Canada

The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to private-sector organisations that collect, use or disclose personal information in the course of commercial activity. The Privacy Commissioner's own summary states it covers 'all businesses that operate in Canada and handle personal information that crosses provincial or national borders in the course of commercial activities'. Three provinces are carved out for purely intra-provincial activity because their own laws were declared substantially similar: Quebec, Alberta and British Columbia. Federal works and undertakings (banks, airlines, telecoms, inter-provincial transport) stay under PIPEDA everywhere, including in those three provinces. Under the Retail Payment Activities Act, a foreign payment service provider that performs retail payment activities for an end user in Canada and directs those activities at people or entities in Canada must register with the Bank of Canada; if it has no office here it 'must identify the name and address of an agent or mandatary within Canada'. Quebec requires every business to have a named person in charge of protecting personal information, whose title and contact details must be published; that person defaults to the most senior executive but need not sit in Quebec.

Rated sectoral Sector-by-sector picture as at 18 August 2026: - All industries, national layer: OPEN. PIPEDA has no localisation rule, no approved-destination list and no prohibited-destination list. The Privacy Commissioner states plainly that 'PIPEDA does not prohibit organizations in Canada from transferring personal information to an organization in another jurisdiction for processing.' - Anyone handling data about people in Quebec: CONDITIONAL. Since September 2023, before personal information is communicated outside Quebec a business must carry out a privacy impact assessment, and may proceed only if that assessment shows the information would get adequate protection. It must also be covered by a written agreement. Note the geography: the trigger is 'outside Quebec', so a Montreal company using a Toronto data centre is caught. - Nova Scotia public sector and its private suppliers: CLOSED. Personal information held by public bodies and municipalities 'must remain in Canada, be accessed, and disclosed only in Canada' unless a narrow exception applies. This binds contracted service providers, not just the public body. - Federal government data: CLOSED for sensitive categories. All Protected B, Protected C and Classified government electronic data must be stored in a government-approved computing facility inside Canada (or on Canadian government premises abroad). - Federally regulated banks and insurers: MIRROR. OSFI's third-party risk guideline requires that complete copies of the statutory Records be kept on computer servers physically located in Canada, updated and accurate as at the end of each business day. Certain exempt institutions may hold records abroad only if OSFI gets immediate, direct, complete and ongoing access. Separately, the Superintendent can order a bank to stop keeping copies abroad, or to keep copies at a place in Canada. - Critical cyber systems in banking, telecoms, energy and transport: MIRROR. The Critical Cyber Systems Protection Act, in force since June 2026, says records a designated operator must keep 'must be kept in Canada'. - Health: OPEN in Ontario. The Ontario privacy regulator says directly that its health privacy law 'does not require that personal health information be retained and stored in Ontario or Canada'. This corrects a very common myth. Other provinces differ and Nova Scotia's health authorities are caught by that province's Canada-only rule. - Payments: OPEN on storage. The Retail Payment Activities Act imposes registration, safeguarding and incident reporting, but we found no requirement that payment data or safeguarded funds sit in Canada. - British Columbia public sector: CONDITIONAL and unsettled. The old rule requiring storage only in Canada was removed in 2021. What remains is a power: a public body 'may disclose personal information outside of Canada only if the disclosure is in accordance with the regulations, if any, made by the minister'. - Mapping and geospatial data: no restriction found, checked 18 August 2026, confidence medium.

Model at the national layer is dg:xmodel:unrestricted. Because there is no list, the question 'is the list populated?' does not arise federally — and that is itself the risk picture: nothing to check, nothing to watch, and nothing stopping a future government from creating one. The Privacy Commissioner's cross-border guidance sets out three duties. First, accountability: 'The organization shall use contractual or other means to provide a comparable level of protection while the information is being processed by the third party.' Second, transparency: organisations must advise individuals that their information 'may be sent to another jurisdiction for processing and that while the information is in another jurisdiction it may be accessed by the courts, law enforcement and national security authorities'. Third, a hard limit the guidance is explicit about: no contract can override the criminal, national security or other laws of the destination country. In Quebec the model is closer to a self-assessed adequacy test: a privacy impact assessment proportionate to the sensitivity, purpose, volume, distribution and format of the information, and the transfer may proceed only if it shows the information would receive adequate protection, backed by a written agreement.

