Which Privacy Rules Apply to Your Canadian Business?

Colleagues review documents beside a laptop.

A business can be based in Calgary, serve customers elsewhere and use suppliers outside Canada. Its address is a starting point for a privacy-law assessment. The information and activities matter too.

This guide covers selected private-sector rules. Public-sector, health, and other sector-specific requirements need their own assessment. It is general information, not legal advice.

Start with the activities and information

Alberta and British Columbia have private-sector laws called PIPA. Quebec has its Act respecting the protection of personal information in the private sector, substantially amended by Law 25. The applicable provincial law can cover local activities, including employment information, subject to its scope and exceptions.

PIPEDA is the federal private-sector law. It generally applies to personal information handled in commercial activities where a substantially similar provincial exemption does not apply. It also applies to personal information crossing provincial or national borders in commercial activities, including in provinces with substantially similar laws.

Federally regulated businesses, such as banks and airlines, are subject to PIPEDA, including for employment information connected with their federal operations. PIPEDA does not generally regulate employee information at provincially regulated employers. Other laws may still protect that information.

Check the actual data flows and activities rather than treating every offshore cloud subscription as a complete answer to jurisdiction. Provincial duties can remain relevant alongside federal ones. Where laws overlap, identify the requirements under each; do not assume that following one supposedly stricter law satisfies the others.

Email marketing is a separate check

CASL regulates commercial electronic messages, including qualifying emails and texts with a Canadian connection. Subject to exceptions, you need a valid consent basis, prescribed sender information, and an unsubscribe mechanism.

Valid express consent generally continues until withdrawal. Particular existing-business-relationship cases can support implied consent for two years after a qualifying purchase or six months after a qualifying inquiry. Other forms of implied consent have different conditions. A public business address is not unrestricted permission to send marketing.

Keep evidence of the basis you rely on and honour unsubscribe requests without delay, no later than ten business days.

Understand the penalty provision behind the figure

The figures below are selected statutory maxima in Canadian dollars. They concern different enforcement routes and specified conduct. They are not automatic charges after a breach, predictions, or a complete account of legal exposure.

Alberta PIPA section 59 provides offence fines on conviction of up to $100,000 for a person other than an individual or $10,000 for an individual. The relevant offence must be established.

PIPEDA section 28 covers, among other things, knowingly contravening breach reporting, notification, and record-keeping duties. The maximum is $10,000 on summary conviction or $100,000 on indictment. These are prosecution-based fines, rather than a general administrative penalty for every privacy failure.

Under Quebec’s private-sector law, the administrative maximum for non-natural persons is the greater of $10 million or 2% of worldwide turnover for the preceding fiscal year. For specified penal offences, the corresponding maximum is the greater of $25 million or 4% of that turnover. Subsequent offence fines are doubled. These are separate mechanisms, with their own conditions.

CASL permits administrative monetary penalties of up to $10 million per violation for non-individuals and $1 million for individuals. Directors and officers can be liable if they direct, authorize, assent to, acquiesce in, or participate in a violation; liability is not automatic from the title. The Act provides a due diligence defence.

Investigation, remediation, notification, and operational disruption can create costs too. Their size depends on the incident. There is no useful basis here for predicting which cost would be largest for your business.

Know the breach reporting route

Under Alberta PIPA, notify the Alberta Commissioner without unreasonable delay where a breach involving personal information under the organization’s control creates a real risk of significant harm. The Commissioner can require notification to affected people.

Under PIPEDA, where a breach creates that risk, report to the federal Commissioner and notify affected individuals as soon as feasible. Maintain records of every breach of security safeguards involving personal information under your control, whether reported or not, for at least 24 months after the day you determine it occurred.

Do not apply those descriptions as a Canada-wide breach procedure. Quebec and other regimes have their own rules. Contracts and sector requirements can add duties. Record the assessment, the law considered, the decision owner and the reasons. Reassess when new facts become available.

Watch proposed changes separately

As checked on 25 October 2026, Parliament’s LEGISinfo lists Bill C-36 at second reading in the House of Commons, with first reading the last major stage completed. It has not been enacted. Recheck its status before publication and distinguish a proposal from current obligations.

Three practical actions

Map whose information you hold, what you do with it and where it goes. Use that map to obtain a scope assessment where needed; the map alone does not determine the law.

Assign responsibility for incident assessment and notification. Make sure the person has access to technical evidence and legal support when needed.

Review the evidence behind your marketing list, your sender details and your unsubscribe process. Give any gap an owner and a due date.

For help organizing these governance tasks, use the contact page at sholahassan.com. For legal interpretation of your circumstances, consult privacy counsel.

Sources

Office of the Privacy Commissioner of Canada, PIPEDA requirements in brief: https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief/

PIPEDA sections 10.1, 10.3 and 28: https://laws-lois.justice.gc.ca/eng/acts/P-8.6/FullText.html

Breach of Security Safeguards Regulations section 6: https://gazette.gc.ca/rp-pr/p2/2018/2018-04-18/html/sor-dors64-eng.html

Alberta organization responsibilities and breach guidance: https://www.alberta.ca/organization-responsibilities-for-protecting-personal-information and https://oipc.ab.ca/breach-notification/

Quebec private-sector law sections 90.12, 91 and 92: https://www.legisquebec.gouv.qc.ca/en/document/cs/p-39.1; CAI sanctions guidance: https://www.cai.gouv.qc.ca/protection-renseignements-personnels/information-entreprises-privees/sanctions-entreprises-poursuites

CASL sections 6, 10, 11, 20, 31 and 33: https://laws.justice.gc.ca/eng/acts/E-1.6/FullText.html ; CRTC implied-consent guidance: https://crtc.gc.ca/eng/com500/guide.htm

Bill C-36 status: https://www.parl.ca/LegisInfo/en/bill/45-1/c-36elsewhere,