CAN/DGSI 133

This document specifies organizational requirements for managing individuals’ consent for the collection, use and disclosure of their data. It establishes processes for informing individuals, supporting their choices, maintaining accurate and current consent states, and enabling consent updates or withdrawal, recognizing that consent preferences evolve over time and require ongoing engagement responsive to changing context, expectations, trust and cultural norms. The specified requirements apply in both conventional and technology-intensive environments, including those that use artificial intelligence (AI) and other emerging technologies that may introduce new or changing data practices.