Ontario's privacy obligations, and where testing fits.

The Personal Health Information Protection Act, 2004 governs health information custodians in Ontario. Section 12(1) requires the custodian to take steps that are reasonable in the circumstances to protect personal health information against theft, loss and unauthorized use or disclosure, and to protect records against unauthorized copying, modification or disposal.

It is a reasonableness standard with no prescribed technology, which means it is assessed after an incident against what a comparable custodian would have done. Section 12(2) adds the notification duty where information is stolen, lost, or used or disclosed without authority. The Information and Privacy Commissioner of Ontario oversees PHIPA and publishes the guidance and decisions worth reading.

PIPEDA is the federal private-sector privacy law applying to most commercial activity. Its security obligation is Principle 7, Safeguards: protect personal information in a way appropriate to how sensitive it is, and protect all personal information regardless of storage format against loss, theft or unauthorized access.

It names three categories of safeguard, physical, technological and organizational, and the Office of the Privacy Commissioner of Canada states plainly that PIPEDA does not specify particular safeguards that must be used. Security patches appear among the named technological examples, which makes a missing patch on a system holding personal information a gap against a cited example rather than a hygiene matter.

Neither statute will tell you to run a test. Both will be applied against what a comparable organization would have done, which is a moving line set by practice rather than by legislation.

That is the argument for testing before an incident rather than after. The question a regulator asks is what steps you took, and a dated report naming its scope is a direct answer. "Nobody required it" has never satisfied a reasonableness standard.

Privacy law is the floor, not the ceiling. Sector and contractual obligations frequently apply at the same time, and these are usually the more specific of the two.

CyberArc is based in Toronto and is the trade name of 17750692 Canada Inc., a federally incorporated Canadian corporation. The agreement is under Canadian law.

Data handling is PHIPA-aware: client data is processed on local AI models by default, and cloud AI tools are used only with the client's written consent. For an organization whose own obligation is to protect the data, a supplier whose handling is agreed in writing before access is granted is the shorter path.