Canada

The Personal Information Protection and Electronic Documents Act, known as PIPEDA, covers private-sector organisations. It applies when they collect, use or disclose personal information as part of commercial activity. The Privacy Commissioner's own summary says it covers 'all businesses that operate in Canada and handle personal information that crosses provincial or national borders in the course of commercial activities'. Three provinces are excluded for activity that stays inside the province, because their own laws were declared substantially similar. They are Quebec, Alberta and British Columbia. Federal works and undertakings stay under PIPEDA everywhere, including in those three provinces. That means banks, airlines, telecoms and inter-provincial transport. Under the Retail Payment Activities Act, a foreign payment service provider must register with the Bank of Canada. That applies if it handles retail payments for an end user in Canada and aims those activities at people or businesses in Canada. If it has no office here it 'must identify the name and address of an agent or mandatary within Canada'. Quebec requires every business to have a named person in charge of protecting personal information. Their title and contact details must be published. The job falls to the most senior executive by default, and that person does not have to be in Quebec.

Your industry decides the answer. Checked industry by industry as at 18 August 2026: - Every industry, national level: OPEN. PIPEDA says nothing about where data must be stored. There is no approved-destination list and no banned-destination list. The Privacy Commissioner states plainly that PIPEDA does not stop this. Organisations in Canada may send personal information to an organisation in another country to be handled there. - Anyone handling data about people in Quebec: CONDITIONAL. Since September 2023 you must carry out a privacy impact assessment before personal information leaves Quebec. You may go ahead only if that assessment shows the information would get adequate protection. You also need a written agreement. Watch the geography. The trigger is leaving Quebec, so a Montreal company using a Toronto data centre is caught. - Nova Scotia public sector and its private suppliers: CLOSED. Personal information held by public bodies and municipalities 'must remain in Canada, be accessed, and disclosed only in Canada'. Only narrow exceptions apply. This binds contracted service providers, not just the public body. - Federal government data: CLOSED for sensitive categories. All Protected B, Protected C and Classified government electronic data must be stored in a government-approved computing facility inside Canada. Canadian government premises abroad also count. - Federally regulated banks and insurers: KEEP A COPY HERE. The Office of the Superintendent of Financial Institutions requires complete copies of the statutory Records to be kept on computer servers physically located in Canada. They must be updated and accurate as at the end of each business day. Some exempt institutions may hold records abroad. That only works if the supervisor gets immediate, direct, complete and ongoing access. Separately, the Superintendent can order a bank to stop keeping copies abroad, or to keep copies at a place in Canada. - Critical cyber systems in banking, telecoms, energy and transport: KEEP A COPY HERE. The Critical Cyber Systems Protection Act has been in force since June 2026. It says records a designated operator must keep 'must be kept in Canada'. - Health: OPEN in Ontario. The Ontario privacy regulator says directly that its health privacy law 'does not require that personal health information be retained and stored in Ontario or Canada'. Other provinces differ. Nova Scotia's health authorities are caught by that province's Canada-only rule. - Payments: OPEN on storage. The Retail Payment Activities Act requires registration, safeguarding and incident reporting. We found no requirement that payment data or safeguarded funds sit in Canada. - British Columbia public sector: CONDITIONAL and unsettled. The old rule requiring storage only in Canada was removed in 2021. What is left is a power. A public body 'may disclose personal information outside of Canada only if the disclosure is in accordance with the regulations, if any, made by the minister'. - Mapping and geospatial data: we found no restriction, checked 18 August 2026, confidence medium.

There is no list at the national level. So the question of whether a list has been filled in does not arise federally. That is a risk in itself. There is nothing to check, nothing to watch, and nothing stopping a future government from creating a list. The Privacy Commissioner's cross-border guidance sets out three duties. First, accountability. You must use contractual or other means to give a comparable level of protection while your supplier handles the information. Second, transparency. You must tell people their information may be sent to another country to be handled. You must also tell them that while it is there, the courts, law enforcement and national security authorities may reach it. Third, a firm limit that the guidance spells out. No contract can override the criminal, national security or other laws of the destination country. Quebec works more like a safety test you run yourself. You do a privacy impact assessment, sized to the sensitivity, purpose, volume, distribution and format of the information. The transfer may go ahead only if it shows the information would get adequate protection. You also need a written agreement.