Rated actively enforced, not aggressive: high activity, real investigations, but the flagship national regulator has no direct fining power. Office of the Privacy Commissioner of Canada — fully operational. Its 2025-26 annual report, published 4 June 2026, records 3,044 PIPEDA complaints received (up 109% year on year), 3,146 Privacy Act complaints (up 62%), nearly 700 private-sector breach reports affecting more than 20 million Canadians, and around 450 federal institution breach reports. Published 2026 findings include a joint investigation into OpenAI (May 2026), commissioner-initiated complaints against X Corp. and X.AI (June 2026), Bell (June 2026), a WestJet compliance letter (July 2026) and Loblaw's PC Optimum loyalty programme (March 2026). It has no administrative monetary penalty power under PIPEDA. Commission d'accès à l'information du Québec — operational and using its new powers. In February 2025 it prohibited Metro Inc. from bringing a biometric database into service. It participated in the joint OpenAI investigation concluded May 2026. It can impose administrative monetary penalties of up to the greater of 2% of worldwide turnover or C$10 million (about US$7.3 million), and penal proceedings can reach the greater of 4% of worldwide turnover or C$25 million (about US$18 million), doubled for repeat offences. Office of the Superintendent of Financial Institutions — operational, supervises banks and insurers, sets the records-in-Canada expectation. Bank of Canada — operational as the retail payments supervisor since 2024-25; registration became compulsory on 8 September 2025 and it publishes enforcement decisions. Communications Security Establishment and the sector regulators named in the Critical Cyber Systems Protection Act — the reporting pipe is legislated but not yet switched on, because the designation and reporting regulations are still to be made. Provincial commissioners in Alberta, British Columbia and Ontario are all operational and publish orders.

FLOOR. Income Tax Act section 230 requires records and books of account to be kept 'at the person's place of business or residence in Canada or at such other place as may [be] designated by the Minister', and retained 'until the expiration of six years from the end of the last taxation year to which the records and books of account relate'. Electronic records must be kept in an electronically readable format for that period. Under PIPEDA an organisation must keep a record of every breach of security safeguards for two years, whether or not it was reportable. Registered payment service providers must file an annual report to the Bank of Canada by 31 March covering the previous calendar year, which presupposes retaining the underlying operational and incident data. Designated operators under the Critical Cyber Systems Protection Act must keep prescribed records in Canada, for a period their regulator sets. Federally regulated banks must keep complete copies of statutory Records on servers in Canada, updated as at the end of each business day. CEILING. PIPEDA's limiting-use principle requires personal information to be retained only as long as necessary to fulfil the identified purposes, and destroyed, erased or made anonymous once no longer required. Quebec goes further and adds an enforceable destruction-or-anonymisation duty once the purpose is achieved. CONFLICT. Canada resolves this the ordinary way: a specific statutory retention duty overrides the general privacy duty to delete, for those records and that period only. It does not licence keeping everything else.

CLOCK 1 — PIPEDA (all commercial organisations). Report to the Privacy Commissioner and notify affected individuals 'as soon as feasible' after determining that a breach of security safeguards creates a real risk of significant harm. No hour count is specified. Keep a record of every breach for 24 months. Knowingly failing to report, notify or keep records is an offence. CLOCK 2 — Retail Payment Activities Act (registered payment service providers). Notify the Bank of Canada and affected individuals or entities 'without delay but no later than 48 hours' after determining an incident is material. Initial, interim and final notices may all be required. Separate rule: at least five business days' advance notice before significant operational changes. CLOCK 3 — Critical Cyber Systems Protection Act (designated operators in banking, telecoms, energy and transport). Report a cyber security incident to the Communications Security Establishment 'within a period prescribed by the regulations, not to exceed 72 hours', and 'immediately after reporting' notify the appropriate sector regulator. This clock is legislated but does not start running until the regulations and designation orders are made. CLOCK 4 — Quebec. Confidentiality incidents presenting a risk of serious injury must be reported to the Commission and to the people affected with diligence, and a register of incidents kept. CLOCK 5 — provincial health. Alberta's Health Information Act requires custodians to notify affected individuals, the Information and Privacy Commissioner and the Minister of Health 'as soon as practicable' where there is a risk of harm. Ontario requires notification at the first reasonable opportunity, and an agent must tell its custodian at the first reasonable opportunity. The practical failure mode in Canada is not missing a single deadline. It is a payments or infrastructure firm treating the privacy report as the only report.

