Privacy and Data Protection Law in Canada: Personal Information, Digital Rights, and Regulatory Oversight

Privacy and Data Protection Law in Canada: Personal Information, Digital Rights, and Regulatory Oversight

Introduction

Privacy and data protection law have become central components of the Canadian legal system. Personal information is now collected and processed in almost every area of modern life: banking, healthcare, employment, education, telecommunications, online shopping, social media, public administration, transportation, and digital communication. Organisations increasingly rely on large databases, cloud services, artificial intelligence, biometric identification, behavioural profiling, and automated decision-making. These developments create opportunities for more efficient services and innovation, but they also raise important questions about individual autonomy, confidentiality, security, discrimination, surveillance, and accountability.

Canadian privacy law seeks to regulate how personal information is collected, used, disclosed, retained, and protected. Its purpose is not simply to prevent unauthorised access to private records. It also establishes limits on what organisations may collect, requires transparency about information practices, gives individuals certain rights of access and correction, and creates mechanisms for investigating complaints and enforcing compliance.

Canada does not have one unified data protection code. Instead, its legal framework consists of federal private-sector privacy legislation, federal public-sector privacy legislation, provincial and territorial statutes, specialised health-information laws, sector-specific requirements, and common-law and civil-law protections. The division of responsibility is particularly important because the rules applying to a bank, a hospital, a provincial government department, an online retailer, and a technology company may be different even when each organisation processes similar personal information.

The central federal private-sector statute has traditionally been the Personal Information Protection and Electronic Documents Act (PIPEDA). It governs many private-sector organisations engaged in commercial activities, including certain interprovincial and international transactions. Provinces with substantially similar private-sector privacy legislation may regulate much of the activity occurring within their borders under their own statutes.

The public sector is governed principally by the federal Privacy Act in relation to federal institutions, together with provincial and territorial public-sector privacy laws. Healthcare information is subject to additional statutory regimes, particularly in provinces where health information is treated as a distinct and highly sensitive category.

The law is also undergoing significant reform. In 2026, Parliament considered Bill C-36, which proposes a new Protecting Privacy and Consumer Data Act and a substantially revised federal private-sector privacy framework. The proposed legislation addresses children’s information, meaningful consent, automated decision-making, deletion rights, data mobility, international transfers, and stronger enforcement. It is important, however, to distinguish proposed legislation from rules already in force. The existing statutory framework continues to govern until any replacement provisions are enacted and brought into force. canada.ca+2

This article examines the constitutional foundations of privacy protection, the principal federal and provincial statutes, the rights of individuals, organisational obligations, health and public-sector privacy, digital technologies, international transfers, regulatory oversight, and available remedies. It approaches privacy as a field of Canadian law in its own right, while recognising its connections with constitutional rights, administrative law, consumer protection, employment, healthcare, intellectual property, and cybersecurity.

1. The Legal and Constitutional Foundations of Privacy in Canada

1.1 Privacy as a legal interest

Privacy is not a single legal concept. It encompasses several related interests, including:

• control over personal information;
• confidentiality of communications;
• protection against unjustified surveillance;
• bodily and territorial privacy;
• informational autonomy;
• protection against unauthorised disclosure;
• security of personal records;
• freedom from inappropriate profiling and intrusive data practices.

Canadian law protects these interests through different legal mechanisms. A person whose medical records are improperly disclosed may rely on health-information legislation. An employee whose personal information is collected by a private employer may invoke applicable privacy legislation and employment law. A person challenging an intrusive government search may rely on section 8 of the Canadian Charter of Rights and Freedoms.

The legal route depends on the actor, the information, the purpose of the collection, and the circumstances in which the privacy interest arose.

1.2 Constitutional protection under the Canadian Charter

The Canadian Charter of Rights and Freedoms does not contain a single provision expressly establishing a general constitutional right to informational privacy. Nevertheless, privacy interests receive significant constitutional protection through several Charter provisions, particularly section 8.

Section 8 guarantees the right to be secure against unreasonable search or seizure. Its purpose is to protect individuals against unjustified state intrusion into areas where they have a reasonable expectation of privacy.

The Supreme Court of Canada has developed an extensive body of jurisprudence concerning privacy in homes, personal property, communications, computers, electronic devices, and personal information held by third parties.

In Hunter v. Southam Inc., [1984] 2 SCR 145, the Supreme Court established foundational principles concerning the protection against unreasonable searches. The Court emphasised that section 8 protects people rather than places and that the reasonableness of a search must be assessed in light of the privacy interests involved.

In R. v. Spencer, 2014 SCC 43, the Court considered whether a person has a reasonable expectation of privacy in subscriber information associated with internet activity. It recognised that anonymity can be an important aspect of informational privacy and that the state cannot necessarily obtain identifying information from an internet service provider without appropriate legal authority.

In R. v. Marakah, 2017 SCC 59, the Court considered privacy interests in text messages stored on another person’s device. The decision demonstrated that the privacy interest in a communication does not necessarily disappear merely because the message is held by someone else.

These cases principally concern government searches and criminal investigations. They do not create a complete statutory code for private-sector data processing. Their importance lies in establishing the constitutional dimension of informational privacy and the limits imposed on state authorities.

1.3 Section 7 and privacy interests

Section 7 of the Charter protects life, liberty, and security of the person in accordance with the principles of fundamental justice. Privacy may become relevant to section 7 where state action affects liberty or security interests in a manner that engages the provision.

However, section 7 is not a general privacy clause. A claimant must establish that the challenged state action engages one of the protected interests and that the deprivation is inconsistent with the principles of fundamental justice.

Privacy arguments may also arise in contexts involving medical treatment, personal autonomy, and state control over sensitive information. Their constitutional significance depends on the specific legal and factual circumstances.

1.4 Privacy and freedom of expression

Privacy can interact with freedom of expression under section 2(b) of the Charter. For example, disputes may involve publication of personal information, journalistic investigation, access to public records, confidential sources, or the publication of intimate images.

The law must sometimes reconcile an individual’s interest in controlling personal information with the public interest in expression, accountability, and access to information.

This balance is not resolved by assuming that privacy always prevails or that expression always prevails. The applicable statute, the nature of the information, the public interest, the circumstances of publication, and the rights of affected individuals all matter.

1.5 Privacy as a principle of statutory interpretation

Privacy also influences the interpretation of legislation. Where a statute authorises the collection, use, or disclosure of personal information, courts may examine the scope of the statutory authority, the purpose of the scheme, and the safeguards provided.

Public authorities must act within their legal powers. A government institution cannot assume that possession of information gives it unrestricted authority to use or disclose it.

Administrative law principles such as legality, procedural fairness, reasonableness, and accountability may therefore intersect with privacy obligations.

1.6 The Canadian legal framework is not limited to the Charter

An important distinction must be maintained between constitutional privacy and statutory data protection.

The Charter generally applies to government action, not to every private relationship between individuals and businesses. A private company collecting customer information does not ordinarily become subject to the Charter merely because it processes personal data.

Private-sector privacy is principally governed by legislation such as PIPEDA and substantially similar provincial statutes. Public-sector privacy is governed by the federal Privacy Act and provincial or territorial public-sector legislation.

The Charter may nevertheless become relevant where state action is involved, including law enforcement access to private databases, government surveillance, or statutory schemes authorising disclosure.

2. The Structure of Canadian Privacy Legislation

2.1 Federal and provincial jurisdiction

Privacy regulation reflects Canada’s constitutional division of powers.

The federal Parliament has authority over matters including banking, interprovincial and international trade and commerce, federal institutions, telecommunications, and other federally regulated activities. Provincial legislatures have broad authority over property and civil rights within the province, including many ordinary commercial and healthcare relationships.

This produces a layered system.

Area	Principal legal framework
Private-sector commercial activities	PIPEDA or substantially similar provincial legislation
Federal government institutions	Privacy Act
Provincial and territorial public bodies	Provincial or territorial public-sector privacy legislation
Personal health information	Provincial health-information statutes and applicable federal rules
Federally regulated financial institutions	PIPEDA and federal financial-sector requirements
Telecommunications and certain digital communications	PIPEDA and sector-specific federal rules
Government searches and seizures	Charter, especially section 8, and relevant statutes

The applicable law may depend on the organisation’s legal status, the nature of the activity, the location of the processing, and whether information crosses provincial or national borders.

2.2 PIPEDA: the principal federal private-sector statute

PIPEDA establishes rules governing the collection, use, and disclosure of personal information in the course of commercial activities.

It applies to many private-sector organisations operating in Canada, including businesses involved in interprovincial or international commercial activity. It also applies to federally regulated businesses, such as banks, airlines, telecommunications companies, and certain transportation undertakings, in relation to their handling of personal information.

The statute incorporates the principles of the Canadian Standards Association’s Model Code for the Protection of Personal Information. These principles form the foundation of PIPEDA’s compliance framework.

PIPEDA’s current consolidated text includes amendments in force through October 19, 2026. The statute remains the principal federal private-sector privacy law while the proposed replacement framework is considered. laws-lois.justice.gc.ca+1

2.3 Provinces with substantially similar private-sector legislation

PIPEDA does not operate identically in every province. The federal government has recognised certain provincial private-sector privacy statutes as substantially similar to PIPEDA.

