Privacy Laws in Canada: PIPEDA, Law 25, PHIPA and What Bill C-36 Would Change

A customer asks how you store their data. A US partner sends a form asking which privacy law you follow. Or you've just read that Ottawa wants fines of up to $25M. Every one of those moments ends with the same search: what are the privacy laws in Canada, and which ones are mine?

Short answer: Canada has no single privacy law. Most private businesses fall under the federal PIPEDA. Businesses in Quebec, Alberta and British Columbia follow their own provincial law for activity inside the province, health providers usually follow a provincial health law such as Ontario's PHIPA, and government bodies follow public-sector laws. Bill C-36 would replace PIPEDA's privacy rules with tougher ones, but as of 2026-10-25 it hasn't passed second reading, so PIPEDA is still the law.

This guide gives you the map in one screen, then translates it into what your systems have to prove: breach records, consent, assessments before data leaves the province or the country, and a named person in charge. It's written for owners and IT people, not lawyers.

Not sure where you stand? Our free compliance readiness assessments take a few minutes, including one for Quebec Law 25, and show your gaps before you spend anything.

What are the privacy laws in Canada?

Canadian privacy laws split two ways: federal vs provincial, and public sector vs private sector. Here's the short list most organisations need.

The OPC lists Alberta, BC and Quebec as the three provinces whose private-sector laws are "substantially similar" to PIPEDA, and Ontario, New Brunswick, Newfoundland and Labrador and Nova Scotia as the four with substantially similar health laws (OPC summary of privacy laws in Canada). "Substantially similar" matters because PIPEDA s.26(2)(b) lets Ottawa exempt activity covered by those laws, but only activity that happens inside that province (PIPEDA).

That's the whole structure. Everything else is detail.

What is PIPEDA in Canada?

PIPEDA, the Personal Information Protection and Electronic Documents Act, is the federal private-sector privacy law. Section 4(1) applies it to personal information an organisation collects, uses or discloses "in the course of commercial activities", and to employee data in a "federal work, undertaking or business" such as a bank, airline or telecom carrier.

Its rules live mostly in Schedule 1: ten principles taken from a national standard, covered below. Personal information means "any factual or subjective information, recorded or not, about an identifiable individual" (OPC, PIPEDA in brief).

What does the federal Privacy Act cover?

The Privacy Act is a different law with a confusingly similar name. It governs how federal government institutions handle personal information and gives people the right to see what Ottawa holds about them. It doesn't apply to your business. If you searched "privacy act canada personal information" because a customer asked about their data, PIPEDA or your provincial law is the one you want.

Which privacy law applies to your organisation?

Start with two questions: what kind of organisation are you, and where does the data live and travel? Then find your row.

One rule overrides the map: the OPC says businesses handling personal information that crosses provincial or national borders are under PIPEDA "regardless of which province or territory they are based in." So a Calgary firm sending customer data to a US cloud deals with both Alberta's PIPA and PIPEDA.

Does Ontario have a private-sector privacy law?

No. Ontario has no general private-sector privacy statute, so PIPEDA covers most Ontario businesses' customer data. Ontario's own privacy laws cover health (PHIPA) and the public sector (FIPPA and MFIPPA). If you searched "privacy laws ontario" or "ontario privacy laws private sector", the answer for a Toronto retailer, law firm or software company is PIPEDA.

Does PIPEDA apply in Quebec, or Law 25?

Partly. Inside Quebec, a private business follows the Quebec Act as amended by Law 25. PIPEDA still applies when personal information leaves the province in a commercial transaction, and always applies to federally regulated businesses in Quebec.

Law 25 is the strictest of the private-sector laws in force today. It requires a named person in charge of personal information, whose title and contact details go on your website (s.3.1). It requires a privacy impact assessment for any new or overhauled information system that handles personal information (s.3.3) and before personal information is communicated outside Quebec (s.17). And it requires a register of every confidentiality incident (s.3.8). The data portability right came into force on 2024-09-22, the last phase of the rollout (Bennett Jones). Our Quebec Law 25 compliance page covers the systems side.

