Super Intelligence definition proposal due (60 days) · Nov 28, 2026 · See what changes
Dates and status re-checked against primary sources on . How we verify
Canada's federal private-sector privacy law, phased in from January 1, 2001 and fully in force since January 1, 2004, governing how organizations collect, use, and disclose personal information in the course of commercial activity. The Office of the Privacy Commissioner has issued guidance on how PIPEDA applies to AI, including automated decision-making and AI training data. Quebec's Law 25 (phased in between September 2022 and September 2024) is stricter and acts as the provincial overlay for Quebec residents.
If you collect, use, or disclose personal information of Canadians in commercial activity, PIPEDA applies — regardless of where your company is based. AI tools that process Canadian personal data must comply with PIPEDA's consent and accountability requirements. Quebec's Law 25 adds stricter requirements: privacy impact assessments before processing that poses a significant privacy risk, notice when a decision is made exclusively by automated processing (with an explanation and a chance for a person to review it on request), and mandatory notification of privacy incidents. If you serve Quebec customers, treat Quebec Law 25 as your compliance floor.