The principal examples are:

• Alberta’s Personal Information Protection Act;
• British Columbia’s Personal Information Protection Act;
• Quebec’s private-sector privacy legislation, principally the Act respecting the protection of personal information in the private sector.

These statutes regulate much of the private-sector handling of personal information within their respective jurisdictions. PIPEDA continues to apply to interprovincial and international commercial data flows and to federally regulated organisations.

The designation of a provincial statute as substantially similar does not mean that the provincial and federal laws are identical. Their definitions, exceptions, enforcement structures, and specific obligations may differ.

2.4 Ontario and other provincial regimes

Ontario does not have a single general private-sector privacy statute equivalent to the Alberta or British Columbia PIPA regimes. Instead, different legal frameworks apply to different activities.

For example, the Personal Health Information Protection Act, 2004 regulates personal health information in Ontario. Public-sector institutions are subject to the Freedom of Information and Protection of Privacy Act, while municipalities and certain local institutions are governed by the Municipal Freedom of Information and Protection of Privacy Act.

Other provinces and territories have their own public-sector privacy legislation, health-information statutes, and specialised rules.

The result is a system in which the same organisation may be subject to more than one privacy statute depending on the information and activity involved.

2.5 Quebec’s distinctive approach

Quebec has developed a particularly extensive privacy framework through the Civil Code of Québec, the Act respecting the protection of personal information in the private sector, the Act respecting Access to documents held by public bodies and the Protection of personal information, and specialised health-information legislation.

The private-sector statute was substantially modernised through legislation commonly known as Law 25, which introduced phased reforms beginning in 2022 and continuing through 2024.

These reforms strengthened governance requirements, consent rules, transparency, privacy impact assessments, incident reporting, individual rights, and enforcement. They also introduced a framework for substantial monetary administrative penalties and penal sanctions.

Quebec’s system is especially significant because it places organisational responsibility and privacy governance at the centre of compliance. Businesses cannot treat privacy as merely an IT-security matter; they must establish internal policies, identify responsible personnel, assess risks, and demonstrate compliance with statutory obligations.

Official consolidated legislation is available through the Quebec government’s legislative portal. laws-lois.justice.gc.ca+1

3. Personal Information and the Scope of Privacy Protection

3.1 What is personal information?

The concept of personal information is the foundation of most Canadian data protection legislation. Although statutory definitions differ, the general idea is information about an identifiable individual.

Under PIPEDA, personal information means information about an identifiable individual, subject to statutory exclusions. The information does not have to identify someone by name. It may be sufficient that the individual can reasonably be identified from the information alone or in combination with other available information.

Examples include:

• name, address, telephone number, and email address;
• date of birth and government identification numbers;
• financial account details and credit history;
• medical records and prescription information;
• employment records and performance evaluations;
• photographs, video recordings, and voice recordings;
• location and movement data;
• internet activity and browsing history;
• device identifiers and certain online identifiers;
• biometric information, such as fingerprints or facial templates;
• opinions and assessments about an identifiable person.

The legal question is not simply whether a particular item looks sensitive. It is whether the information relates to an identifiable individual under the applicable statute.

3.2 Identifiability and combined information

Information that appears anonymous in isolation may become personal information when combined with other data.

For example, a dataset may contain only postal codes, age ranges, and purchase histories. If the combination makes it reasonably possible to identify particular individuals, privacy obligations may still apply.

This is especially important in data analytics, advertising technology, research, and artificial intelligence. Organisations may assume that removing names is sufficient to anonymise a dataset. That assumption is not necessarily correct.

PIPEDA distinguishes between personal information and information that has been rendered anonymous in accordance with the applicable legal standard. The effectiveness of anonymisation depends on the risk that an individual can be re-identified, taking account of available technology and other information.

3.3 Sensitive personal information

Some information creates greater privacy risks because of its nature or the consequences of its disclosure.

Examples include:

• health and medical information;
• genetic and biometric information;
• financial information;
• information about racial or ethnic origin;
• religious or philosophical beliefs;
• sexual orientation and intimate life;
• precise location information;
• information concerning children;
• information relating to criminal allegations or convictions.

PIPEDA does not establish a single exhaustive list of sensitive categories. Sensitivity is assessed contextually. The same type of information may have different implications depending on the circumstances in which it is collected and used.

The sensitivity of information influences the form and degree of consent required, the security safeguards expected, and the reasonableness of the organisation’s processing activities.

3.4 Publicly available information

Not every piece of information accessible to the public is automatically outside privacy law.

PIPEDA contains specific rules and exceptions concerning publicly available information, as defined by regulation. The fact that information appears on a public website or social media profile does not necessarily give every organisation unrestricted permission to collect, aggregate, analyse, or republish it for any purpose.

The purpose of collection, the nature of the information, applicable exceptions, and the expectations created by the context remain relevant.

3.5 Information about businesses and organisations

Privacy legislation generally protects information about individuals rather than information about legal entities as such.

A corporation’s registered office address or general business telephone number will not ordinarily be personal information merely because it relates to a company. However, information about a sole proprietor, an identifiable employee, or a named professional may fall within the definition.

The distinction is important in business databases, professional directories, customer relationship management systems, and commercial due diligence.

4. The Ten Fair Information Principles under PIPEDA

PIPEDA’s framework is based on ten fair information principles derived from the Canadian Standards Association’s Model Code for the Protection of Personal Information. These principles establish the core responsibilities of organisations handling personal information.

4.1 Accountability

An organisation is responsible for personal information under its control, including information transferred to a third party for processing.

It must designate an individual or individuals responsible for compliance, establish policies and procedures, and make information about its privacy practices available.

Accountability cannot simply be transferred to an external service provider. A company that stores customer information through a cloud provider remains responsible for ensuring that the information is handled in accordance with applicable legal requirements.

4.2 Identifying purposes

An organisation should identify the purposes for collecting personal information before or at the time of collection.

For example, an online retailer may collect a customer’s name and delivery address to fulfil an order. It may also seek consent to use purchase history for personalised advertising. These are different purposes and should not be treated as automatically interchangeable.

A business should not collect information first and attempt to justify its use later through an overly broad privacy policy.

4.3 Consent

Knowledge and consent are central to PIPEDA. In general, individuals must understand and agree to the collection, use, or disclosure of their personal information, subject to statutory exceptions.

Consent must be meaningful. A person should understand what information is involved, why it is being collected, and the reasonably foreseeable consequences of the processing.

The form of consent depends on the circumstances. Express consent may be necessary for sensitive information or where the collection, use, or disclosure is outside reasonable expectations. Implied consent may be sufficient in other circumstances where the purpose and consequences are reasonably clear.

4.4 Limiting collection

Organisations should collect only the personal information necessary for the identified purposes.

A business should not demand extensive personal details merely because it has the technical ability to collect them. For example, an online service that needs an email address to provide access may not necessarily require a full date of birth, precise location history, and unrelated demographic information.

The principle of data minimisation is particularly important in digital services, where information can be collected continuously and at very low marginal cost.

4.5 Limiting use, disclosure, and retention

Personal information should not be used or disclosed for purposes other than those for which it was collected, except with consent or where the law permits or requires otherwise.

An organisation should also retain personal information only as long as necessary to fulfil the identified purposes or satisfy legal requirements.

Retention policies should address both active databases and backups, archives, and information held by service providers. Simply moving data into an inactive storage system does not necessarily remove the organisation’s responsibilities.

4.6 Accuracy

Personal information should be as accurate, complete, and up to date as necessary for the purposes for which it is used.

The required degree of accuracy depends on the consequences of the decision. A minor spelling error in a marketing database may have limited effects. An inaccurate credit record, medical history, employment assessment, or automated eligibility score may have serious consequences.

Organisations should establish procedures for correcting inaccurate records and ensuring that material changes are reflected where the information continues to be used.

4.7 Safeguards

Personal information must be protected by security safeguards appropriate to its sensitivity.

These may include:

• physical access controls;
• authentication and access-management systems;
• encryption;
• secure transmission;
• staff training;
• contractual controls over service providers;
• monitoring and logging;
• incident-response procedures;
• secure destruction.

The level of protection should reflect the nature of the information, the risks associated with its use, and the consequences of unauthorised access or disclosure.

4.8 Openness

An organisation should make its privacy policies and practices readily available.

Individuals should be able to understand what information is collected, why it is collected, how it is used, how long it is retained, and how they can contact the organisation with questions or complaints.

A privacy policy should not be so obscure or technical that an ordinary person cannot reasonably understand the organisation’s practices.

4.9 Individual access

Individuals generally have a right to request access to personal information held about them by an organisation, subject to statutory exceptions.

The right is important because it allows a person to understand what information is being used, assess its accuracy, and identify possible inappropriate collection or disclosure.

The organisation must generally respond within the statutory timeframe and explain any refusal permitted by law.

4.10 Challenging compliance

Individuals should have a meaningful way to challenge an organisation’s compliance with privacy principles.

An organisation should establish complaint procedures and identify the person responsible for handling privacy concerns. If the complaint is not resolved, the individual may be able to bring it to the Office of the Privacy Commissioner of Canada or the relevant provincial privacy commissioner.

