At PULP, compliance is not treated as a checklist. It is embedded into how we operate across information security, lifecycle management, and sustainability.
We align with recognized Canadian and global frameworks to ensure that information, materials, and systems are handled responsibly, securely, and sustainably.
Security today is not isolated.
It spans:
Our approach integrates these domains into a connected operating model, with compliance applied across each layer.
How we approach data protection across physical and digital environments
(Canada)
What it is: Federal law governing how organizations handle personal information.
Why it matters: Establishes baseline expectations for data privacy, consent, and protection.
PULP Application: Applies to all client and operational data handled across services.
(Alberta)
What it is: Provincial law regulating the collection and use of personal information.
Why it matters: Defines how organizations operating in Alberta manage privacy.
PULP Application: Directly governs PULP’s operations in Alberta.
(Global Standard)
What it is: Global benchmark for privacy and data protection.
Why it matters: Sets expectations for transparency, rights, and responsible processing.
PULP Application: Informing global best practices and cross-border engagements.
(Personally Identifiable Information)
What it is: Any data that can identify an individual.
Examples: Names, contact information, financial data
PULP Application: Treated as sensitive across its lifecycle.
Data is handled with defined access and control
Physical and digital information are protected consistently
Responsibility is shared between PULP and clients
Understanding what must be protected and why
(Canada)
What it is: Rules for retaining financial and tax records.
Why it matters: Ensures compliance and audit readiness.
PULP Application: Supports retention and secure destruction timelines.
(Alberta)
What it is: Law governing health-related personal information.
Why it matters: Protects sensitive health data.
PULP Application: Guides handling where health data is involved.
(Definition)
Includes:
Secure chain-of-custody from handling to destruction
Regulated retention aligned with legal requirements
Unified handling across paper and digital data
Managing risk across systems and users
What it is: Structured approach to managing cyber risk
(Identify, Protect, Detect, Respond, Recover)
PULP Application: Guides cybersecurity services and risk mitigation
What it is: Canada’s national cybersecurity authority
PULP Application: Aligns with Canadian baseline security recommendations
What it is: Practical set of prioritized cybersecurity actions
PULP Application: Supports measurable improvement in SMB environments
Security is focused on risk reduction, not guarantees
Systems, users, and configurations are all part of security
Cybersecurity integrates with physical information handling
Protecting information across its physical lifecycle
(International Secure Information Governance & Management Association)
What it is: A global industry association representing providers of secure information lifecycle services.
iSIGMA was formed through the combination of:
👉 NAID established the original global standards for secure information destruction, including requirements for:
iSIGMA continues to maintain and evolve these standards across both physical and digital information lifecycle services.
PULP is a member of iSIGMA and aligns its operations with iSIGMA/NAID best practices for:
🔗 Learn more about iSIGMA standards:
https://www.isigmaonline.org/
🔗 About NAID standards (within iSIGMA):
https://www.isigmaonline.org/about-isigma/naid/
What it is: Controlled tracking of materials from collection through final destruction
PULP Application: Ensures no unauthorized access, loss, or exposure
Materials are handled securely at every step
Physical and digital security are aligned
Destruction processes follow recognized industry practices
Managing impact across the lifecycle of materials
(SDGs)
What it is: Global framework for sustainable development
PULP Application: Guides long-term environmental and community initiatives
(EPR — Canada)
What it is: Responsibility for lifecycle and disposal of materials
PULP Application: Drives recycling, recovery, and waste reduction
What it is: Provincial framework for waste and environmental protection
PULP Application: Governs material handling and disposal
(FSC Canada)
What it is: Standards for responsible forestry and paper lifecycle
PULP Application: Supports recycling and circular use of materials
Materials are diverted from landfill where possible
Recycling and recovery are prioritized
Sustainability is embedded into operations
These frameworks are not applied separately.
They are integrated across:
Canadian Federal & Alberta Frameworks (Plus Key Global Standards)
| Standard / Regulation | Level | What It Is | PULP Relevance | Link |
|---|---|---|---|---|
| PIPEDA | Federal | Governs how private-sector organizations handle personal data | Core framework for all data handling across PULP services | |
| PIPA (Alberta) | Provincial | Regulates collection and use of personal information | Applies directly to PULP operations in Alberta | |
| GDPR (EU) | Global | Global benchmark regulation for personal data protection | Guides best practices for global compliance and privacy design | |
| PII (Personally Identifiable Information) | General Standard | Data that identifies an individual | Treated as sensitive across all PULP services |
| Standard / Regulation | Level | What It Is | PULP Relevance | Link |
|---|---|---|---|---|
| CRA Recordkeeping Requirements | Federal | Defines retention periods for financial and tax records | Guides storage and destruction timelines | |
| HIA (Health Information Act – Alberta) | Provincial | Governs health-related personal information | Applies when handling health-sensitive documents | |
| Confidential Documents (Classification) | Operational | Includes financial, legal, payroll, customer, and health data | Default classification used in PULP operations | N/A |
| Standard / Framework | Level | What It Is | PULP Relevance | Link |
|---|---|---|---|---|
| NIST Cybersecurity Framework | Global | Structured approach to cybersecurity risk management | Guides PULP cybersecurity services and methodology | |
| Canadian Centre for Cyber Security | Federal | National authority for cybersecurity practices and threat intelligence | Provides baseline for Canadian cyber protection standards | |
| CIS Critical Security Controls | Global | Practical set of prioritized cybersecurity actions | Enables measurable risk reduction for SMB clients | |
| PII (Personally Identifiable Information) | General Standard | Data that identifies an individual | Treated as sensitive across all PULP services |
| Standard / Framework | Level | What It Is | PULP Relevance | Link |
|---|---|---|---|---|
| iSIGMA / NAID Standards | Global Industry | Standards for secure information destruction and lifecycle management | Guides shredding, handling, transport, and destruction practices | |
| Chain-of-Custody Practices | Industry Best Practice | Ensures materials are securely tracked from start to destruction | Core operational control in PULP services | N/A |
| Standard / Regulation | Level | What It Is | PULP Relevance | Link |
|---|---|---|---|---|
| UN Sustainable Development Goals (SDGs) | Global | Framework for sustainable development | Guides PULP sustainability and community initiatives | |
| Extended Producer Responsibility (EPR) | Federal / Provincial | Assigns responsibility for lifecycle of materials | Supports recycling and waste reduction practices | |
| Alberta Environmental Regulations | Provincial | Governs waste management and environmental impact | Applies to material processing and recycling | |
| FSC Canada (Sustainable Forestry) | Global / Canada | Promotes responsible sourcing and forestry practices | Relevant for paper lifecycle and recycling |
