Last reviewed 2026-10-20
First edition, partly verified. Every rule here links to the source we opened, and what we could not confirm is listed in the “not verified” section near the end. An independent legal and tax review is still to come: treat this as a research starting point.
This guide is for a company outside Canada that collects, stores or processes personal information about people in Canada, and for Canadian companies that send such data abroad. It goes deeper than the privacy section of Working with Canadian Companies, which has the penalty figures and a side-by-side table; those are not repeated here. If you sell to US customers from Canada, see Selling to the US from Canada for the other direction.
Research limits: the tool budget ran out mid-run, so Alberta and British Columbia law, CASL and the AI rules could not be checked against primary sources. They are listed under "What this guide did not verify" rather than described from memory.
1. The map: federal law and three provincial laws
Canada's federal private-sector law is the Personal Information Protection and Electronic Documents Act (PIPEDA). According to the Office of the Privacy Commissioner (OPC), it governs how private-sector organizations collect, use and disclose personal information in commercial activities across Canada, and also covers the employee information of federally regulated businesses. It rests on ten principles in its Schedule 1: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access and challenging compliance (OPC overview).
| Question | Answer, per the OPC overview |
|---|---|
| Which provinces have their own private-sector law? | Alberta, British Columbia and Quebec; those laws are deemed substantially similar to PIPEDA |
| Which law applies inside those provinces? | The provincial law generally replaces PIPEDA for collection, use and disclosure within the province |
| What about data crossing provincial or national borders? | PIPEDA covers it, even in those provinces |
| Which organizations are always under PIPEDA? | Federally regulated ones such as airlines, banks and telecommunications companies, and organizations in the three territories |
| Other laws? | Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador have substantially similar laws for personal health information |
| Exclusions | Business contact information used solely to communicate with a person in their job, purely personal use, journalistic, artistic or literary purposes; many non-profits are outside PIPEDA unless they carry on commercial activity |
Source for the whole table: OPC.
2. Does it reach a foreign company?
The OPC overview speaks of businesses that "operate in Canada" and does not address organizations based abroad. Whether PIPEDA applies to a foreign company with no Canadian presence that collects data from people in Canada was not confirmed on any page opened. Do not assume you are outside it. The safer planning view: if you target Canadians, hold their data or use a Canadian processor, treat PIPEDA (and Law 25 for Quebec residents) as applicable, and ask counsel to confirm.
3. Breach reporting under PIPEDA
The statute is clear on the core duties (PIPEDA ss. 10.1 to 10.3):
- Report to the Commissioner when it is reasonable in the circumstances to believe a breach of security safeguards creates a "real risk of significant harm" to an individual.
- Timing. The report and the notice to individuals are due "as soon as feasible" after the organization determines that the breach has occurred.
- Notify the individuals under the same threshold. The notice must give enough information for them to understand the significance of the breach to them, and must be conspicuous and direct, except in prescribed circumstances.
- Significant harm includes bodily harm, humiliation, damage to reputation or relationships, financial loss and identity theft. Risk factors include the sensitivity of the information and the probability that it has been, is being or will be misused.
- Notify other organizations (including government institutions) that may be able to reduce the risk of harm.
- Keep a record of every breach involving personal information under your control, in accordance with prescribed requirements, and give the Commissioner access on request (s. 10.3).
The retention period for the records is set by regulation and was not opened. The OPC's own breach page, as fetched, still described the breach rules as awaiting proclamation, so it appears out of date; rely on the statute text.
4. Quebec: Law 25
The Quebec privacy regulator, the Commission d'accès à l'information (CAI), publishes a summary of the Law 25 changes (CAI). Key points relevant to a foreign business that deals with Quebec residents:
| Requirement | What the CAI page says |
|---|---|
| Accountability | The person who runs the business is responsible, may delegate in writing, and the privacy officer's title and contact details must be published on the website |
| Incidents | Notify the CAI and the individuals when there is a risk of serious harm; keep an incident register and give it to the CAI on request |
| Consent | Since September 2023: request consent separately for each purpose, in plain language; express consent for using sensitive information for a new purpose |
| Transfers outside Quebec | Since September 2023: complete a privacy impact assessment first; transfer only if protection is adequate and a written agreement covers it |
| Automated decisions | Tell the person when a decision is based exclusively on automated processing, and let them submit observations to a staff member who can review it |
| Portability | Since September 22, 2024: individuals may request their computerized data in a structured, commonly used format |
| Privacy by default and tracking | Publicly offered technology must default to the highest privacy settings (cookie settings excepted); tracking technologies that identify, locate or profile must be disclosed and activated by the person |
| Penalties | The CAI page gives administrative penalties up to 2% of worldwide turnover or $10 million; fines and the penal scale are in the working guide |
The CAI page says it is a simplified summary and that the official texts prevail. It gives no effective dates for several items, so confirm those against the statute.
5. Cross-border transfers and cloud storage
The OPC's guidance on processing personal data across borders is the main authority opened for this section (OPC). Its address suggests it dates from 2009, and whether it has since been replaced was not checked. Its points:
- PIPEDA does not prohibit sending personal information to a processor outside Canada. It uses accountability between organizations, not an adequacy list.