The ten principles are set out in Schedule 1 to PIPEDA and form the foundation of the federal private-sector privacy framework. laws-lois.justice.gc.ca+1

5. Consent, Purpose Limitation, and Meaningful Choice

5.1 Consent as a central legal requirement

Consent is not merely a checkbox or a formal statement in a privacy policy. It is a legal mechanism intended to ensure that individuals understand and exercise a meaningful degree of control over the collection, use, and disclosure of their information.

Under PIPEDA, organisations must generally obtain meaningful consent, subject to statutory exceptions. The validity of consent depends on the circumstances, including the sensitivity of the information and the reasonable expectations of the individual.

An organisation should explain its purposes in language that is clear and understandable. It should not hide important uses behind lengthy or ambiguous wording.

5.2 Express and implied consent

Express consent involves an affirmative indication of agreement. It may be given verbally, in writing, electronically, or through another appropriate method.

Implied consent may arise from an individual’s conduct where the purpose is obvious and the individual voluntarily provides information in circumstances that reasonably indicate agreement.

For example, a consumer who provides a delivery address to an online retailer may reasonably be understood to consent to the use of that address for delivery. That does not necessarily mean the consumer has also consented to unrelated marketing, profiling, or disclosure to third-party advertisers.

5.3 Consent for sensitive information

Sensitive information generally requires a higher degree of care.

A person may reasonably expect a hospital to use medical information to provide treatment, but that expectation does not automatically authorise the hospital to disclose the information to an unrelated commercial advertiser.

Similarly, biometric information collected to authenticate access to a secure facility should not automatically be reused for behavioural analysis or unrelated identification purposes.

The sensitivity of information influences the form of consent, the safeguards required, and the legitimacy of the proposed purpose.

5.4 Withdrawal of consent

Individuals may generally withdraw consent, subject to legal or contractual restrictions and reasonable notice.

Withdrawal does not necessarily require an organisation to erase every record immediately. The organisation may have legal obligations to retain particular information, or it may need to maintain records for legitimate purposes permitted by law.

However, it should explain the consequences of withdrawal and should not continue optional processing merely because the individual has difficulty locating the relevant settings.

5.5 Consent in digital environments

Digital services frequently present consent through layered privacy notices, pop-ups, account settings, cookies, and app permissions.

A technically affirmative click does not necessarily establish meaningful consent if the individual was not adequately informed or was presented with a misleading choice.

The legal analysis may consider whether the information was understandable, whether optional purposes were separated from essential service functions, whether the individual could refuse without unreasonable consequences, and whether the organisation’s practices were consistent with its representations.

5.6 Children and young people’s information

Children’s information requires particular care because younger users may not fully understand the consequences of data collection, behavioural profiling, or disclosure.

PIPEDA’s existing framework requires organisations to consider the circumstances when obtaining consent. A child’s age, maturity, the nature of the information, and the potential consequences may affect whether consent can be meaningfully given.

Quebec’s private-sector privacy legislation includes specific protections for personal information concerning minors, including rules relevant to consent where a minor is under 14.

The proposed federal Bill C-36 would introduce more explicit protections for children’s personal information, including a higher standard for handling such information. Those proposed provisions should not be confused with the requirements of current law. canada.ca+1

6. Individual Rights under Canadian Privacy Legislation

6.1 The right to access personal information

Under PIPEDA, an individual generally has the right to request access to personal information held by an organisation, subject to statutory exceptions.

The request may concern information such as:

• customer records;
• transaction histories;
• account details;
• employment records;
• communications;
• personal assessments;
• information supplied to or obtained from third parties.

The organisation must make reasonable efforts to assist the individual and respond within the statutory period, subject to permitted extensions.

Access may be refused in specified circumstances, including where disclosure would reveal personal information about another individual or privileged information, or where another statutory exception applies.

A refusal should not be arbitrary. The organisation must comply with applicable requirements concerning notice and reasons.

6.2 The right to correct inaccurate information

Individuals may challenge information that is inaccurate, incomplete, or out of date.

Under PIPEDA, an organisation must amend personal information where the statutory requirements are met. Where it does not agree to make a requested change, it may be required to annotate the information to record the dispute.

Correction is particularly important where personal information is used to make decisions about credit, insurance, employment, eligibility, or access to services.

6.3 The right to withdraw consent

An individual may withdraw consent to the continued collection, use, or disclosure of personal information, subject to legal and contractual restrictions and reasonable notice.

The organisation should explain the practical consequences. For example, withdrawing consent to the use of location data may prevent a location-based service from functioning, but it should not automatically be treated as consent to unrelated processing.

6.4 The right to complain

An individual who believes that an organisation has violated privacy legislation may submit a complaint to the relevant privacy commissioner.

Under PIPEDA, the Office of the Privacy Commissioner of Canada may investigate complaints, conduct audits in appropriate circumstances, and issue findings and recommendations.

The federal process is generally investigative rather than an ordinary court action. Where a complaint is not resolved, the individual may have access to the Federal Court under the statutory framework.

6.5 The right to deletion: current limits and proposed reform

A general, unconditional right to have all personal information erased does not currently exist under PIPEDA in the same form as the right to erasure under the European Union’s General Data Protection Regulation.

Individuals may nevertheless have practical routes to request deletion or disposal in particular circumstances, including withdrawal of consent, the expiry of retention needs, applicable provincial legislation, or other legal requirements.

Quebec’s Law 25 reforms include rights and obligations concerning the cessation of dissemination, de-indexing, and re-indexing of personal information in specified circumstances. These are not identical to a universal right to erasure.

Bill C-36 proposes a more explicit right to request disposal of personal information in certain circumstances. As of November 8, 2026, the bill remains at second reading in the House of Commons and has not become law. Parliament of Canada+1

6.6 Data portability and mobility

Data portability refers to the ability to obtain personal information in a usable format or transfer it to another service provider.

PIPEDA does not currently provide a general, comprehensive data portability right equivalent to that found in some other data protection regimes.

Bill C-36 proposes a data mobility framework under which individuals could securely transfer personal information between organisations where the relevant framework applies. This proposal remains part of the pending legislation and should not be described as an existing general statutory right. canada.ca+1

7. Privacy Obligations of Private-Sector Organisations

7.1 Responsibility and governance

A business that collects or processes personal information must establish an appropriate privacy governance structure.

Under PIPEDA, accountability is a foundational principle. An organisation should designate an individual responsible for privacy compliance, establish policies and procedures, and ensure that employees understand their responsibilities.

A privacy programme should address the entire information lifecycle, including collection, use, disclosure, storage, access, retention, destruction, and incident response.

The organisation’s size and complexity may influence the form of its programme, but small businesses are not automatically exempt from privacy obligations.

7.2 Privacy policies and notices

A privacy policy should accurately describe the organisation’s practices. It should identify the types of information collected, the purposes of collection, relevant disclosures, retention practices, and the means by which individuals may exercise their rights.

The policy should not promise a level of confidentiality or security that the organisation cannot reasonably provide.

Where practices change materially, organisations should assess whether additional notice or consent is required.

7.3 Privacy impact assessments

A privacy impact assessment (PIA) is a structured process for identifying and evaluating privacy risks associated with a programme, system, or project.

A PIA may examine:

• the categories of personal information involved;
• the purposes of collection and processing;
• the legal authority or consent basis;
• the individuals affected;
• data flows and third-party access;
• security safeguards;
• retention and deletion;
• cross-border transfers;
• potential effects on vulnerable groups;
• risks arising from automated decisions.

PIPEDA does not impose a universal statutory requirement for every private organisation to complete a formal PIA for every project. However, PIAs are widely used as a governance tool and may be required by provincial law, sector-specific rules, contractual commitments, or regulatory guidance.

Quebec’s private-sector privacy framework imposes specific privacy impact assessment requirements in certain circumstances, including the acquisition, development, or overhaul of information systems involving personal information and certain transfers outside Quebec.

7.4 Privacy by design

Privacy by design means incorporating privacy safeguards into the design and operation of systems rather than attempting to address risks only after a problem occurs.

For example, a digital service may be designed to collect the minimum information necessary, separate identifying data from analytical data, restrict employee access, encrypt sensitive records, and delete information according to a defined retention schedule.

Privacy by design is particularly important where an organisation develops applications, uses biometric identification, operates large databases, or relies on automated decision systems.

7.5 Third-party service providers

Organisations frequently outsource data processing to cloud providers, payment processors, analytics companies, marketing platforms, and other service providers.

PIPEDA’s accountability principle means that an organisation remains responsible for information under its control even when a third party processes it on its behalf.

Contracts with service providers should therefore address:

• permitted purposes and processing instructions;
• confidentiality obligations;
• access restrictions;
• security safeguards;
• incident notification;
• subcontracting;
• retention and deletion;
• audit and verification rights;
• assistance with access requests and investigations;
• return or destruction of information at the end of the relationship.

A contract alone does not guarantee compliance. The organisation should also assess the provider’s security practices and monitor the relationship proportionately to the risks.

7.6 Employee access and internal confidentiality

Privacy risks do not arise only from external hackers. Employees and contractors may access information without a legitimate business reason, disclose it improperly, or use it for personal purposes.

