Kristen Pennington

Bio

Kristen Pennington maintains a dynamic practice in privacy and data protection law. She assists emerging and established companies across a range of industries, providing insights into Canada’s distinct laws in these disciplines to support businesses entering or investing in the Canadian market. She also regularly collaborates with international counsel to advise on the Canadian privacy law considerations of multijurisdictional projects.

As a Certified Information Privacy Professional / Canada (IAPP), Kristen counsels clients on a wide variety of privacy and data security issues, including cross-border transfers of personal information, preventing and responding to data breaches, conducting privacy impact assessments, and evaluating the privacy law implications of new products, services, technologies and initiatives, including AI tools.

Kristen helps clients develop robust privacy compliance programs, including policies governing employees’ handling of personal information, data subject rights requests and vendor management, and frequently drafts privacy policies, cookie banners, consent forms, photo and video waivers, and acceptable use policies.

Kristen has significant experience negotiating the privacy and data protection terms in an array of commercial agreements, including contracts with customers and vendors who handle personal information, as well as data sharing agreements with affiliates and other third parties.

Working with employers, Kristen advises on employee privacy issues, including conducting background checks, developing employee privacy policies and notices, collecting employees’ health and diversity-related information, engaging in employee monitoring, providing privacy-related training to personnel, and selecting and engaging payroll and other service providers who handle employees’ personal information.

Kristen also regularly assists vendors and purchasers with assessing the privacy law implications of corporate transactions, including conducting due diligence on the privacy and data protection practices of target companies and negotiating the terms of purchase agreements.Where needed, Kristen counsels clients on responding to complaints and investigations by privacy regulators regarding compliance with Canadian privacy laws.

Kristen is regularly quoted on emerging privacy and data protection issues, including in leading sources such as the Canadian Bar Association National Magazine, Canadian Lawyer Magazine and Canadian HR Reporter. She co-authored the 2021 and 2022 Canadian chapters of the International Comparative Legal Guide to Data Protection, and has recently had her publications featured in the Canadian Privacy Law Review and Internet and E-Commerce Law in Canada, among other notable publications. Kristen was recognized by Chambers Canada (2025) as a leading lawyer in the area of Privacy & Data Protection and shortlisted for the Rising Star Award at the inaugural North American PICCASO Awards.