Canada
Full entry AI-checked Checked 5 November 2026
| Law | Citation | Status | In force from |
|---|---|---|---|
| Personal Information Protection and Electronic Documents Act (PIPEDA) | S.C. 2000, c. 5 | In force | 1 January 2001 |
| Breach of Security Safeguards Regulations | SOR/2018-64 | In force | 1 November 2018 |
| Canada’s Anti-Spam Legislation (CASL) | S.C. 2010, c. 23 | In force | 1 July 2014 |
| Data mobility amendments to PIPEDA (Budget 2025 Implementation Act, No. 1) | S.C. 2026, c. 3, ss. 389–390 | Enacted, not yet in force | — |
| Bill C-36 (Protecting Privacy and Consumer Data Act) | Bill C-36, 45th Parliament, 1st Session | Draft, not law | — |
- Personal Information Protection and Electronic Documents Act (PIPEDA): Part 1 is the private-sector privacy law. It was phased in and has covered commercial activity in every province since 2004, except where a substantially similar provincial law applies instead.
- Breach of Security Safeguards Regulations: What breach reports and notices must contain, and the 24-month record-keeping rule.
- Canada’s Anti-Spam Legislation (CASL): Commercial electronic messages and, since 15 January 2015, installing computer programs. Its private right of action was repealed before it ever came into force.
- Data mobility amendments to PIPEDA (Budget 2025 Implementation Act, No. 1): Assented to on 26 March 2026 but not yet in force. Once regulations set up a data mobility framework, an organisation in it must, when an individual asks, send the personal information it collected from them to another organisation in the framework.
- Bill C-36 (Protecting Privacy and Consumer Data Act): Introduced on 15 June 2026 to replace Part 1 of PIPEDA, with fines and a new Digital Safety and Data Protection Commission. Only first reading had happened when checked. Its predecessor, Bill C-27, died in January 2025 along with its Artificial Intelligence and Data Act.
Regulators
Section titled “Regulators”- Office of the Privacy Commissioner of Canada (OPC)
- Canadian Radio-television and Telecommunications Commission (CRTC), for CASL
What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”PIPEDA covers private-sector organisations that handle personal information in commercial activities, plus employee data of federally regulated businesses such as banks, airlines and telecoms. Non-profits are covered only for commercial activities. Alberta, British Columbia and Quebec have their own private-sector laws that apply instead within those provinces, but PIPEDA still covers federally regulated businesses and data crossing provincial or national borders. Business contact details used only to reach someone about their work are excluded.
Sources: laws-lois.justice.gc.ca/eng/acts/P-8.6/page-1.html · priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-info… · priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-info… · laws-lois.justice.gc.ca/eng/regulations/SOR-2004-219/page-1.html · laws-lois.justice.gc.ca/eng/regulations/SOR-2004-220/page-1.html
Lawful bases
Section titled “Lawful bases”PIPEDA is consent-based. Organisations need meaningful consent to collect, use or disclose personal information, unless a listed exception applies, and only for purposes a reasonable person would consider appropriate. Consent counts only if people would understand its nature, purpose and consequences. Express consent is generally needed for sensitive information, for uses outside reasonable expectations, or where there’s a meaningful risk of significant harm. A right to move data between organisations is enacted but not yet in force (see laws).
Sources: laws-lois.justice.gc.ca/eng/acts/P-8.6/page-1.html · laws-lois.justice.gc.ca/eng/acts/P-8.6/nifnev.html · laws-lois.justice.gc.ca/eng/acts/P-8.6/page-7.html · priv.gc.ca/en/privacy-topics/collecting-personal-information/consent/…
Consent age for online services
Section titled “Consent age for online services”PIPEDA sets no age. The OPC’s position is that, in all but exceptional circumstances, consent for children under 13 must come from a parent or guardian. For older minors, consent is valid only if their maturity lets them understand what they agree to.
Sources: priv.gc.ca/en/privacy-topics/collecting-personal-information/consent/… · priv.gc.ca/en/privacy-topics/privacy-for-businesses/protection-of-chi…
Children
Section titled “Children”The OPC’s Children’s Privacy Code (20 October 2026) is guidance on PIPEDA for online services directed at or likely to be used by under-18s. It expects the child’s best interests to come first, opt-in for non-essential uses, location, profile visibility and third-party sharing off by default, no profiling for marketing or behavioural ads, and no deceptive design. The OPC takes comments until 20 January 2027. Its age assurance guidance is being finalised. Bill C-36 would list under-18s’ information as an example of sensitive information (pending).
Sources: priv.gc.ca/en/privacy-topics/privacy-for-businesses/protection-of-chi… · priv.gc.ca/en/opc-news/news-and-announcements/2026/nr-c_261020 · priv.gc.ca/en/about-the-opc/what-we-do/consultations/completed-consul… · parl.ca/DocumentViewer/en/45-1/bill/C-36/first-reading
Cookies and similar technologies
Section titled “Cookies and similar technologies”No separate cookie law. Online tracking falls under PIPEDA consent. The OPC accepts opt-out consent for behavioural advertising only if the purposes are obvious, people learn of them at or before collection, the opt-out is easy, immediate and lasting, and the data is non-sensitive where practicable. Avoid tracking children, and don’t use tracking people can’t decline, such as fingerprinting. CASL treats cookies and scripts as consented to where a person’s conduct shows it.