Organisations should apply role-based access controls and ensure that employees can access only the information required for their duties.

Training, confidentiality agreements, disciplinary procedures, access logs, and monitoring can support compliance. However, employee monitoring itself may raise privacy issues and must be proportionate and legally justified.

7.7 Retention and secure destruction

Organisations should establish retention periods based on the purposes for which information was collected and applicable legal obligations.

Personal information should not be retained indefinitely merely because storage is inexpensive.

When information is no longer required, it should be securely destroyed or rendered appropriately anonymous. Destruction procedures should cover paper files, portable devices, servers, backups, and third-party systems.

7.8 Accountability for overseas processing

A Canadian organisation may use a service provider located outside Canada. The use of a foreign processor does not automatically remove the organisation from Canadian privacy law.

The organisation must remain accountable for personal information under its control and should ensure that the foreign service provider is subject to appropriate contractual and operational safeguards.

The location of processing may also trigger additional provincial requirements, particularly in Quebec and in public-sector contexts where statutory restrictions on transfers outside the province may apply.

8. Security Safeguards and Privacy Breaches

8.1 The duty to safeguard personal information

Privacy protection requires more than obtaining consent and publishing a privacy policy. Organisations must take reasonable steps to protect personal information against loss, theft, unauthorised access, disclosure, copying, modification, or destruction.

Under PIPEDA, the level of protection should reflect the sensitivity of the information. Financial account credentials, medical records, government identification numbers, and biometric templates generally require stronger safeguards than ordinary business contact information.

Appropriate safeguards may include:

• encryption of sensitive information at rest and in transit;
• multi-factor authentication;
• strong password and access-management controls;
• network segmentation and security monitoring;
• regular software updates and vulnerability management;
• secure backup and recovery arrangements;
• employee training and confidentiality obligations;
• physical protection of records and equipment;
• documented incident-response procedures;
• secure disposal of information and devices.

No security measure can eliminate every risk. The legal question is whether the organisation has implemented safeguards that are reasonable in the circumstances and appropriate to the sensitivity of the information.

8.2 What constitutes a breach of security safeguards?

A breach may involve more than an external cyberattack. It can arise through:

• theft or loss of a laptop or mobile device;
• accidental disclosure of an email attachment;
• sending personal information to the wrong recipient;
• unauthorised employee access;
• ransomware or other malicious software;
• compromise of a supplier’s systems;
• improper publication of confidential records;
• loss of paper files;
• unauthorised alteration or destruction of information.

A breach may affect confidentiality, integrity, or availability. For example, ransomware may prevent an organisation from accessing its own records even where the attacker has not publicly disclosed them. The incident may nevertheless create serious privacy and operational consequences.

8.3 Mandatory breach reporting under PIPEDA

PIPEDA contains mandatory breach reporting and notification requirements.

An organisation subject to the federal provisions must report a breach of security safeguards to the Office of the Privacy Commissioner of Canada where it is reasonable to believe that the breach creates a real risk of significant harm to an individual.

The organisation must also notify affected individuals where the statutory threshold is met. Notification must be given as soon as feasible after the organisation determines that the breach has occurred.

Significant harm may include bodily harm, humiliation, damage to reputation or relationships, loss of employment or business opportunities, financial loss, identity theft, and other serious consequences.

The assessment considers factors such as the sensitivity of the information involved and the probability that the information has been or will be misused.

8.4 Record-keeping obligations

PIPEDA requires organisations to maintain records of every breach of security safeguards involving personal information under their control.

The records must be retained for the period prescribed by the applicable regulations, including breaches that do not reach the threshold for notification.

This obligation is important because it enables the organisation and the regulator to assess patterns, identify systemic weaknesses, and determine whether the organisation has complied with its reporting responsibilities.

The Office of the Privacy Commissioner provides guidance on breach reporting, risk assessment, notification, and record-keeping. laws-lois.justice.gc.ca+1

8.5 Provincial breach-notification requirements

Provincial legislation may establish additional or different breach-reporting obligations.

Quebec’s private-sector privacy legislation requires an organisation to notify the Commission d’accès à l’information and affected individuals where a confidentiality incident presents a risk of serious injury. The organisation must also maintain a register of confidentiality incidents.

Alberta’s PIPA contains mandatory reporting provisions for incidents involving a real risk of significant harm. The organisation must notify the Information and Privacy Commissioner of Alberta, who may require further action.

British Columbia’s PIPA imposes security obligations, although its breach-notification framework is not identical to the federal PIPEDA and Alberta regimes. Organisations should check current statutory and regulatory requirements rather than assume that one national reporting procedure applies everywhere.

8.6 Responding to an incident

A responsible incident-response process generally involves several stages:

1. Containment: Stop or limit unauthorised access and prevent further disclosure.
2. Assessment: Identify the information involved, affected individuals, systems, and likely consequences.
3. Legal analysis: Determine which privacy statutes and reporting thresholds apply.
4. Notification: Inform regulators and affected individuals where legally required.
5. Mitigation: Provide practical assistance, such as account protection, password resets, or fraud-prevention information where appropriate.
6. Remediation: Correct the underlying security weakness.
7. Documentation: Preserve evidence, decisions, reports, and communications.
8. Review: Examine whether governance, training, contracts, or security controls need improvement.

An organisation should not delay legal assessment merely because the technical investigation is incomplete. It may need to make preliminary decisions while continuing to establish the full scope of the incident.

9. Public-Sector Privacy and the Federal Privacy Act

9.1 The distinction between public and private institutions

Public-sector privacy law regulates the personal information held by government institutions and public bodies.

The federal Privacy Act applies to federal government institutions, including departments and agencies within its statutory scope. It establishes rules governing the collection, retention, use, disclosure, and individual access to personal information held by those institutions.

Provincial and territorial public-sector privacy statutes apply to the relevant governments, ministries, municipalities, educational institutions, police bodies, and other public authorities, according to their statutory definitions.

The public-sector framework is distinct from PIPEDA. A federal government department does not generally rely on PIPEDA as its principal privacy statute when administering government programmes. Its obligations arise primarily under the Privacy Act and other applicable legislation.

9.2 Collection by federal institutions

Under the Privacy Act, federal institutions may collect personal information only where the collection relates directly to an operating programme or activity of the institution, subject to the Act’s requirements.

This principle limits the ability of government institutions to gather information merely because it might prove useful at some unspecified future time.

The institution should identify the legal and administrative purpose of the collection and ensure that the information is collected through appropriate means.

9.3 Use and disclosure

Federal institutions are generally restricted to using personal information for the purpose for which it was obtained or compiled, for a use consistent with that purpose, or for another use authorised by the Act.

Disclosure is also controlled. The Privacy Act establishes circumstances in which personal information may be disclosed, including with the individual’s consent or under specified statutory exceptions.

Examples of possible authorised disclosures include disclosures for law enforcement purposes, disclosures required by law, and certain disclosures in the public interest. The availability of an exception depends on its statutory conditions.

9.4 Access and correction

Individuals generally have a right to request access to personal information about themselves held by a federal government institution.

The right is subject to exceptions, including provisions concerning national security, law enforcement, privileged information, and personal information about other individuals.

Individuals may also request correction of personal information believed to be inaccurate or incomplete. Where an institution refuses to make a requested correction, the individual may be able to require that a notation of the disagreement be attached to the record.

These rights support transparency and administrative accountability. They are particularly important where government records influence eligibility for benefits, immigration decisions, licensing, enforcement, or other public programmes.

9.5 The Office of the Privacy Commissioner of Canada

The federal Privacy Commissioner oversees compliance with the Privacy Act and PIPEDA under the current legal framework.

In relation to federal public institutions, the Commissioner investigates complaints concerning access, collection, use, disclosure, retention, and other privacy matters. The Commissioner may also conduct investigations and report on systemic issues.

The federal Privacy Act has not undergone a comprehensive modernisation comparable to the reforms introduced in some provincial regimes. In April 2026, the federal government launched a review examining possible changes involving digital services, automated decision systems, privacy impact assessments, data sharing, breach management, and Indigenous data governance. The review is a reform process, not itself an amendment to the Act. canada.ca+1

9.6 Privacy and access to information

Public-sector privacy legislation often operates alongside freedom-of-information statutes.

Access-to-information laws allow individuals and the public to seek records held by government institutions, subject to exemptions. Privacy provisions protect personal information contained in those records.

The two regimes must be reconciled. A government record may be accessible in principle but contain personal information that must be withheld or severed before disclosure.

The legal analysis may involve the public interest, the nature of the information, consent, statutory exceptions, and the rights of affected individuals.

10. Health Information and Medical Privacy

10.1 Why health information receives special protection

Health information is among the most sensitive categories of personal information. It may reveal a person’s physical and mental condition, diagnoses, treatment, medication, genetic characteristics, family history, reproductive health, and other intimate matters.

Unauthorised disclosure can cause serious consequences, including discrimination, stigma, financial harm, and damage to personal relationships.

Canadian privacy law therefore includes specialised health-information statutes and rules governing healthcare providers, hospitals, laboratories, pharmacies, insurers, and other health-sector organisations.