TRAP 1 — 'Outside Quebec' does not mean 'outside Canada'. Quebec's assessment-and-agreement requirement bites on any communication of personal information beyond Quebec's borders. A Quebec business moving to a Toronto or Vancouver cloud region triggers the same paperwork as one moving to Ireland. Most cross-border compliance programmes are built around national borders and miss this entirely. TRAP 2 — Biometrics in Quebec run on a 60-day fuse. The creation of a database of biometric characteristics and measurements 'must be disclosed to the Commission d'accès à l'information promptly and not later than 60 days before it is brought into service', and biometric verification needs express consent plus prior notice. The Commission can suspend or prohibit the database. It did exactly that to Metro Inc. in February 2025. Plan the notification before you sign the vendor contract, not after. TRAP 3 — British Columbia's data-residency rule is gone. The old requirement that public bodies store personal information only in Canada was repealed in 2021 and does not appear in the current statute. What is left is a regulation-making power over disclosure outside Canada. Vendors still marketing 'BC data residency required' as a legal fact are selling a repealed rule. That said, the power sits there unused, so this is a dormant switch, not a settled liberalisation. TRAP 4 — Nova Scotia's rule is about you, not just about government. It binds 'service providers contracted by these entities who handle personal information'. If you sell software to a Nova Scotia municipality, university or health authority, your storage and your support team's screen access must be in Canada. Fines reach C$500,000 (about US$365,000) for a corporation, C$25,000 for an unincorporated business and C$2,000 for an individual employee. TRAP 5 — Canada has a quiet records-location rule in tax law. Income Tax Act section 230 requires records to be kept at a place of business or residence in Canada unless the Minister designates somewhere else. It is old, it is routinely ignored, and it is still on the books. TRAP 6 — The national privacy regulator cannot fine you, which lulls people into ignoring it, while Quebec's regulator can reach 4% of worldwide turnover. Risk is concentrated in the province with 23% of the population.

LANDING IN THE NEXT 12 MONTHS - Bill C-36, the Protecting Privacy and Consumer Data Act. Introduced and given first reading on 15 June 2026; at second reading in the House of Commons as at 18 August 2026. Status: proposed, no legal effect. It would repeal Part 1 of PIPEDA, create a Privacy and Consumer Data Commissioner inside a new Digital Safety and Data Protection Commission of Canada, require a privacy impact assessment and mitigation measures before personal information is disclosed or transferred outside Canada, create a right to request disposal of personal information, and define a child as anyone under 18 with children's information treated as sensitive by default. Two previous attempts (Bill C-11 and Bill C-27) both died on the order paper, so treat passage as uncertain. - Critical Cyber Systems Protection Act phase-in. Bill C-8 received royal assent in June 2026. The Telecommunications Act security amendments took effect immediately. The Critical Cyber Systems Protection Act itself is being brought in gradually, and its real obligations — cyber security programme within 90 days of designation, supply-chain risk mitigation, incident reporting inside 72 hours, records kept in Canada — do not bite until the designation and reporting regulations are made. Watch for those regulations. - Bill C-2, the Strong Borders Act, would expand lawful-access powers over service providers. It has been stuck at second reading since September 2025. Status: proposed. DORMANT SWITCHES — powers already held, usable without consultation 1. The Superintendent of Financial Institutions can order a bank to stop keeping copies of records in another country, or to keep copies at any place in Canada, where access is inadequate or the Minister advises it is against the national interest. The bank 'shall without delay comply'. This can turn a global bank's data architecture into a Canadian one with a single order. 2. British Columbia's minister can make regulations governing disclosure of personal information outside Canada. The power sits in the statute; whether it has been exercised we could not confirm. 3. The amended Telecommunications Act gives the Governor in Council and the Minister power to direct telecommunications providers on security matters, in force since royal assent. 4. Nova Scotia's Canada-only rule already allows the head of a public body to authorise exceptions — meaning the strictness is administratively adjustable in both directions.