We rate enforcement active rather than aggressive. There is plenty of activity and there are real investigations. But the main national regulator has no power to fine. Office of the Privacy Commissioner of Canada. Fully operational. Its 2025-26 annual report, published 4 June 2026, records 3,044 PIPEDA complaints received, up 109 per cent on the year before. It also records 3,146 Privacy Act complaints, up 62 per cent. It records nearly 700 private-sector breach reports, affecting more than 20 million Canadians. And it records around 450 federal institution breach reports. Published 2026 findings include a joint investigation into OpenAI in May 2026, commissioner-initiated complaints against X Corp. and X.AI in June 2026, Bell in June 2026, a WestJet compliance letter in July 2026 and Loblaw's PC Optimum loyalty programme in March 2026. It has no power to impose money penalties under PIPEDA. Commission d'accès à l'information du Québec. Operational and using its new powers. In February 2025 it stopped Metro Inc. bringing a biometric database into service. It took part in the joint OpenAI investigation that finished in May 2026. It can impose money penalties. The cap is 2 per cent of worldwide turnover, or 10 million Canadian dollars (about 7.3 million US dollars), whichever is greater. Court proceedings can reach the greater of 4 per cent of worldwide turnover or 25 million Canadian dollars (about 18 million US dollars). Both figures double for repeat offences. Office of the Superintendent of Financial Institutions. Operational. It supervises banks and insurers, and it sets the keep-records-in-Canada expectation. Bank of Canada. Operational as the retail payments supervisor since 2024-25. Registration became compulsory on 8 September 2025 and it publishes enforcement decisions. Communications Security Establishment, plus the industry regulators named in the Critical Cyber Systems Protection Act. The reporting channel is written into the law but is not switched on. The regulations naming who is covered and how to report have not been made. Provincial commissioners in Alberta, British Columbia and Ontario are all operational and publish orders.

MINIMUMS. Income Tax Act section 230 requires records and books of account to be kept 'at the person's place of business or residence in Canada or at such other place as may [be] designated by the Minister'. They must be kept 'until the expiration of six years from the end of the last taxation year to which the records and books of account relate'. Electronic records must stay readable by computer for that period. Under PIPEDA you must keep a record of every breach of security safeguards for two years, whether or not you had to report it. Registered payment service providers must file an annual report to the Bank of Canada by 31 March, covering the previous calendar year. That assumes you keep the underlying operational and incident data. Designated operators under the Critical Cyber Systems Protection Act must keep required records in Canada, for a period their regulator sets. Federally regulated banks must keep complete copies of statutory Records on servers in Canada, updated as at the end of each business day. MAXIMUMS. PIPEDA says you may keep personal information only as long as you need it for the purposes you identified. After that you must destroy it, erase it or make it anonymous. Quebec goes further. It makes destroying or anonymising the data an enforceable duty once the purpose is achieved. WHEN THEY CLASH. Canada settles this the ordinary way. A specific legal duty to keep records beats the general privacy duty to delete. That applies to those records and that period only. It does not let you keep anything else.

CLOCK 1. PIPEDA, for all commercial organisations. Report to the Privacy Commissioner and tell the affected people 'as soon as feasible'. The clock starts when you decide a breach of security safeguards creates a real risk of significant harm. No hour count is set. Keep a record of every breach for 24 months. Knowingly failing to report, notify or keep records is a crime. CLOCK 2. Retail Payment Activities Act, for registered payment service providers. Tell the Bank of Canada and the affected people or businesses 'without delay but no later than 48 hours'. That runs from when you decide an incident is material. You may need to send initial, interim and final notices. There is a separate rule. Give at least five business days' notice before significant operational changes. CLOCK 3. Critical Cyber Systems Protection Act, for designated operators in banking, telecoms, energy and transport. Report a cyber security incident to the Communications Security Establishment 'within a period prescribed by the regulations, not to exceed 72 hours'. Then 'immediately after reporting' tell the right industry regulator. This clock is in the law but does not start running until the regulations and designation orders are made. CLOCK 4. Quebec. Report confidentiality incidents that risk serious injury to the Commission and to the people affected, with diligence. Keep a register of incidents. CLOCK 5. Provincial health. Alberta's Health Information Act applies where there is a risk of harm. Custodians must tell the affected people, the Information and Privacy Commissioner and the Minister of Health 'as soon as practicable'. Ontario requires notice at the first reasonable opportunity, and an agent must tell its custodian at the first reasonable opportunity. The usual mistake in Canada is not missing one deadline. It is a payments or infrastructure firm treating the privacy report as the only report.