10.2 Provincial health-information legislation

Several provinces have dedicated legislation governing personal health information.

Examples include:

• Ontario’s Personal Health Information Protection Act, 2004 (PHIPA);
• Alberta’s Health Information Act;
• Manitoba’s Personal Health Information Act;
• Saskatchewan’s Health Information Protection Act;
• Newfoundland and Labrador’s Personal Health Information Act;
• Nova Scotia’s Personal Health Information Act;
• New Brunswick’s Personal Health Information Privacy and Access Act.

These statutes establish rules for collection, use, disclosure, access, correction, safeguards, and oversight. They also identify the organisations and professionals subject to the relevant obligations.

10.3 Ontario’s PHIPA

Ontario’s PHIPA regulates personal health information handled by health information custodians and other persons identified by the statute.

Health information custodians include categories such as healthcare practitioners, hospitals, long-term care facilities, pharmacies, and other designated health-sector organisations.

PHIPA establishes requirements concerning consent, permitted uses and disclosures, access requests, correction, safeguards, and accountability.

The Information and Privacy Commissioner of Ontario oversees the Act and may investigate complaints and review compliance.

A patient generally has rights to access personal health information held by a custodian and to request correction where the record is inaccurate or incomplete, subject to statutory exceptions.

10.4 Health information and consent

Consent in healthcare is complex because information may need to be shared among professionals to provide treatment.

A patient may reasonably expect relevant information to be available to members of the healthcare team involved in their care. However, that expectation does not create unrestricted permission to disclose the information to employers, insurers, advertisers, or unrelated service providers.

Health-information statutes commonly identify circumstances in which information may be used or disclosed without express consent, including certain treatment, administration, payment, legal, and public-health purposes.

The exact rules differ by province and by the role of the organisation receiving the information.

10.5 Electronic health records

Electronic health records create benefits through improved continuity of care and faster access to relevant information. They also create risks involving excessive access, insecure systems, inaccurate entries, and inappropriate secondary use.

Healthcare institutions should apply role-based access, audit trails, authentication controls, secure communication, and procedures for identifying inappropriate access.

A healthcare professional’s legitimate access to a patient record for treatment does not automatically authorise curiosity-driven browsing or disclosure to a person without a proper role.

10.6 Genetic and biometric health information

Genetic information may reveal not only facts about the individual but also information relevant to biological relatives. Biometric information may be used for authentication or identification and can be difficult to replace if compromised.

The federal Genetic Non-Discrimination Act prohibits certain conduct involving compulsory genetic testing and the use or disclosure of genetic test results as a condition of providing goods or services or entering into contracts, subject to the Act’s scope and constitutional framework.

Privacy legislation and human rights law may also become relevant where genetic or biometric information is used in employment, insurance, healthcare, or other relationships.

10.7 Health data research and secondary use

Health information may be used for research, public health, planning, and quality improvement. These activities can produce important social benefits but require appropriate legal authority and safeguards.

Depending on the jurisdiction, research may rely on consent, statutory authorisation, ethics approval, de-identification, or another permitted legal basis.

Researchers and institutions should assess whether the information remains identifiable, whether the proposed use is compatible with the original purpose, and whether the relevant legislation imposes additional requirements.

11. Privacy in Employment and Workplace Relationships

11.1 Employee personal information

Employers collect substantial amounts of personal information, including identification details, contact information, payroll records, performance assessments, disciplinary records, medical information, biometric data, and records of workplace activity.

The applicable privacy framework depends on the employer’s status and the jurisdiction. Federally regulated employers may be subject to PIPEDA in relation to employee information connected with their federal undertakings. Provincial privacy statutes may apply to other private-sector employers, while public-sector employers are generally governed by public-sector legislation.

11.2 Collection and use of employee information

Employers should collect only information reasonably necessary for legitimate employment purposes and should explain how it will be used.

Examples of legitimate purposes may include payroll administration, workplace safety, benefits management, legal compliance, performance assessment, and protection of business systems.

The fact that an employer has a contractual relationship with an employee does not create unrestricted authority to collect or use personal information.

11.3 Workplace monitoring

Employers may use surveillance cameras, access-card systems, computer monitoring, GPS tracking, vehicle telematics, email monitoring, and productivity software.

Monitoring may be legitimate in some circumstances, but its scope should be proportionate to the purpose and consistent with applicable law.

Relevant questions include:

• Is there a legitimate operational or security purpose?
• Is the monitoring necessary for that purpose?
• Is the information collected excessive?
• Have employees been adequately informed?
• Is monitoring conducted in areas where a reasonable expectation of privacy exists?
• How long are the records retained?
• Who may access the information?

A policy stating that all workplace activity may be monitored does not automatically make every form of surveillance lawful.

11.4 Medical information and accommodation

Employers may need limited medical information to administer sick leave, assess workplace restrictions, or implement accommodation obligations. They do not ordinarily require unrestricted access to an employee’s complete medical history.

Human rights legislation, employment law, and privacy statutes may operate together. The employer should generally focus on functional limitations, restrictions, and accommodation needs rather than collecting irrelevant diagnostic details.

11.5 Automated workplace decisions

Employers increasingly use software to screen applicants, assess productivity, allocate shifts, monitor attendance, and evaluate performance.

These systems may process personal information and produce consequential decisions about individuals. Privacy law may regulate the collection and use of the underlying information, while human rights and employment law may address discriminatory or unfair outcomes.

Where automated systems are used, employers should consider transparency, accuracy, bias, human review, and the ability of affected individuals to challenge inaccurate information.

12. International Transfers and Cross-Border Data Protection

12.1 The international nature of modern data processing

Personal information may be collected in Canada, stored in another country, accessed by a foreign service provider, and transferred through several jurisdictions during a single commercial transaction.

Cloud computing, international payment systems, customer relationship platforms, and outsourced support services make cross-border processing common.

Canadian law does not impose one universal prohibition on sending personal information outside Canada. However, the transfer must comply with the applicable privacy statute, and the organisation generally remains responsible for the information under its control.

12.2 PIPEDA and foreign service providers

Under PIPEDA, an organisation remains accountable for personal information transferred to a third party for processing.

The organisation should use contractual and other safeguards to ensure that the service provider handles the information appropriately. It should also be transparent about relevant processing practices.

A transfer to another country does not itself constitute a new purpose in every circumstance, but the organisation must still ensure that the processing is consistent with the purposes for which the information was collected and with applicable consent and disclosure rules.

12.3 Quebec’s international-transfer requirements

Quebec has specific rules concerning the communication of personal information outside Quebec.

Before communicating personal information outside the province, a private-sector organisation must conduct a privacy impact assessment in the circumstances prescribed by the Act. The assessment must consider the sensitivity of the information, the purposes of use, the safeguards available, and the legal framework applicable in the destination jurisdiction.

The transfer may proceed only if the statutory conditions are satisfied, including the requirement that the information receive adequate protection in light of generally recognised privacy principles.

A written agreement must also address the applicable protection requirements.

These rules are particularly relevant to businesses using cloud services or international data processors.

12.4 Public-sector transfers

Public-sector data transfers may be subject to additional restrictions, including requirements concerning storage, access, and processing outside the province or territory.

Government institutions may have to consider statutory restrictions, privacy impact assessments, contractual controls, and government-wide policies.

The rules may differ from those applying to private-sector businesses. An organisation should not assume that a transfer permitted for a commercial enterprise is automatically permitted for a public authority.

12.5 Foreign government access

Cross-border processing can create the possibility that foreign authorities may seek access to information under their domestic laws.

A Canadian organisation should assess this risk when selecting service providers and designing data architecture. Relevant considerations include the provider’s jurisdiction, contractual commitments, access controls, encryption, and the legal mechanisms available to challenge or limit disclosure.

The existence of foreign legal powers does not automatically establish that a transfer violates Canadian law. The organisation must assess the applicable Canadian requirements and the practical risks of the proposed arrangement.

12.6 Canada’s international privacy commitments

Canada participates in international privacy and data protection cooperation, including through the Organisation for Economic Co-operation and Development (OECD) and the Asia-Pacific Economic Cooperation (APEC) privacy framework.

The federal government and provincial authorities also engage with foreign regulators on matters such as cross-border investigations, data breaches, and international technology practices.

International interoperability is important because organisations increasingly process information across borders. However, international cooperation does not remove the need to comply with Canadian statutory requirements.

13. Artificial Intelligence, Automated Decisions, and Emerging Privacy Risks

13.1 The relationship between privacy law and artificial intelligence

Artificial intelligence systems frequently depend on large volumes of personal information. They may process text, images, voice recordings, location data, behavioural patterns, financial records, and information inferred from other datasets.

Privacy law applies to these activities where personal information is collected, used, or disclosed. The fact that processing is performed by an algorithm rather than a human employee does not remove the organisation’s legal responsibilities.

An organisation using AI must therefore consider whether it has a lawful basis for collecting the information, whether the purpose is appropriate, whether consent is required, whether the information is sufficiently accurate, and whether the safeguards are proportionate to the risks.

13.2 Training artificial intelligence systems on personal information

AI developers may use personal information to train, test, fine-tune, or evaluate models.

The legal analysis depends on the source of the information, the purpose of processing, the nature of the model, the possibility of identifying individuals, and the applicable privacy statute.