- Sending data to a processor for the original purpose is a "use", so extra consent is generally not required.
- The sending organization stays responsible. It must use contracts or other means to provide a "comparable" level of protection, meaning generally equivalent and not identical, and should have audit and inspection rights.
- Customers should be told, plainly and ideally at collection, that their information may be processed in another jurisdiction and may be accessible to that country's courts, law enforcement and national security authorities.
- No contract overrides foreign law. Assess the risks, including legal and political conditions, before transfer; highly sensitive data may not suit a foreign transfer.
For Quebec data, Law 25 adds the privacy impact assessment and written agreement above. Data residency laws specific to government contracts or health data were not researched. A practical consequence for cloud buyers: pick a region and sub-processor list, record them in the processor agreement, and update the privacy notice.
6. Federal reform and AI: status
- Bill C-27. The federal privacy reform bill was introduced in the 44th Parliament. Its LEGISinfo entry shows it stalled in committee: last action second reading and referral on April 24, 2023, with committee consideration "not completed" and report stage and third reading "not reached." The entry is filed under a prior session (November 22, 2021, to January 6, 2025). It does not use the word "died", but it shows no passage (LEGISinfo C-27).
- Successor. A search of the 45th Parliament bills for "privacy" returned, on its first of four pages, only Bill S-5, Connected Care for Canadians Act (health information technology and data blocking), at second reading in the House of Commons with first reading on May 28, 2026 (LEGISinfo search). No bill on that page mentions PIPEDA or artificial intelligence. Three result pages and other search terms were not read, so a replacement federal privacy or AI bill cannot be ruled out.
- Practical effect. Planning on the basis that PIPEDA, as it stands, is the federal baseline is reasonable but unconfirmed.
- AI. No federal AI statute was verified. Two AI-related duties are confirmed elsewhere: Quebec's automated-decision notice above, and Ontario's requirement, from January 1, 2026, that employers with 25 or more employees disclose AI use in job postings (see Working with Canadian Companies).
7. Marketing and anti-spam
Canada's anti-spam law, CASL, requires consent for commercial electronic messages; the working guide cites the maximum administrative penalty of $10 million per violation for an organization. CASL's scope over foreign senders, the express and implied consent rules, the unsubscribe requirement and the status of the private right of action were not opened for this guide.
8. What a foreign company should do
Treating the law as applicable (see section 2), a reasonable program looks like this:
- Map what Canadian personal data you hold, where, and why.
- Name an accountable person and publish a privacy policy; for Quebec, publish the officer's title and contact details.
- Rework consent and notices around the ten principles and, for Quebec, separate consent per purpose.
- Put processor and cloud agreements in place that give comparable protection, audit rights and sub-processor control.
- Run a privacy impact assessment before sending Quebec data outside Quebec.
- Prepare a breach response plan and a breach record log; know who decides "real risk of significant harm".
- Check CASL consent before any marketing message to Canadian recipients.
9. Checklist
- Identify which law applies: PIPEDA, Alberta, British Columbia, Quebec, or several
- Get counsel's view on whether the law reaches you if you have no Canadian presence
- Inventory Canadian personal data, systems and vendors
- Designate a person accountable for privacy and publish contact details
- Update the privacy notice to mention processing and possible access abroad
- Document the purposes and collect consent per purpose
- Sign data-processing agreements with comparable-protection and audit terms
- Complete a privacy impact assessment before moving Quebec data out of Quebec
- Write a breach plan and keep a log of every breach
- Review automated decision-making and tell individuals
- Check email and text marketing against CASL consent rules
- Monitor federal reform bills
10. What to ask a lawyer or accountant
- Does PIPEDA or Law 25 apply to us, and from what threshold?
- How should we handle Alberta and British Columbia customers differently?
- Are our cloud regions and sub-processors acceptable for Canadian data?
- Do we need a Quebec-specific privacy impact assessment for our current transfers?
- What breach records must we keep and for how long?
- What does CASL require for our email list and tracking?
- Which rules apply to our use of AI in decisions about individuals?
11. What this guide did not verify
Alberta's Personal Information Protection Act and British Columbia's equivalent (only their existence and "substantially similar" status come from the OPC page); CASL's text beyond the working guide's citation, including foreign senders and the private right of action; Law 25 effective dates not given on the CAI page and the penal fines; the retention period for PIPEDA breach records; whether PIPEDA reaches foreign organizations with no Canadian presence; whether the OPC cross-border guidance has been replaced; provincial data residency requirements; any federal AI statute; and the remaining three pages of the LEGISinfo search, so any successor to Bill C-27 is unconfirmed.
12. Sources opened
- OPC, PIPEDA in brief
- OPC, guidelines for processing personal data across borders
- PIPEDA, ss. 10.1 to 17
- CAI, main changes under Law 25
- LEGISinfo, Bill C-27
- LEGISinfo, 45th Parliament bills, search for "privacy"
Research, not advice. Rules change and depend on your facts: confirm with a qualified Canadian professional before you act. Items we could not verify are labelled in the text.