Canada Personal Information Protection and Electronic Documents Act (PIPEDA)

Canada's federal private-sector privacy law, governing how organizations collect, use, and disclose personal information in the course of commercial activity. The Office of the Privacy Commissioner has issued guidance on how PIPEDA applies to AI, including automated decision-making and AI training data. Quebec's Law 25 (in force since 2023) is significantly stricter and acts as the provincial overlay for Quebec residents.

Key requirements

• Meaningful consent required for collection, use, and disclosure of personal information
• Individuals can access their personal information and challenge inaccuracies
• Designated Privacy Officer accountable for PIPEDA compliance
• Mandatory breach notification to OPC and affected individuals for breaches creating real risk of significant harm
• Quebec Law 25: privacy impact assessments, explicit consent for certain AI decisions, stricter breach reporting

Further reading

• AI and Data Privacy for Small Teams (GDPR + CCPA Guide)
• AI Vendor Due Diligence in 30 Minutes (Questions + Scoring Sheet)