TRAP 1. 'Outside Quebec' does not mean 'outside Canada'. Quebec's assessment-and-agreement rule applies to any move of personal information beyond Quebec's borders. A Quebec business moving to a Toronto or Vancouver cloud region does the same paperwork as one moving to Ireland. Most cross-border compliance programmes are built around national borders and miss this. TRAP 2. Biometrics in Quebec run on a 60-day fuse. Creating a database of biometric characteristics and measurements 'must be disclosed to the Commission d'accès à l'information promptly and not later than 60 days before it is brought into service'. Biometric checks also need express consent plus notice in advance. The Commission can suspend or ban the database. It did exactly that to Metro Inc. in February 2025. Plan the notice before you sign the supplier contract, not after. TRAP 3. British Columbia's keep-it-in-Canada rule is gone. The old requirement that public bodies store personal information only in Canada was repealed in 2021 and is not in the current statute. What is left is a power to make regulations about disclosure outside Canada. Suppliers still selling 'British Columbia data must stay in Canada' as a legal fact are selling a repealed rule. The power sits there unused, so the rule could come back without a new law. TRAP 4. Nova Scotia's rule is about you, not just about government. It binds 'service providers contracted by these entities who handle personal information'. If you sell software to a Nova Scotia municipality, university or health authority, your storage and your support team's screen access must be in Canada. Fines reach 500,000 Canadian dollars (about 365,000 US dollars) for a corporation. They reach 25,000 Canadian dollars for an unincorporated business, and 2,000 Canadian dollars for an individual employee. TRAP 5. Canada has a quiet records-location rule in tax law. Income Tax Act section 230 requires records to be kept at a place of business or residence in Canada, unless the Minister names somewhere else. It is old, it is often ignored, and it is still on the books. TRAP 6. The national privacy regulator cannot fine you, which leads people to ignore it. Quebec's regulator can reach 4 per cent of worldwide turnover. Your risk is concentrated in the province with 23 per cent of the population.

LANDING IN THE NEXT 12 MONTHS - Bill C-36, the Protecting Privacy and Consumer Data Act. Introduced and given first reading on 15 June 2026. At second reading in the House of Commons as at 18 August 2026. Status: proposed, no legal effect. It would repeal Part 1 of PIPEDA. It would create a Privacy and Consumer Data Commissioner inside a new Digital Safety and Data Protection Commission of Canada. It would require a privacy impact assessment, and steps to reduce risk, before personal information is disclosed or transferred outside Canada. It would create a right to ask for personal information to be disposed of. And it would define a child as anyone under 18, with children's information treated as sensitive by default. Two earlier attempts, Bill C-11 and Bill C-27, both died before becoming law. Treat passage as uncertain. - Critical Cyber Systems Protection Act phase-in. Bill C-8 received royal assent in June 2026. The Telecommunications Act security amendments took effect immediately. The Critical Cyber Systems Protection Act itself is being brought in gradually. Its real duties do not apply until the designation and reporting regulations are made. Those duties are a cyber security programme within 90 days of designation, reducing supply-chain risk, reporting incidents inside 72 hours, and keeping records in Canada. Watch for those regulations. - Bill C-2, the Strong Borders Act, would widen police access powers over service providers. It has been stuck at second reading since September 2025. Status: proposed. POWERS ALREADY HELD, USABLE WITH NO CONSULTATION 1. The Superintendent of Financial Institutions can order a bank to stop keeping copies of records in another country. It can also order copies to be kept at any place in Canada. That applies where access is inadequate, or the Minister advises it is against the national interest. The bank 'shall without delay comply'. A single order can turn a global bank's data setup into a Canadian one. 2. British Columbia's minister can make regulations about disclosing personal information outside Canada. The power is in the statute. We could not confirm whether it has been used. 3. The amended Telecommunications Act lets the Governor in Council and the Minister direct telecommunications providers on security matters. That has been in force since royal assent. 4. Nova Scotia's Canada-only rule already lets the head of a public body allow exceptions. So the strictness can be adjusted either way by administrators.