What Principle 7 requires
The OPC states the obligation as protecting personal information in a way that is appropriate to how sensitive it is, and protecting all personal information regardless of how it is stored against loss, theft, or any unauthorized access.
Three categories of safeguard are named: physical measures such as locked cabinets and restricted offices; technological tools such as passwords, encryption, firewalls and security patches; and organizational controls such as security clearances, limiting access, staff training and agreements. The OPC also states plainly that PIPEDA does not specify particular security safeguards that must be used.
"Appropriate to how sensitive it is" does the real work
This is the sentence that scales the obligation to your business. A mailing list and a database of financial or health records are not owed the same protection, and the same control can be adequate in one system and negligent in another.
It also means you cannot answer the question by naming tools. Whether your safeguards are appropriate depends on what you hold, so the defensible position is a documented assessment of the data and the controls protecting it, revisited when either changes.
Technological safeguards are the testable ones
Physical and organizational safeguards are audited by inspection and interview. Technological safeguards are the category you can actually test, and testing is the only way to know whether the control you configured is the control you have.
Security patches are listed as a technological safeguard, which is a useful detail: a missing patch on a system holding personal information is not merely a hygiene issue, it is a gap against a named example in the Principle.
Where PIPEDA ends and other obligations begin
PIPEDA is federal and private-sector. Ontario health information custodians are governed by PHIPA for personal health information. Some provinces have their own substantially similar private-sector laws, and public bodies are covered by separate legislation.
If you operate in Ontario and hold health data, assume both PIPEDA and PHIPA are in play depending on the information, and get advice on which applies to which dataset. That determination is legal advice and CyberArc does not provide it.