Prioritizing privacy by design: SSC’s ATIP Division leads the way
Data Privacy Week is observed annually and will take place this year from January 26 to 30, with Data Privacy Day held on January 28. The theme for 2026 is Prioritize privacy by design, and it calls on public servants to embed privacy at the outset of projects and technology adoption. Doing so reduces risk, supports compliance and strengthens trust in government services.
Why this matters
As the main provider of IT services to the Government of Canada (GC), Shared Services Canada (SSC) plays a critical role in enabling secure, privacy-conscious digital services. Every new program or technology has privacy implications. When privacy is considered early, projects move faster and outcomes are stronger. At SSC, the Access to Information and Privacy (ATIP) Division helps make this possible by providing expert guidance and innovative tools.
Innovation in action
To prioritize privacy by design in technology adoption, the ATIP Division developed the technology assessment for privacy implications (TAPI) tool. TAPI was created in response to updated federal privacy policies that shifted traditional privacy impact assessments (PIAs) to focus on programs rather than technologies.
Recognizing this gap, SSC introduced TAPI to ensure enterprise technologies are assessed for privacy risks before launch. TAPI complements program-level PIAs by providing a reusable reference for programs adopting assessed solutions.
The first TAPI was completed for Microsoft 365 E5, setting a government-wide benchmark for privacy by design.
“The TAPI for M365 has been an invaluable resource for the Courts Administration Service, offering a clear and structured view of privacy considerations within the M365 E5 environment. It has helped us understand key risks, controls and mitigation measures, supporting informed, high-level decision-making. We deeply appreciate SSC’s expertise, responsiveness and collaborative approach throughout the process. This work represents a meaningful contribution to advancing privacy governance.”
Since then, this first TAPI has been consulted more than 275 times, helping departments adopt technologies responsibly and consistently. GC departments and agencies can now consult completed TAPIs for technologies used across multiple institutions, providing a reference for program-level PIAs.
View a completed TAPI or discuss one in progress
If your organization would like to view a completed TAPI or discuss one in progress, reach out to SSC’s ATIP Policy and Governance team. Early engagement helps apply privacy by design, identify risks sooner, and choose the right path forward.
Benefits to Canadians
By assessing technologies before they are introduced, TAPI helps prevent privacy risks that could affect personal information. This proactive approach means Canadians can trust that the digital tools powering government services are designed with privacy in mind.
Learn more
