How to Designate a Person Responsible for Personal Information Protection (RPRP)

Step-by-step process

Decide: yourself or someone else?

By default, it's you (the executive). If delegating, the CAI recommends choosing someone with significant decision-making authority and the necessary skills. Continue to step 2 if delegating, otherwise skip to step 4.

Draft the delegation document

Download our template. Fill in: delegate's name, date, delegated responsibilities. Sign electronically or on paper.

Have the delegate sign

The delegate must accept and sign, electronically or in writing. Give them a signed copy. File the original with your compliance documents.

Publish on your website

Add to your privacy policy or contact page: 'Person responsible for personal information protection: [email]'. The name is not required.

Inform your team

Send an email to your employees: 'Privacy questions and access requests go to [name/email].' That's it.

Common mistakes

Forgetting to publish. No contact info on your website = violation.
Delegating without documentation. If audited, you must prove who the RPRP is.
Appointing someone without authority. The RPRP must be able to act, not just hold the title.

Frequently asked questions

I'm self-employed. Do I need to designate myself as RPRP?

Yes, but it's automatic, you're the RPRP by default. Simply publish your contact information on your website.

Can I appoint an external consultant?

Yes. Use the same delegation document. You remain legally responsible, but the consultant handles operations.

Do I need to notify the CAI?

No. No registration required. Internal documentation and publishing on your website is sufficient.

My RPRP is leaving. What do I do?

The role automatically reverts to you. Update your website the same day. Appoint a replacement as soon as possible.

Where can I find the detailed legal requirements?

See our guide on the RPRP designation obligation for the legal text and complete requirements.