Privacy & Security Consulting in Manitoba

Manitoba private-sector businesses are governed by Canada's federal privacy law, PIPEDA, with oversight from the Office of the Privacy Commissioner of Canada. PIPEDA's ten fair information principles set the standard for how organizations collect, use, and disclose personal information in commercial activity — and they place real obligations on businesses that have not formalized their practices. Breach notification is among the most operationally demanding: when a security incident creates a real risk of significant harm, organizations must report to the Privacy Commissioner and notify affected individuals, and must maintain records of all breaches regardless of whether notification was required. For Manitoba's health sector, The Personal Health Information Act (PHIA) adds a separate layer, governing how trustees — hospitals, physicians, pharmacies, and health agencies — handle personal health information, with oversight from the Manitoba Ombudsman.

Privacy Horizon works with Manitoba organizations to translate those requirements into programs that function in practice. Most businesses we work with are not starting from zero — they have some policies in place, some informal practices around data handling, and a general awareness that privacy matters. What they typically lack is the documented accountability framework, the vendor management process, the incident response procedure, and the internal training that turn awareness into a defensible program. Our advisors close that gap methodically, without creating more complexity than the organization needs.

The services we provide in Manitoba reflect the full range of what organizations here actually require. Privacy and security coaching builds internal capability in teams fielding data questions without dedicated expertise. Policy development produces a documented framework that demonstrates accountability to regulators and to enterprise customers conducting vendor assessments. Virtual Privacy Officer and Virtual CISO arrangements provide ongoing senior guidance without the overhead of a permanent hire. When acquisitions are on the table, our M&A due diligence work ensures that privacy risk is part of the commercial conversation before a transaction closes. Custom training ensures that the people handling personal information understand their obligations clearly — and know what to do when something goes wrong.