Security + privacy regulations in Canada

Canada's privacy regime is federated. PIPEDA (Personal Information Protection and Electronic Documents Act) applies federally to private-sector organizations, with 'substantially similar' provincial laws in Alberta (PIPA), British Columbia (PIPA), and Quebec (Law 25). PIPEDA is based on ten fair-information principles derived from the OECD guidelines — similar in spirit to GDPR but less prescriptive. Quebec's Law 25, phased in from 2022 through 2024, is the outlier. It is the most prescriptive Canadian privacy regime: mandatory Privacy Impact Assessments for certain processing activities, explicit consent for automated decision-making, data-localization-style requirements (technically transfer-impact assessments), and a dedicated breach-notification regime with specific timelines and required content. If you serve Quebec users, Law 25 effectively supersedes PIPEDA for that population. The proposed Consumer Privacy Protection Act (CPPA, part of Bill C-27) would modernize PIPEDA to approximate GDPR more closely, but has been in parliamentary process for years. As of 2026 it's unclear when (or if) it passes. Breach notification in Canada is trigger-based under PIPEDA ('real risk of significant harm') rather than timeline-based, but provincial regimes (especially Quebec) impose specific timelines and content requirements. CASL (Canadian Anti-Spam Legislation) governs commercial electronic messages with one of the stricter consent regimes globally.