Data protection & privacy law in Canada (2026)
Data protection in Canada: comprehensive law.
Canada has a mature, comprehensive federal private-sector data-protection law — PIPEDA — in force since 2001 (fully applicable from 2004), overseen by the Office of the Privacy Commissioner of Canada, complemented by the federal Privacy Act for government institutions and by substantially-similar provincial laws in Quebec, Alberta and British Columbia. A GDPR-style modernization package (Bill C-27, containing the Consumer Privacy Protection Act, the Tribunal Act and the AIDA) died on the Order Paper when Parliament was prorogued in January 2025 and has not been reintroduced as of mid-2026, though the federal budget signaled a new private-sector privacy statute and tribunal bill are being prepared. Meanwhile, Quebec's Law 25 (fully in force since September 2024) currently sets the strictest bar in the country, with GDPR-like consent, breach and PIA obligations and administrative penalties up to CA$25M or 4% of worldwide turnover.
Legal framework
Personal Information Protection and Electronic Documents Act (PIPEDA), 2000 (federal private sector), and the Privacy Act, 1985 (federal public sector), supervised by the Office of the Privacy Commissioner of Canada (OPC); substantially similar provincial regimes include Quebec's Law 25, Alberta PIPA and British Columbia PIPA.
Key points: data & privacy in Canada
Federal private-sector law (PIPEDA)
PIPEDA applies to organizations that collect, use or disclose personal information in the course of commercial activities across Canada, based on 10 Fair Information Principles (Schedule 1) grounded in consent, purpose limitation, accuracy, safeguards and accountability. It applies federally except where a province has enacted 'substantially similar' private-sector legislation (Quebec, Alberta, BC).
Supervisory authority
The Office of the Privacy Commissioner of Canada (OPC) is the independent federal regulator that investigates complaints, conducts audits, publishes guidance and pursues enforcement under both PIPEDA and the Privacy Act; it works jointly with provincial commissioners (e.g., a 2026 joint investigation of OpenAI OpCo, LLC was published on 6 May 2026).
Mandatory breach reporting
Since 1 November 2018, organizations subject to PIPEDA must report to the OPC and notify affected individuals of any breach of security safeguards that creates a 'real risk of significant harm' (RROSH), regardless of the number of people affected, and must keep records of ALL breaches for 24 months.
Federal reform stalled (Bill C-27)
Bill C-27 — which would have replaced PIPEDA's private-sector provisions with the Consumer Privacy Protection Act (CPPA), created a Personal Information and Data Protection Tribunal with penalty powers up to 5% of global revenue, and enacted the Artificial Intelligence and Data Act (AIDA) — died on the Order Paper when Parliament was prorogued in January 2025 and had not been reintroduced by mid-2026, though the government has signaled a new private-sector privacy bill is planned.
Provincial regimes — Quebec Law 25 sets the bar
Quebec's Act respecting the protection of personal information in the private sector, as modernized by Law 25, has been fully in force since 22 September 2024 and imposes GDPR-style obligations — designated privacy officer, mandatory PIAs, granular consent, cross-border transfer assessments, portability, and administrative monetary penalties up to CA$25M or 4% of worldwide turnover — enforced by the Commission d'accès à l'information (CAI). Alberta and BC each have their own PIPA statutes.
Public-sector and adjacent cyber laws
The federal Privacy Act (R.S.C. 1985, c. P-21) governs the handling of personal information by federal government institutions and is also enforced by the OPC. Separately, Bill C-8 (Critical Cyber Systems Protection Act) received Royal Assent on 15 June 2026, imposing mandatory cybersecurity programs and incident-reporting duties on operators of designated critical cyber systems in federally regulated sectors — complementing but not replacing PIPEDA.
Timeline of decisions
- Enforcement · officialTikTok found to inadequately protect children's data in Canada
A joint investigation by the federal OPC and the Quebec, BC, and Alberta authorities found TikTok collected sensitive data, including biometric and profiling data, from hundreds of thousands of Canadian children; TikTok agreed to strengthen age assurance and stop targeting users under 18.
Office of the Privacy Commissioner of Canada
- Law · officialBill C-27 dies on prorogation, ending federal privacy reform attempt
When Parliament was prorogued, Bill C-27 (the Digital Charter Implementation Act, 2022) died on the Order Paper, killing the proposed Consumer Privacy Protection Act and Artificial Intelligence and Data Act; Canada remains governed by the 2000-era PIPEDA.
LEGISinfo, Parliament of Canada
- Decision · officialFederal Court of Appeal rules Facebook breached PIPEDA
In Canada (Privacy Commissioner) v. Facebook, 2024 FCA 140, the court overturned a lower ruling and found Facebook failed to obtain meaningful consent and to safeguard data in the Cambridge Analytica matter, clarifying the 'reasonable consumer' standard for consent.