Sources: priv.gc.ca/en/privacy-topics/technology/online-privacy-tracking-cooki… · laws-lois.justice.gc.ca/eng/acts/E-1.6/page-2.html
Electronic marketing
Section titled “Electronic marketing”Under CASL, commercial electronic messages such as email and texts need express or implied consent, sender identification and a free unsubscribe that takes effect within 10 business days. Implied consent covers, for example, a purchase in the past two years or an inquiry in the past six months. Messages that only give a requested quote or confirm a transaction don’t need consent, but still need sender identification and an unsubscribe. Installing software on someone’s device in the course of business needs express consent.
Sources: laws-lois.justice.gc.ca/eng/acts/E-1.6/page-1.html · laws-lois.justice.gc.ca/eng/acts/E-1.6/page-2.html
Breach notification
Section titled “Breach notification”Report a breach of security safeguards to the OPC, and notify the people affected, as soon as feasible once you determine it creates a real risk of significant harm. Also notify organisations that can reduce the harm. Keep a record of every breach, reportable or not, for 24 months. Knowingly failing to report, notify or keep records is an offence.
Sources: laws-lois.justice.gc.ca/eng/acts/P-8.6/page-3.html · laws-lois.justice.gc.ca/eng/regulations/SOR-2018-64/page-1.html · priv.gc.ca/en/privacy-topics/business-privacy/breaches-and-safeguards…
Registration and fees
Section titled “Registration and fees”None. PIPEDA has no registration duty and no fee for organisations.
Sources: laws-lois.justice.gc.ca/eng/acts/P-8.6 · priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-info…
Data protection officer
Section titled “Data protection officer”Designate one or more people accountable for compliance and give their identity on request. They can delegate day-to-day work, but the organisation stays accountable. OPC guidance expects a privacy management program with a named person in charge.
Sources: laws-lois.justice.gc.ca/eng/acts/P-8.6/page-7.html · priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-info…
International transfers
Section titled “International transfers”PIPEDA doesn’t restrict transfers outside Canada. The organisation stays accountable for information sent to a processor and must use contracts or other means to get a comparable level of protection. Tell people their information may be processed abroad and accessed by foreign courts and authorities. Bill C-36 would require a privacy impact assessment before transfers out of Canada (pending).
Sources: laws-lois.justice.gc.ca/eng/acts/P-8.6/page-7.html · priv.gc.ca/en/privacy-topics/airports-and-borders/gl_dab_090127 · parl.ca/DocumentViewer/en/45-1/bill/C-36/first-reading
Impact assessments
Section titled “Impact assessments”Not required by PIPEDA. The OPC recommends privacy impact assessments for new projects involving personal information and for generative AI, and its Children’s Privacy Code strongly encourages them for higher-risk services used by children.
Sources: priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-info… · priv.gc.ca/en/privacy-topics/technology/artificial-intelligence/gd_pr… · priv.gc.ca/en/privacy-topics/privacy-for-businesses/protection-of-chi…
Automated decisions and AI
Section titled “Automated decisions and AI”No federal AI law. The Artificial Intelligence and Data Act died with Bill C-27 in January 2025, and Bill C-36 leaves AI out, though it would give people an explanation of automated decisions with significant effects (pending). The OPC’s generative AI principles expect a legal basis, necessity, openness, explainable outputs and impact assessments, and warn of no-go zones. The government consulted on AI transparency in 2026.
Sources: parl.ca/legisinfo/en/bill/44-1/c-27 · parl.ca/DocumentViewer/en/45-1/bill/C-36/first-reading · priv.gc.ca/en/privacy-topics/technology/artificial-intelligence/gd_pr… · priv.gc.ca/en/opc-news/news-and-announcements/2026/nr-c_261023
Penalties
Section titled “Penalties”The OPC investigates, makes findings and can enter compliance agreements, but it can’t fine. Complainants or the OPC can apply to the Federal Court, which can order changes and award damages. Knowingly breaching the breach rules or obstructing the OPC is an offence with fines up to $100,000. CASL violations carry penalties up to $1 million for individuals and $10 million for others. Bill C-36 would add fines up to $10 million or 3% of global revenue (pending).
Sources: laws-lois.justice.gc.ca/eng/acts/P-8.6/page-3.html · laws-lois.justice.gc.ca/eng/acts/P-8.6/page-4.html · laws-lois.justice.gc.ca/eng/acts/P-8.6/page-5.html · priv.gc.ca/en/privacy-topics/business-privacy/breaches-and-safeguards… · laws-lois.justice.gc.ca/eng/acts/E-1.6/page-3.html · parl.ca/DocumentViewer/en/45-1/bill/C-36/first-reading
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | Added the data mobility amendments to PIPEDA (S.C. 2026, c. 3, ss. 389–390), enacted but not yet in force, found by Law Watch’s first check of Justice Laws. |
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/ca.yaml.