Does Canada have HIPAA?

No. HIPAA is a US law and doesn't apply to Canadian organisations treating Canadians. The closest equivalents are provincial health laws such as Ontario's PHIPA, plus PIPEDA for commercial activity. We go province by province in HIPAA in Canada, and our PHIPA compliance page covers health IT.

Which laws cover employee data in the workplace?

This is the gap most people miss. PIPEDA covers employee data only in federally regulated businesses (s.4(1)(b)). Alberta's and BC's PIPA cover employees of private businesses in those provinces, and so does Quebec's Act.

For a provincially regulated private employer in Ontario, no general privacy statute covers employee data. What Ontario does have is a transparency rule: employers with 25 or more employees on January 1 need a written electronic monitoring policy, but the rules "do not establish a right for employees not to be electronically monitored" (Ontario ESA guide).

Picture a 60-person Mississauga distributor that turns on email and laptop monitoring. Its legal duty is to say so in a written policy. It still has to secure that monitoring data properly, because a breach of it becomes everyone's problem.

What are the 10 privacy principles in PIPEDA?

The ten PIPEDA principles sit in Schedule 1, clauses 4.1 to 4.10. Lawyers read them as duties. Your IT team should read them as a build list.

Principle 9 is where most small businesses get stuck. You can't answer an access request in 30 days if nobody knows which of your 14 SaaS tools hold that customer's records. A data inventory fixes that, and it's the first deliverable in our PIPEDA compliance work.

Are there separate internet privacy laws in Canada?

Not for privacy itself. The same laws cover data you collect online: PIPEDA or your provincial law applies to website forms, cookies, analytics and app data. Quebec adds specific online duties. Anyone collecting personal information through technological means must publish a privacy policy in clear and simple language on their website (s.8.2). Tools that can identify, locate or profile a person must be disclosed before use (s.8.1).

So "internet privacy laws in Canada" and "digital privacy laws in Canada" point back to the same table above. The difference is evidence. Online, your cookie banner, tag manager and form fields are the proof.

What information does PIPEDA not cover?

PIPEDA s.4(2) and s.4.01 carve out four things:

• Government institutions covered by the Privacy Act.
• Personal or domestic use. Your personal contact list isn't regulated.
• Journalistic, artistic or literary purposes, as long as the data isn't used for anything else.
• Business contact information (name, title, work email, work phone) used only to communicate with someone about their job, business or profession.

Beyond those carve-outs, the OPC says PIPEDA generally doesn't cover provincial governments, non-profits and charities without commercial activity, or political parties. Provincially regulated employee data falls outside it too. And in Alberta, BC and Quebec, activity inside the province goes to the provincial law instead.

A trap: the business-contact exemption only covers contact details used "solely" to communicate with someone about their job, business or profession. Any other use of the same data falls back under PIPEDA. And Canada's anti-spam law adds its own consent rules for commercial email on top.

Who can disclose personal information without consent?

PIPEDA s.7(3) gives a closed list. Its main items allow an organisation to disclose personal information without the person's knowledge or consent when the disclosure is:

• to its own lawyer (an advocate or notary in Quebec);
• to collect a debt the person owes it;
• required by a subpoena, warrant or court order;
• to a government institution that has identified its lawful authority and asked for the information, for national security, law enforcement, administering a law, or contacting next of kin;
• on the organisation's own initiative to a government institution, when it has reasonable grounds to believe a law has been broken;
• to another organisation, where reasonable for investigating a breach of an agreement or a law, or for detecting, suppressing or preventing fraud;
• to a government institution, next of kin or authorised representative when the organisation suspects financial abuse of the person;
• to someone who needs it in an emergency that threatens life, health or security (and the person must be told in writing without delay);
• for statistical or scholarly research that can't be done otherwise, with the OPC told first;
• to an archive, or once the record is 100 years old or the person has been dead 20 years;
• of publicly available information specified by regulation; or
• required by law.

