Slide Content
Add your content here. You can use HTML formatting like bold, italic , lists, images, and more.
Privacy expectations continue to evolve across the United States, Canada and Mexico. Regulators, enterprise customers, insurers and investors increasingly expect organizations to demonstrate how privacy commitments work in practice, not simply publish them.
This article walks through five areas of privacy readiness, with two questions embedded in each section. Answer as you read, then receive a score and a practical action list.
How scoring works:
Yes = 3 points (in place, documented and provable); Partly = 1 point (some implementation, but gaps or missing evidence); No = 0 points (not in place or unknown). Maximum: 30 points. This is a self-assessment, not a legal compliance determination.
0 of 10 answered
North America’s privacy landscape at a glance
There is no single law covering every organization across North America. Applicability depends on the people whose data you process, the jurisdiction, and the processing activity.
| Country | Current landscape | What to watch |
|---|---|---|
| United States | State comprehensive privacy laws plus sector-specific rules | Different thresholds, individual rights and opt-out obligations across states |
| Canada | Federal PIPEDA and relevant provincial laws, including Quebec, Alberta and British Columbia | Proposed federal reforms, including Bill C-36 as described in the source checklist; verify its status before publication |
| Mexico | New private-sector data protection law effective March 21, 2025, as described in the source checklist | Updated regulatory oversight and implementation requirements |
The North American privacy landscape
Privacy obligations depend on whose data you handle, where those individuals live, and what you do with their information. There is no single privacy law covering all of North America. In the United States, state comprehensive privacy laws operate alongside sector-specific requirements. In Canada, PIPEDA and relevant provincial laws apply, while proposed federal reforms may change expectations. Mexico introduced a new private-sector data protection law in 2025. A readiness program starts with understanding the rules that actually apply to your organization.
Readiness check 1 of 10 · Accountability
Choose “Yes” only if you can provide evidence of this practice.
Readiness check 2 of 10 · Applicable laws
Choose “Yes” only if you can provide evidence of this practice.
Know what data you collect and what you disclose
Privacy notices and internal inventories need to reflect real operational behavior. That includes website technologies, applications, employee systems, vendors and AI tools. An accurate inventory makes it easier to assess where personal information goes, which purposes it serves and whether your disclosures are up to date.
Readiness check 3 of 10 · Data inventory
Choose “Yes” only if you can provide evidence of this practice.
Readiness check 4 of 10 · Notices that match practice
Choose “Yes” only if you can provide evidence of this practice.
Verify consent and protect higher-risk information
A consent banner can record a preference without proving that every downstream tag or data transfer honored it. Test what happens when visitors decline, withdraw consent or send applicable opt-out signals. Sensitive and children’s information also calls for heightened attention and safeguards.
Readiness check 5 of 10 · Consent, cookies and digital tracking
Choose “Yes” only if you can provide evidence of this practice.
Readiness check 6 of 10 · Sensitive and children’s information
Choose “Yes” only if you can provide evidence of this practice.
Make vendor oversight and individual rights operational
Privacy compliance extends beyond your own systems. Vendors may store or access personal information in other jurisdictions, and individuals may exercise access, correction, deletion or opt-out rights. Documented procedures matter, but end-to-end testing shows whether they work.
Readiness check 7 of 10 · Vendors and cross-border transfers
Choose “Yes” only if you can provide evidence of this practice.
Readiness check 8 of 10 · Individual rights
Choose “Yes” only if you can provide evidence of this practice.
Build privacy into change management and incident response
New technologies, AI tools and data uses can introduce new privacy risks. Retention and deletion should be part of normal operations. Incident response also needs rehearsed procedures so teams can identify applicable notification obligations quickly.
Readiness check 9 of 10 · Privacy by design, retention and AI
Choose “Yes” only if you can provide evidence of this practice.
Readiness check 10 of 10 · Incident readiness
Choose “Yes” only if you can provide evidence of this practice.
Your privacy readiness results
Answer all 10 questions to calculate your score and get a prioritized action list.
0 / 30
Book your complimentary private executive briefing
Areas to strengthen
One final test: If a regulator, major client, insurer or investor asked for evidence of your privacy program tomorrow, could you provide it within 48 hours? If not, use your gaps as a roadmap.
Turn your answers into action
Privacy readiness is not a one-time project. Websites change, vendors change and legislation evolves. Repeat this assessment at least annually and after major operational changes. Focus first on areas marked “No,” then close evidence gaps in areas marked “Partly.”
For website consent in particular, make sure you can verify what tags and pixels actually do after a user declines or withdraws consent. Independent monitoring can help connect privacy policies and consent records to observed site behavior.
Editorial note: This article adapts the supplied “Privacy in North America: A 10-Question Readiness Check.” The legal landscape can change. Confirm the status of Bill C-36 and current legal requirements with qualified counsel before publication. The score is an operational self-assessment, not legal advice or a certification of compliance.
