PIPEDA Data Compliance with Streamdal

We're updating our documentation, so the presented info might not be the most recent.
Beta

The data compliance features of Streamdal are currently in beta, and being tested with a select group of contributors, companies, and design partners. If you would like to participate in the beta, please reach out to us.

Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) regulates how private businesses handle personal information during commercial activities. It aims to strike a balance between individual privacy rights and the operational needs of businesses to utilize such data.

Streamdal is a powerful tool to help keep your data compliant with PIPEDA principals.

Streamdal’s Approach

You can leverage Streamdal for:

Limiting Data Collection: The Streamdal SDK can enforce rules on consumers and producers to reject data or alert you if it contains more personal data than what is necessary, ensuring data minimization.

Data Accuracy: Along with the rules you can set up to limit the collection of data, the SDK can validate and filter for specific fields of data.

For example: you could set up rules to validate fields such as time, name, social security number, and much more to ensure information is present and accurate.

Enforcing Data Policies and Safeguards: Because the SDK executes your rules and pipelines as data is being produced or consumed, you will be able to mask, obfuscate, and otherwise enforce PII handling policies before it moves through your system - and every step afterward as needed.

Coming Soon: A visual guide on setting up PIPEDA-specific rules in the Console UI.

Regulatory Insights

We wanted to make researching the relevant data regulations easier and give a better idea of where Streamdal could be the most impactful for your organization. In most cases, the combination of the observability and data governance capabilities will ensure successful compliance.

While more principles could be applicable, below are a few taken from The Office of the Privacy Commissioner of Canada’s “PIPEDA in brief”1 along with how Streamdal can help with data compliance:

PrincipalsHow Streamdal Helps Comply
(4) Limiting collectionThe Streamdal SDK can enforce rules on consumers and producers to reject or alert on data if it contains more personal data than what is necessary, ensuring data minimization.
(6) AccuracyRules and Pipelines can be attached to producers and consumers to ensure data is valid and accurate and alert for anomalies.

For example, you could create rules to filter for e-mail address, phone number, IP address, and other sensitive fiends like those listed above in our approach, and much more to ensure data is valid.
(7) SafeguardsYou can physically apply your data safeguards to producers and consumers handling sensitive data by creating rules and attaching them as pipelines.

From the Console UI (or Streamdal CLI), you can periodically audit real-time data with Tail to ensure data is flowing within the necessary safeguards.
Information

Did you know:

The Office of the Privacy Commissioner of Canada suggests the following checklist for ensuring data accuracy:

  • List the specific items of personal information you need to provide a service.
  • List where all related personal information can be found.
  • Record the date when the personal information was obtained or updated.
  • Record the steps taken to verify the accuracy, completeness, and timeliness of the information. This may require reviewing your records or communicating with your customer2.

Footnotes

  1. Office of the Privacy Commissioner of Canada. (2019). PIPEDA in brief [Sections (4) Limiting Collection; (6) Accuracy; (7) Safeguards]. https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief/ ↩

  2. Office of the Privacy Commissioner of Canada. (2021). PIPEDA Fair Information Principle 6 – Accuracy: Tips. https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/p_principle/principles/p_accuracy/ ↩