Anything outside s.7(3) (and the business-transaction rule in s.7.2) needs consent. Notice what isn't on it: "a partner asked nicely", "it helps our marketing", or "the new vendor needs a full copy for testing". Those are the disclosures that turn into complaints.

What constitutes a privacy breach in Canada?

Under PIPEDA, a "breach of security safeguards" is "the loss of, unauthorized access to or unauthorized disclosure of personal information" resulting from a failure of your safeguards, or from not having them (s.2). A stolen laptop, an email sent to the wrong list, a ransomware gang copying your file share, a contractor snooping in records: all breaches.

Not every breach must be reported. You report to the OPC and notify affected people when it's reasonable to believe the breach creates a real risk of significant harm (s.10.1). Significant harm includes humiliation, damage to reputation, financial loss, identity theft and loss of employment opportunities. The test weighs how sensitive the data is and how likely misuse is (s.10.1(7)-(8)).

But you record every breach, reportable or not, and keep each record for 24 months (Breach of Security Safeguards Regulations, s.6). That log is the first thing the OPC asks for.

It happens a lot. In 2025-26 the OPC received almost 700 breach reports from businesses, affecting more than 20 million Canadians, plus 3,044 PIPEDA complaints (OPC, 2026-06-04).

The reporting duty differs by law:

Picture a Montreal and Toronto accounting firm hit by ransomware on a Friday night. Quebec clients' data triggers the CAI and the incident register. Ontario clients' data triggers the PIPEDA test. One incident, two clocks, two regulators. That's normal, and it's why the response plan should name both before anything happens.

What counts as an invasion of privacy?

Outside the statutes, people can sue. In Ontario, the Court of Appeal recognised the tort of "intrusion upon seclusion" in Jones v. Tsige, 2012 ONCA 32. A bank employee had looked at a colleague's banking records at least 174 times over four years. The court required an intrusion a reasonable person would find "highly offensive", set damages at up to $20K for this kind of harm, and awarded $10K (Osgoode Hall commentary).

Several provinces, including BC, Saskatchewan, Manitoba and Newfoundland and Labrador, have privacy statutes that create a right to sue as well (Dolden). For a business the lesson is plain. An insider snooping in records is a breach under privacy law and can also be a lawsuit.

What are the penalties under privacy laws in Canada today?

This is where the laws differ most, and where most summaries get it wrong.

So today a business in Quebec faces real regulatory fines. A business elsewhere under PIPEDA mostly faces investigations, published findings, Federal Court applications and the cost of a breach. That gap is exactly what Bill C-36 is meant to close.

Want one programme that covers PIPEDA, Law 25 and PHIPA at once? Our governance, risk and compliance team maps each law onto the same evidence: one data inventory, one breach log, one set of vendor contracts.

What would Bill C-36 change?

Status as of 2026-10-25: Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts, was introduced and read a first time on 2026-06-15 by the Minister of Artificial Intelligence and Digital Innovation. LEGISinfo lists it as "At second reading in the House of Commons". It has no second-reading vote, no committee study and no royal assent (LEGISinfo).

If passed, C-36 would enact the Protecting Privacy and Consumer Data Act (PPCDA), repeal Part 1 of PIPEDA, and rename what's left the Electronic Documents Act. Some summaries call it the "Consumer Privacy Protection Act". That was the name in the failed Bill C-27. C-36 is the third attempt, after C-11 (2020) and C-27.

Here's what would change, from the Library of Parliament's legislative summary (2026-07-06):

If you run in Quebec, much of that list will look familiar: PIAs before data leaves, automated-decision transparency (Law 25 s.12.1), a named person in charge. C-36 would bring the rest of Canada closer to Quebec.

When would Bill C-36 take effect?

Not soon, and not on a fixed date. PPCDA s.147 says it comes into force by order of the Governor in Council, and not before the part of C-36 that sets up the Commission. That Commission is created by a different bill, C-34, which enacts the Digital Safety Act and the Digital Safety Commission of Canada Act. C-34 is also only at second reading (LEGISinfo C-34).