For example, a company may collect customer communications to provide technical support. It does not follow automatically that the same communications may be used to train a general-purpose AI model for unrelated commercial purposes.

Organisations should examine:

• whether the original collection purpose covers the proposed use;
• whether additional consent is required;
• whether the information is sensitive;
• whether the data can be effectively de-identified;
• whether the model may reproduce or reveal personal information;
• whether the processing creates risks for children or other vulnerable groups;
• whether a privacy impact assessment is appropriate or legally required.

13.3 Automated decision-making

Automated decision-making systems use algorithms to make or support decisions about individuals. They may be used in credit assessment, insurance underwriting, recruitment, benefits administration, fraud detection, education, and access to services.

The use of such systems raises questions of accuracy, transparency, accountability, and fairness.

Under existing PIPEDA, the application of the general principles depends on the particular processing activity. The Act does not contain a comprehensive, stand-alone right to an explanation of every automated decision.

Quebec’s private-sector legislation provides more specific transparency requirements in relation to decisions based exclusively on automated processing. In certain circumstances, an individual must be informed when such a decision is made and may request information about the personal information used, the reasons and principal factors that led to the decision, and the opportunity to submit observations to a person able to review the decision.

The federal Privacy Act and associated government policies also address automated decision-making in public administration. The Directive on Automated Decision-Making establishes requirements for federal institutions using automated systems to make or support administrative decisions, including impact assessment, transparency, quality assurance, and human involvement proportionate to the system’s impact.

13.4 Profiling and behavioural analysis

Profiling involves using personal information to evaluate or predict aspects of an individual’s behaviour, preferences, interests, reliability, or circumstances.

It may be used for advertising, fraud detection, pricing, insurance, recruitment, and customer segmentation.

Profiling can create privacy concerns even where the underlying information was not originally considered sensitive. A combination of ordinary data points may reveal health conditions, financial vulnerability, political interests, or other intimate characteristics.

Organisations should assess whether the profiling purpose is reasonable, whether individuals have been adequately informed, whether consent is required, and whether the resulting use creates unfair or discriminatory consequences.

13.5 Facial recognition and biometric identification

Facial recognition systems compare or analyse facial characteristics to identify or authenticate individuals. Other biometric systems may use fingerprints, voice patterns, iris scans, gait, or behavioural characteristics.

Biometric information creates particular risks because it is closely connected to an individual’s identity and cannot be replaced as easily as a password.

Organisations using biometric systems should assess whether collection is necessary, whether a less intrusive method is available, whether consent is meaningful, how templates are stored, and how the system can be protected against unauthorised access or misuse.

The collection of facial images from public sources does not automatically authorise every subsequent use of those images for identification or surveillance. The legal analysis must consider the applicable privacy legislation, the circumstances of collection, the purpose of processing, and any relevant statutory exceptions.

13.6 Children’s data and online services

Children may not fully understand how online services collect and use their personal information. Behavioural advertising, location tracking, profiling, and automated recommendations can have lasting consequences.

Privacy protection for children therefore requires attention to age, maturity, transparency, parental involvement where appropriate, and the child’s best interests.

The proposed federal Bill C-36 would place additional emphasis on children’s information and require organisations to apply a higher standard of protection. It would also establish a more explicit framework for meaningful consent and transparency. These provisions remain proposals while the bill proceeds through Parliament. canada.ca+1

13.7 AI regulation and the failure of Bill C-27

Privacy regulation should be distinguished from the proposed federal Artificial Intelligence and Data Act (AIDA).

AIDA was introduced as Part 3 of Bill C-27, the Digital Charter Implementation Act, 2022. Bill C-27 did not become law and died when the 44th Parliament was prorogued in January 2025. Consequently, AIDA was never enacted.

This does not mean that AI systems operate outside Canadian law. Existing privacy, human rights, consumer protection, employment, intellectual property, and sector-specific legislation may apply to AI-related activities.

The proposed Bill C-36 would address certain privacy aspects of automated decision-making and AI-related personal information processing, but it is not a revival of AIDA and should not be described as a comprehensive AI regulatory statute. publications.gc.ca+2

14. Regulatory Oversight and Privacy Commissioners

14.1 The Office of the Privacy Commissioner of Canada

The Office of the Privacy Commissioner of Canada (OPC) is an independent federal oversight institution responsible for privacy matters under the current federal framework.

Its responsibilities include:

• investigating complaints under PIPEDA and the Privacy Act;
• conducting certain audits and examinations;
• reviewing privacy practices of organisations and federal institutions;
• advising Parliament and government;
• issuing guidance and recommendations;
• promoting public awareness of privacy rights;
• reporting on systemic privacy concerns.

The Commissioner performs an important accountability function by examining how organisations and government institutions handle personal information.

14.2 Investigations under PIPEDA

The OPC may investigate complaints concerning the collection, use, disclosure, safeguarding, or access to personal information.

An investigation may involve reviewing documents, interviewing representatives, examining privacy policies, and assessing whether an organisation’s practices comply with the statute.

The Commissioner may issue findings and recommendations. PIPEDA’s current enforcement structure is principally based on investigation, reporting, and access to the Federal Court rather than a general administrative fine regime comparable to some foreign data protection systems.

14.3 Federal Court proceedings

Where a PIPEDA complaint has been investigated and the Commissioner issues a report, an individual may apply to the Federal Court in accordance with the statutory requirements.

The Court may make orders requiring an organisation to correct its practices and may award damages in appropriate circumstances.

This mechanism gives individuals access to judicial remedies while preserving the investigative role of the Privacy Commissioner.

14.4 Provincial privacy commissioners

Provincial privacy regulators oversee compliance with the statutes within their jurisdictions.

Important examples include:

• the Information and Privacy Commissioner of Alberta;
• the Office of the Information and Privacy Commissioner for British Columbia;
• the Commission d’accès à l’information du Québec;
• the Information and Privacy Commissioner of Ontario;
• the Office of the Information and Privacy Commissioner of Manitoba;
• the Saskatchewan Information and Privacy Commissioner.

Their powers differ. Some may investigate complaints, issue orders, conduct audits, review access decisions, or impose or recommend penalties under particular statutes.

The regulator’s jurisdiction should be identified before a complaint is submitted. A complaint about a provincial health institution, for example, may belong before the relevant provincial commissioner rather than the federal OPC.

14.5 Regulatory cooperation

Privacy issues frequently cross provincial and national borders. Regulators therefore cooperate through information-sharing arrangements, joint investigations, and coordinated guidance where legally authorised.

A single breach may affect customers in several provinces and involve an organisation subject to more than one privacy statute. Regulatory cooperation can reduce duplication and help establish consistent expectations.

However, each regulator retains the authority and responsibilities granted by its own legislation.

15. Enforcement, Liability, and Remedies

15.1 Regulatory investigation and corrective action

Privacy regulators may investigate alleged non-compliance and require organisations to provide information relevant to an inquiry.

Depending on the statute, a regulator may recommend corrective measures, issue orders, conduct audits, or refer serious matters for further enforcement.

The available powers differ significantly between PIPEDA, provincial private-sector legislation, public-sector statutes, and health-information laws.

15.2 Monetary penalties

The current PIPEDA framework does not provide a general administrative monetary penalty system equivalent to the proposed federal model in Bill C-36.

Provincial regimes may impose monetary penalties or other sanctions in specified circumstances. Quebec’s Law 25 reforms, for example, introduced significant administrative and penal consequences for certain violations of its private-sector privacy legislation.

The applicable maximum and calculation method depend on the statutory provision and the nature of the violation. A business should not assume that the same penalty structure applies throughout Canada.

15.3 Civil liability

Privacy violations may give rise to civil proceedings in appropriate circumstances.

A claimant may rely on a statutory remedy, breach of confidence, breach of contract, negligence, or another recognised cause of action, depending on the facts and jurisdiction.

The existence of a privacy complaint does not automatically establish a right to damages. The claimant must identify a legally recognised basis for relief and satisfy the relevant requirements.

15.4 Breach of confidence

The common law recognises the action for breach of confidence. It may apply where confidential information is communicated in circumstances importing an obligation of confidence and is subsequently misused or disclosed without authority.

The action can be relevant to personal information, trade secrets, medical records, commercial information, and other confidential material.

The claimant must establish the elements of the cause of action, including the confidential character of the information and the circumstances giving rise to the obligation.

15.5 Intrusion upon seclusion

Ontario courts have recognised the tort of intrusion upon seclusion.

In Jones v. Tsige, 2012 ONCA 32, the Ontario Court of Appeal recognised a cause of action where a defendant intentionally or recklessly intrudes, without lawful justification, upon the private affairs or concerns of another person in a manner that a reasonable person would regard as highly offensive and causing distress, humiliation, or anguish.

The case concerned an employee of a financial institution who repeatedly accessed another person’s banking records without authorisation.

The tort is not a general remedy for every privacy complaint. Its scope is limited by the elements identified by the Court, and its availability outside Ontario depends on the relevant law and judicial development.

15.6 Public disclosure of private facts

Some Canadian courts have also recognised a tort addressing public disclosure of private facts.

