Procedure
Privacy Impact and Cross-Border Transfer Procedure
This procedure defines the process for conducting Privacy Impact Assessments (PIAs), AI Impact Assessments (AI-IAs), and Cross-Border Data Transfer Assessments to identify, evaluate, and mitigate privacy and data protection risks associated with data processing activities, including AI training and inference operations.
- Type
- Procedure
- Version
- 1.6.13
- Date
- 2026-10-26
- Owner
- Data Protection Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Privacy
- Review frequency
- Annual and upon material privacy, regulatory, or AI governance change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Scope
- Governance and accountability
- Procedure
- Children's data protection
- Framework alignment
Frameworks it maps to
- ISO/IEC 27701:2025 Annex A.1.2.6
- GDPR Article 35
- EU AI Act Annex IV
- Treasury Board Directive on Automated Decision-Making, section 6.1 (Algorithmic Impact Assessment; federal institutions subject to the Policy on Service and Digital)
- Quebec Law 25 (CQLR c. P-39.1) sections 3.3 and 12.1 (private sector)
- CSA CCM v4.1 DSP-09
- CSA CCM v4.1 DSP-10
- ISO/IEC 42005:2025
Related documents
- Privacy and Data Governance Policyprivacy
- DPIA (Data Protection Impact Assessment) Templateprivacy
- Transfer Impact Assessment (TIA) Templateprivacy
- AI Security and Risk Standardai
- Information Security Policysecurity
- Records Retention and Destruction Standardgovernance
Next
All Documents