So two bills have to pass, then a commission has to be built, then a cabinet order has to set the date. Until then, PIPEDA stays in force and the OPC keeps enforcing it. The government's own backgrounder gives no in-force date and promises consultation on the move to the new regulator.

Should you wait for Bill C-36 before doing anything?

No, and here's the practical reason. Almost everything C-36 would add (a written programme, a data inventory, breach discipline, vendor contracts, PIAs before data moves) is work PIPEDA's principles already imply and Law 25 already requires. If you do it now, you're compliant today and most of the way ready for C-36. If you wait, you'll be doing it under a deadline with fines attached.

Provincial reform is moving too. Alberta ran a public survey on updating its PIPA from February 2 to 17, 2026 and is consulting its commissioner, with no bill yet (Government of Alberta).

What should your IT team build now?

Whatever law applies, the evidence a regulator asks for looks the same. Six things, in order:

1. A data inventory. Every system, SaaS tool and backup that holds personal information, what it holds, why, where it's stored and who can reach it. Without it, access requests, retention and breach scoping are guesswork.
2. A named accountable person. PIPEDA principle 1 expects one. Law 25 requires one and wants their title on your website.
3. A breach log and a tested response. Record every incident for 24 months, decide reportability against the right test for each province, and rehearse it once a year. Our managed security services team runs detection and the first hours of response.
4. Vendor contracts that match the law. Who processes what, where, with breach notice back to you. Our third-party risk page covers the review.
5. Assessments before data moves. A privacy impact assessment before a new system, a cloud move or a transfer out of Quebec, and soon, if C-36 passes, out of Canada.
6. Retention that deletes. Scheduled jobs that remove data when its purpose ends, with proof they ran. Pair them with identity and access management so only the right people see what remains.

Picture a 40-person Ottawa software firm with customers in all ten provinces. It doesn't need five programmes. It needs one inventory, one log and one set of contracts, then a short appendix per law covering the clocks and regulators that differ. That's how a small team keeps up.

Frequently asked questions

Which law governs privacy in Canada?

There isn't one. PIPEDA governs most private businesses. Quebec, Alberta and BC have their own private-sector laws for activity inside those provinces. The Privacy Act governs federal institutions, and provincial laws cover health and the public sector.

What are the most common privacy laws in Canada?

For businesses: PIPEDA, Quebec's private-sector Act as amended by Law 25, and Alberta's and BC's PIPA. For health: Ontario's PHIPA and the other provincial health laws. For government: the federal Privacy Act and provincial FIPPA-type laws.

Is PIPEDA being replaced?

It's proposed. Bill C-36 would replace PIPEDA's privacy part with the Protecting Privacy and Consumer Data Act, but it's still at second reading in the House as of 2026-10-25. PIPEDA remains the law until C-36 passes and a separate order brings it into force.

Does PIPEDA apply to small businesses?

Yes. There's no size exemption. PIPEDA applies to any organisation handling personal information in commercial activity, from a two-person shop to a bank. The C-36 backgrounder says the new regulator would consider the needs of small and medium businesses, but it doesn't exempt them.

Do I need a privacy policy on my website in Canada?

In practice, yes. PIPEDA's openness principle requires you to make your privacy practices readily available, and a website policy is the usual way. In Quebec it's explicit: if you collect personal information through technological means, you must publish a privacy policy in clear and simple language on your website (s.8.2).

What should you do next?

Find your row in the decision table, then check the six IT items against your own systems. If two of them are missing, start with the data inventory, because every other item depends on it. Then put Bill C-36 on your calendar as a watch item, not a reason to wait.

We help organisations in Toronto, Montreal and Ottawa, and remotely across Canada, turn these laws into systems that prove compliance. Talk to us about a privacy review of your environment.

This article explains Canadian privacy law in general terms as of 2026-10-25. It isn't legal advice. For a decision about your organisation, talk to privacy counsel.