The legal framework
The Personal Information Protection and Electronic Documents Act applies to commercial activity across Canada, except where a province has substantially similar legislation — Quebec, British Columbia and Alberta. Quebec's Law 25 imposes consent, breach notification and portability requirements comparable to the GDPR. Federal reform bills have repeatedly failed to pass.
Key points
| Federal | PIPEDA: access, correction and complaint to the Privacy Commissioner |
|---|---|
| Quebec | Law 25: explicit consent, privacy officer, breach reporting, portability since 2024, heavy penalties |
| British Columbia and Alberta | Substantially similar provincial statutes |
| Health data | Provincial health information statutes apply |
| Breach notification | Mandatory under PIPEDA where there is a real risk of significant harm |
| Enforcement | The federal Commissioner can investigate and recommend; Quebec can impose substantial penalties |
| Reform | Federal modernisation bills have not been enacted |
| PIPEDA | Applies to commercial activity; substantially similar provincial laws apply in three provinces |
| Findings not orders | The federal Commissioner makes findings; binding orders require the Federal Court |
| Quebec Law 25 | Adds breach notification, portability and de-indexing rights |
| Breach reporting | Mandatory where there is a real risk of significant harm |
In practice
- Write to the organisation first, citing the relevant statutory right; keep proof of the date.
- Set out clearly what you want: a copy of your data, deletion, or an end to marketing.
- If there is no adequate reply within the statutory period, complain to the regulator — it is free.
- For dating, health and fertility apps, ask specifically about third-party sharing and overseas transfers.
- Complain to the organisation first: the Commissioner will ask whether you did.
- In Quebec, use the de-indexing right where search results are the problem.
Cost and coverage
Free; organisations may charge only minimal reproduction costs in limited circumstances.
Recent changes
Quebec's Law 25 has effectively become the national benchmark, because national companies apply its standards everywhere rather than run two systems.
Where to go
- Office of the Privacy Commissioner of Canada.
- Commission d'accès à l'information du Québec.
- Provincial commissioners in British Columbia and Alberta.
Worth knowing
If you deal with a company operating nationally, invoking Quebec's rules can be effective even outside Quebec, because most large organisations have aligned their practices to the strictest standard they face. The federal Commissioner cannot impose fines. Quebec's regime, by contrast, has substantial penalties and is the stronger route where it applies.
Official sources and links
- Canada.ca — official government portal
- Justice Laws Website — federal statutes and regulations