In Jane Doe 72511 v. N.M., 2018 ONSC 6607, the Ontario Superior Court considered the non-consensual distribution of intimate images and recognised the tort of public disclosure of private facts.

This development illustrates the legal response to privacy harms associated with digital communication and online publication. The availability and precise scope of the tort should not be assumed to be identical in every province.

15.7 Charter remedies

Where a privacy violation results from unconstitutional state action, section 24 of the Charter may provide a remedy.

Depending on the circumstances, a court may exclude evidence under section 24(2), grant an appropriate remedy under section 24(1), or issue another order consistent with the constitutional framework.

A Charter remedy is not automatically available against a private organisation. The claimant must establish the necessary connection to government action and satisfy the relevant constitutional requirements.

16. The Proposed Federal Reform: Bill C-36

16.1 Why reform is being proposed

PIPEDA was enacted in 2000, before the widespread adoption of smartphones, large-scale social media platforms, generative AI, advanced biometric identification, and contemporary data brokerage.

The federal government has argued that the existing statute needs modernisation to address new forms of data processing and strengthen public confidence in the digital economy.

Earlier reform efforts included Bill C-11 in 2020 and Bill C-27 in 2022. Neither resulted in a new federal private-sector privacy statute. Bill C-27 died in January 2025 when Parliament was prorogued. publications.gc.ca+1

16.2 The Protecting Privacy and Consumer Data Act

In June 2026, the federal government introduced Bill C-36, which proposes to enact the Protecting Privacy and Consumer Data Act (PPCDA), amend PIPEDA, and make related legislative changes.

The proposed PPCDA would replace the principal private-sector provisions of PIPEDA with a modernised statute. The remaining electronic-documents provisions of PIPEDA would be reorganised under separate legislation.

The bill proposes a number of important changes, including:

• express recognition of privacy as a fundamental right;
• stronger protection for children’s personal information;
• clearer requirements for meaningful consent;
• greater transparency about automated decision-making;
• a right to request disposal of personal information in certain circumstances;
• a data mobility framework;
• safeguards and risk assessment requirements for certain international transfers;
• provisions addressing inappropriate uses of personal information, including surveillance pricing;
• expanded regulatory powers and stronger penalties.

These proposals represent a significant potential change to the federal framework, but they are not yet the law. canada.ca+1

16.3 Proposed institutional reform

Bill C-36 would also change the institutional structure responsible for private-sector privacy oversight.

It proposes a Digital Safety and Data Protection Commission of Canada, with a designated Privacy and Consumer Data Commissioner and a specialised Privacy and Consumer Data Division.

Under the proposal, the new structure would assume many functions currently exercised by the Office of the Privacy Commissioner of Canada in relation to private-sector privacy, including complaints, investigations, and enforcement. The OPC would continue to have responsibilities under the federal Privacy Act.

The proposed Commission would have authority to issue binding orders and apply significant monetary penalties in specified circumstances. The bill also provides for review and appeal mechanisms.

These institutional changes have attracted debate concerning regulatory independence, the concentration of digital oversight functions, and the relationship between privacy protection and online safety regulation. The legal position will depend on the final legislation, any parliamentary amendments, and the provisions brought into force. Ministère de la Justice+1

16.4 Parliamentary status as of November 8, 2026

The official parliamentary record lists Bill C-36 as being at second reading in the House of Commons. It has not completed committee consideration, report stage, third reading, or Senate passage.

It has therefore not received Royal Assent and is not yet in force as a replacement private-sector privacy statute. PIPEDA and the applicable provincial laws continue to govern existing obligations. Parliament of Canada+1

This distinction is essential for businesses, public institutions, and individuals. A proposed right or penalty under Bill C-36 should not be presented as an existing legal entitlement or obligation.

16.5 The separate review of the Privacy Act

The federal government also launched a review of the Privacy Act in April 2026. The review examines possible changes to the public-sector privacy regime, including data sharing between government programmes, privacy impact assessments, automated decision-making, breach management, safeguards, and Indigenous data governance.

The review is separate from Bill C-36. It is intended to inform future policy and legislative decisions rather than immediately amend the Privacy Act.

The government indicated that a report consolidating the review’s findings would be published in the winter of 2026–27. canada.ca+1

17. A Practical Example: A Data Breach Involving an Online Financial Service

Consider a Canadian financial technology company offering an online payment and budgeting platform. Customers provide their names, email addresses, bank-account information, transaction histories, and other financial details. The company uses a cloud provider located outside Canada to store and process the information.

An attacker obtains access to the cloud environment and downloads customer records. The company discovers the incident several days later.

Several legal questions arise.

First, which privacy legislation applies? The company must determine whether it is subject to PIPEDA, a substantially similar provincial statute, or more than one regime. If it operates across provincial borders, the location of customers and the nature of its commercial activities may be relevant.

Second, who is responsible? The company cannot automatically transfer its legal responsibility to the cloud provider. Under PIPEDA’s accountability principle, an organisation remains responsible for personal information under its control, including information processed by a service provider.

Third, was the information adequately protected? The company must examine its authentication systems, encryption, access permissions, security monitoring, and contractual safeguards. The investigation should establish whether the incident resulted from a technical vulnerability, inadequate access controls, or another failure.

Fourth, must the incident be reported? Under PIPEDA, the company must report a breach to the OPC and notify affected individuals if there is a real risk of significant harm. If provincial legislation also applies, the company must assess its separate reporting obligations.

Fifth, what rights do customers have? Customers may seek information about the breach, request access to their personal information, challenge inaccurate records, and complain to the relevant privacy regulator. Depending on the facts, civil remedies may also be available.

Sixth, what happens to the overseas service provider? The company must assess the contractual and legal safeguards governing the international processing arrangement. The fact that information was stored outside Canada does not automatically remove the company’s obligations under Canadian law.

This example demonstrates that privacy compliance is not simply a matter of publishing a policy. It requires organisational accountability, appropriate security, contractual oversight, incident management, and an effective procedure for protecting individual rights.

18. Key Takeaways

• Canadian privacy law is divided between federal, provincial, territorial, and sector-specific legislation.
• The Canadian Charter protects important privacy interests, particularly against unreasonable government searches and seizures under section 8.
• PIPEDA remains the principal federal private-sector privacy statute as of November 8, 2026.
• Alberta, British Columbia, and Quebec have substantially similar private-sector privacy legislation covering important aspects of activity within their jurisdictions.
• Ontario and other provinces have specialised public-sector and health-information regimes rather than one universal private-sector privacy statute.
• The federal Privacy Act governs personal information held by federal government institutions.
• Personal information generally includes information about an identifiable individual, even where the individual’s name does not appear in the record.
• Sensitive information, including health, financial, genetic, biometric, and children’s information, requires particular care.
• PIPEDA is based on ten fair information principles: accountability, identifying purposes, consent, limiting collection, limiting use and disclosure, accuracy, safeguards, openness, individual access, and challenging compliance.
• Consent should be meaningful and informed. Providing information for one purpose does not automatically authorise unrelated processing.
• Individuals generally have rights of access and correction under PIPEDA, subject to statutory exceptions.
• PIPEDA does not currently establish a comprehensive general right to erasure or data portability equivalent to those available under some foreign regimes.
• Organisations must protect personal information through safeguards appropriate to its sensitivity and maintain accountability when using third-party service providers.
• PIPEDA requires reporting and notification of breaches that create a real risk of significant harm, together with prescribed record-keeping.
• Public-sector privacy law regulates government collection, use, disclosure, retention, and access to personal information.
• Health information is governed by specialised provincial statutes, including Ontario’s PHIPA and Alberta’s Health Information Act.
• Workplace monitoring and automated employment decisions must be assessed under applicable privacy, employment, and human rights laws.
• Cross-border processing is not automatically prohibited, but Canadian organisations remain responsible for compliance and may face additional provincial requirements.
• Artificial intelligence systems that process personal information remain subject to existing privacy legislation, even though Canada does not yet have a comprehensive federal AI statute.
• Bill C-36 proposes a substantial reform of federal private-sector privacy law, but it remains at second reading and is not yet in force.
• Privacy violations may lead to regulatory investigations, corrective orders, statutory penalties, court proceedings, and civil liability, depending on the applicable legislation and circumstances.

19. Frequently Asked Questions

1. Does Canada have one national data protection law?

No. Canada has a federal private-sector privacy statute, PIPEDA, together with provincial and territorial legislation. Public-sector and health information are also regulated through specialised laws.

2. What is PIPEDA?

The Personal Information Protection and Electronic Documents Act is federal legislation governing the collection, use, and disclosure of personal information in commercial activities within its scope. It also applies to certain federally regulated organisations and interprovincial and international data flows.

3. Does PIPEDA apply to every Canadian business?

No. Some businesses operating entirely within Alberta, British Columbia, or Quebec may be primarily subject to the applicable provincial private-sector privacy statute for activities within that province. PIPEDA continues to apply in relevant interprovincial, international, and federally regulated contexts.

4. What is considered personal information?

Generally, it is information about an identifiable individual. It may include names, addresses, financial records, medical information, photographs, biometric identifiers, location information, and other information that can reasonably identify a person.