Office of the Privacy Commissioner of Canada
- Decision · officialEuropean Commission confirms Canada's GDPR adequacy
In its first review since 2001, the European Commission concluded PIPEDA continues to provide protection 'essentially equivalent' to the EU, preserving unrestricted EU-to-Canada data flows for organizations subject to PIPEDA.
European Commission
- Enforcement · officialTim Hortons app found to violate privacy laws over location tracking
A joint federal-provincial investigation found the Tim Hortons app tracked users' location every few minutes, even when closed, without meaningful consent, collecting 'vast amounts' of sensitive data via a US provider, Radar.
Office of the Privacy Commissioner of Canada
- Law · officialQuebec's Law 25 (Bill 64) receives royal assent
Quebec became the first Canadian jurisdiction to substantially modernize its privacy regime, adding breach notification, consent, data portability, and significant penalties; provisions phased in through 2022-2024, raising the bar nationally.
National Assembly of Québec
- Enforcement · officialRCMP's use of Clearview AI ruled a Privacy Act violation
The Privacy Commissioner concluded the RCMP's use of Clearview AI's facial-recognition technology violated the federal Privacy Act, reinforcing limits on government use of AI biometric surveillance tools.
Office of the Privacy Commissioner of Canada
- Enforcement · officialClearview AI found to have conducted mass surveillance of Canadians
A joint federal-provincial investigation concluded Clearview AI's scraping of billions of facial images from the internet was unlawful mass surveillance violating PIPEDA; commissioners ordered it to stop collecting and to delete images of Canadians.
Office of the Privacy Commissioner of Canada
- Law · officialPIPEDA mandatory breach notification takes effect
Under the Breach of Security Safeguards Regulations (SOR/2018-64), private-sector organizations must report breaches posing a real risk of significant harm to the Privacy Commissioner, notify affected individuals, and keep breach records for 24 months.
Canada Gazette
- Law · officialMandatory breach reporting comes into force under PIPEDA
Organizations became legally required to report breaches posing a 'real risk of significant harm' to the Privacy Commissioner, notify affected individuals, and keep breach records, Canada's first nationwide mandatory breach regime for the private sector.
Canada Gazette
- Law · officialDigital Privacy Act (Bill S-4) receives royal assent
This amendment to PIPEDA introduced mandatory breach reporting and recordkeeping obligations and strengthened consent requirements, laying the groundwork for the breach rules that took effect in 2018.
Justice Laws Website, Government of Canada
- Decision · officialEuropean Commission grants Canada original GDPR-predecessor adequacy
The Commission ruled that PIPEDA provided adequate protection under the EU Data Protection Directive, enabling cross-border EU-to-Canada data transfers, a key external driver for Canada's privacy framework.
EUR-Lex, European Union
- Law · officialPIPEDA enacted, establishing security-safeguard duty
The Personal Information Protection and Electronic Documents Act became Canada's foundational private-sector privacy law, requiring organizations to protect personal information with safeguards appropriate to its sensitivity, the bedrock cyber obligation still in force.
Justice Laws Website
- Law · officialPIPEDA enacted, governing online personal data
The Personal Information Protection and Electronic Documents Act set ground rules for how private-sector organizations collect, use and disclose personal information in commercial activities, including online, Canada's foundational digital privacy framework, phased in through 2004.
Office of the Privacy Commissioner of Canada
Sources
- priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-pro
- laws-lois.justice.gc.ca/eng/acts/p-8.6/
- laws-lois.justice.gc.ca/eng/acts/p-21/
- priv.gc.ca/en/about-the-opc/
- priv.gc.ca/en/privacy-topics/business-privacy/breaches-and-safeguards/privacy-br
- parl.ca/legisinfo/en/bill/44-1/c-27
- justice.gc.ca/eng/csj-sjc/pl/charter-charte/c27_1.html
- legisquebec.gouv.qc.ca/en/document/cs/P-39.1%20/20230630
- cai.gouv.qc.ca/uploads/pdfs/CAI_RQ_2026.pdf
- parl.ca/legisinfo/en/bill/45-1/c-8
- osler.com/en/insights/reports/2025-legal-outlook/canadas-2026-privacy-prioritie
- priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-busin
- priv.gc.ca/en/report-a-concern/report-a-privacy-breach-at-your-organization/repo
- priv.gc.ca/en/opc-news/news-and-announcements/2020/qa_20200924/
- priv.gc.ca/en/opc-actions-and-decisions/advice-to-parliament/2026/parl_sub_26052
Next for Canada: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 17 Aug 2026. Methodology & how to cite · State of Technology Regulation 2026