The British Columbia Freedom of Information and Protection of Privacy Act (FIPPA/FOIPPA) is BC's privacy law for the public sector. It applies to BC public bodies, including provincial government ministries, municipalities, Crown corporations, school boards, health authorities, universities, local police, and self-governing professional bodies.
FIPPA covers access to information and the protection of personal information held by BC public bodies: provincial government ministries, municipalities, Crown corporations, school boards, health authorities, universities, local police, and self-governing professional bodies.
Since February 2023, public bodies must have a privacy management program (PMP). They must also notify the BC OIPC and affected individuals without unreasonable delay when a breach could reasonably result in significant harm. Individuals who fail to report unauthorized disclosures face fines up to $50K, and corporations up to $500K.
The 2021 amendments removed the general rule that personal information must stay in Canada. A privacy impact assessment is still required for every initiative, with a documented risk assessment before sensitive personal information is stored outside Canada.
Official source: https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/96165_00
ThreeShield's CISSP- and CISA-certified assessors run the BC FIPPA engagement, and Lavawall® collects the technical evidence continuously, so your posture is current the day an auditor, insurer, or client asks for it, not just at renewal.
Fines up to $500K for corporations and $50K for individuals who fail to report unauthorized disclosures.
| BC FIPPA requirement | Lavawall® collects | ThreeShield delivers |
|---|---|---|
| Multi-factor authentication status | ✓ Continuously | — |
| Patch and vulnerability posture | ✓ Continuously | — |
| Encryption at rest and in transit | ✓ Continuously | — |
| Access and audit-log review | ✓ Continuously | — |
| Risk assessment and scoping | ⚑ Platform data | CISSP/CISA-led |
| Policies, procedures, and evidence package | — | Written by ThreeShield |
It does if you are a BC public body, such as a provincial ministry, municipality, Crown corporation, school board, health authority, university, local police force, or self-governing professional body. We confirm scope in the first call, at no charge.
A gap assessment against BC FIPPA usually takes a few weeks. Closing the gaps and standing up the evidence takes longer, and that is where most of the work sits, so the total depends on your starting point. Because Lavawall® is already collecting the technical evidence while we work, you do not restart from zero at reassessment.
Yes. Many clients begin self-serve on Lavawall®, then bring in ThreeShield for the assessment, the policies, and the sign-off once they know where the gaps are. The three engagement models below are meant to be moved between.
ThreeShield meets you at your current security maturity. Every level includes Lavawall®.
For lean IT teams and cost-conscious organizations with internal security capacity
Expert guidance alongside your team, ideal for MSPs and organizations with some internal IT capacity
Full compliance delivery, managed end to end by ThreeShield
Choose your engagement model: DIY via Lavawall®, supported by ThreeShield's CISSP/CISA team, or fully done-for-you. Every model includes continuous monitoring, so you stay compliant between audits.
Book a Scoping CallDIY · Supported · Done-for-You