5. Is an email address personal information?

It may be. An email address that identifies or can reasonably be linked to an individual generally qualifies as personal information. A generic business address may not identify an individual, depending on the circumstances.

6. Is publicly available information exempt from privacy legislation?

Not automatically. Certain publicly available information may fall within statutory exceptions, but an organisation cannot assume that every item published online can be collected, combined, and used without restrictions.

7. What are the ten fair information principles?

They are accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance.

8. Must a company always obtain express consent?

No. Depending on the circumstances, consent may be express or implied, and certain statutory exceptions may apply. However, consent must be meaningful, and sensitive information or unexpected uses may require a higher standard.

9. Can an individual request access to personal information held by a company?

Generally, yes, under PIPEDA and applicable provincial legislation, subject to statutory exceptions. Organisations must follow the relevant procedures and response periods.

10. Can an individual demand that a company delete all personal information?

There is no general, unconditional right to erasure under current PIPEDA equivalent to the GDPR’s right to erasure. However, deletion or disposal may be available under particular provincial provisions, retention requirements, consent arrangements, or other legal obligations.

11. What is the difference between anonymisation and de-identification?

De-identification generally involves removing or modifying identifying elements, while anonymisation seeks to make identification or re-identification no longer reasonably possible under the applicable legal standard. The terminology and precise legal requirements depend on the statute.

12. What happens when a company experiences a data breach?

The organisation must assess the incident, contain the breach, determine the applicable reporting obligations, and notify regulators and affected individuals where legally required. Under PIPEDA, notification is required when there is a real risk of significant harm.

13. Must every data breach be reported to the federal Privacy Commissioner?

No. Under PIPEDA, mandatory reporting applies where the breach creates a real risk of significant harm. However, organisations must maintain records of breaches as required by the legislation, and other provincial statutes may impose separate reporting duties.

14. Can a Canadian company store customer information outside Canada?

Generally, yes, subject to applicable privacy laws and safeguards. The organisation remains accountable for information under its control. Quebec and certain public-sector regimes impose additional requirements for particular international transfers.

15. Does the Privacy Act apply to private companies?

Generally, no. The federal Privacy Act governs federal government institutions. Private-sector organisations are generally regulated under PIPEDA or applicable provincial legislation.

16. Who supervises privacy compliance in Canada?

The Office of the Privacy Commissioner of Canada oversees federal privacy legislation. Provincial and territorial privacy commissioners supervise the statutes within their respective jurisdictions.

17. Does Canada have special laws protecting medical information?

Yes. Several provinces have dedicated health-information legislation, including Ontario’s PHIPA, Alberta’s Health Information Act, and Quebec’s legislation governing health and social services information.

18. Can an employer monitor employees?

Certain forms of workplace monitoring may be lawful where they have a legitimate purpose and comply with applicable privacy and employment requirements. The employer must consider necessity, proportionality, transparency, and the privacy interests of employees.

19. Is facial recognition regulated in Canada?

Facial recognition involves personal and often biometric information. Its collection and use may be subject to PIPEDA, provincial privacy legislation, human rights law, and other applicable rules. Public availability of a photograph does not automatically authorise its use in every facial-recognition system.

20. Is artificial intelligence covered by Canadian privacy law?

Yes, where an AI system collects, uses, or discloses personal information within the scope of an applicable privacy statute. Existing privacy obligations continue to apply even in the absence of a comprehensive federal AI statute.

21. Can a company use customer information to train an AI model?

Not automatically. The organisation must assess the purpose of collection, consent, reasonable expectations, sensitivity, and applicable statutory exceptions. Using information for an unrelated AI-training purpose may require additional consent or another lawful basis.

22. Does Canada have a right to explanation for automated decisions?

The position varies. Quebec has specific statutory transparency and review provisions for certain exclusively automated decisions. The federal PIPEDA framework does not currently provide a comprehensive general right to an explanation of every automated decision. Bill C-36 proposes additional transparency requirements.

23. What is the tort of intrusion upon seclusion?

It is a civil cause of action recognised by the Ontario Court of Appeal in Jones v. Tsige, 2012 ONCA 32. It addresses intentional or reckless, unjustified intrusion into another person’s private affairs that would be highly offensive to a reasonable person and causes the required form of distress.

24. What is Bill C-36 and why is it important?

Bill C-36 proposes the Protecting Privacy and Consumer Data Act, which would substantially modernise federal private-sector privacy law. It addresses meaningful consent, children’s information, deletion requests, automated decision-making, international transfers, data mobility, and regulatory enforcement. As of November 8, 2026, it remains at second reading in the House of Commons.

25. Can an individual receive compensation for a privacy violation?

Potentially. Compensation may be available through statutory proceedings, civil claims, or other recognised remedies. The claimant must establish the applicable legal basis and satisfy its requirements. A finding by a privacy regulator does not automatically establish entitlement to damages in every case.

20. Principal Legislation and Official Legal Resources

The following legislation and institutions provide the principal legal foundations for studying privacy and data protection in Canada.

Federal legislation

• Personal Information Protection and Electronic Documents Act (PIPEDA) — federal private-sector privacy legislation.
• Privacy Act — personal information held by federal government institutions.
• Genetic Non-Discrimination Act — protections concerning compulsory genetic testing and the use of genetic test results.
• Criminal Code — provisions relevant to certain forms of unlawful interception, misuse, and other privacy-related offences.
• Competition Act — relevant to certain deceptive data-related commercial practices and digital advertising.

Provincial and territorial legislation

• British Columbia Personal Information Protection Act — private-sector privacy.
• Alberta Personal Information Protection Act — private-sector privacy.
• Quebec Act respecting the protection of personal information in the private sector — private-sector privacy, as amended by Law 25.
• Civil Code of Québec — general civil-law provisions relevant to privacy and personality rights.
• Ontario Personal Health Information Protection Act, 2004 — personal health information.
• Ontario Freedom of Information and Protection of Privacy Act — provincial public-sector information and privacy.
• Ontario Municipal Freedom of Information and Protection of Privacy Act — municipal and designated local institutions.

Regulatory institutions and guidance

• Office of the Privacy Commissioner of Canada — federal privacy oversight, investigations, guidance, and reports.
• Office of the Information and Privacy Commissioner of Alberta — provincial privacy oversight.
• Office of the Information and Privacy Commissioner for British Columbia — provincial privacy oversight.
• Commission d’accès à l’information du Québec — Quebec privacy and access-to-information regulator.
• Information and Privacy Commissioner of Ontario — oversight of Ontario’s privacy and access-to-information legislation.
• Treasury Board of Canada Secretariat — federal privacy policies and public-sector privacy modernisation.

Current legislative developments

• Bill C-36 — Parliamentary legislative status — official record of the Protecting Privacy and Consumer Data Act proposal.
• 2026 Review of the Privacy Act — federal public-sector privacy reform initiative.

Conclusion

Privacy and data protection law in Canada is a complex but essential component of the country’s legal framework. It regulates the relationship between individuals, businesses, public authorities, and organisations that collect or process personal information. Its central concern is not merely the confidentiality of records, but the responsible exercise of power over information that can influence a person’s identity, opportunities, financial position, health, reputation, and autonomy.

The Canadian approach is characterised by a combination of federal and provincial regulation. PIPEDA provides an important national framework for private-sector commercial activity, while Alberta, British Columbia, and Quebec maintain substantially similar provincial legislation. The federal Privacy Act governs personal information held by federal institutions, and specialised provincial statutes protect health information and regulate public bodies. This structure requires organisations to identify the applicable legal regime rather than assume that one privacy policy or compliance procedure satisfies every statutory obligation.

The development of digital technology has made these distinctions increasingly important. Personal information is now used not only to administer transactions and provide services but also to predict behaviour, determine eligibility, personalise prices, assess risk, and train artificial intelligence systems. The resulting privacy questions concern meaningful consent, transparency, data minimisation, accuracy, security, automated decisions, and the limits of secondary use. Existing Canadian privacy legislation already applies to many of these activities, even though the legal framework has not yet been fully modernised for the contemporary digital economy.

Bill C-36 represents a significant proposed development. Its provisions concerning children’s information, meaningful consent, automated decision-making, disposal of personal information, data mobility, international transfers, and regulatory enforcement could substantially change federal private-sector privacy law. Nevertheless, legislative proposals must be distinguished from enacted law. As of November 8, 2026, PIPEDA remains in force and Bill C-36 has not completed the parliamentary process.

For businesses and public institutions, privacy compliance should be understood as a continuing governance responsibility. It requires appropriate collection practices, transparent purposes, effective consent procedures, proportionate security, responsible retention, careful use of third-party processors, and the ability to respond effectively to individual requests and data breaches. For individuals, knowledge of privacy rights provides a means of understanding, questioning, and challenging how personal information is handled.

Ultimately, the effectiveness of Canadian privacy law depends on maintaining a workable relationship between technological innovation, legitimate organisational needs, public administration, and individual autonomy. Personal information may be an important resource in a modern economy, but its commercial or administrative usefulness does not remove the legal responsibilities attached to its collection and use. Privacy protection is therefore not an obstacle external to the digital economy; it is one of the legal conditions necessary for public confidence, institutional accountability, and responsible technological development.