Coast To Coast To Coast.Always On Watch.

• Personal Information Protection Act (BC PIPA)

  Applies to: Private-sector organizations, including non-profits, collecting, using or disclosing personal information in BC (including employee information)

  Deemed substantially similar to PIPEDA. Requires consent, reasonable security arrangements and access rights. As of November 2026 there is no general mandatory breach notification duty for private organizations, although the OIPC recommends notifying affected people and reporting serious breaches voluntarily.

• Personal Information Protection and Electronic Documents Act (PIPEDA)

  Applies to: Federally regulated businesses in BC (banks, telecoms, airlines) and personal information that crosses provincial or national borders in the course of commercial activity

  Mandatory reporting to the Office of the Privacy Commissioner of Canada and notification of individuals when a breach creates a real risk of significant harm, plus breach records kept for 24 months.

• Freedom of Information and Protection of Privacy Act (FIPPA)

  Applies to: BC public bodies (ministries, health authorities, school districts, universities, municipalities) and their service providers

  Since February 1, 2023, public bodies must notify affected individuals and the commissioner of breaches that could reasonably be expected to cause significant harm, and must run privacy management programs. Part 3 privacy duties extend to service providers and their staff, and disclosure outside Canada requires a privacy impact assessment.

• E-Health (Personal Health Information Access and Protection of Privacy) Act

  Applies to: Designated provincial health information banks

  BC has no single health information act for private practice. Private clinics, dental offices and other private health providers are generally governed by BC PIPA, while public health bodies fall under FIPPA and, for health information banks, the E-Health Act.

City pages:AbbotsfordBurnabyKelownaRichmondSurreyVancouverVictoria

• Personal Information Protection Act (Alberta PIPA)

  Applies to: Private-sector organizations in Alberta, and non-profits for personal information collected in connection with a commercial activity

  Deemed substantially similar to PIPEDA. Since 2010 it has required organizations to notify the Commissioner without unreasonable delay of any loss of, or unauthorized access to or disclosure of, personal information where a reasonable person would consider there is a real risk of significant harm. The Commissioner can require notification of affected individuals. The government consulted on modernizing PIPA in 2025 and 2026; no amending bill had passed as of November 2026.

• Health Information Act (HIA)

  Applies to: Health custodians such as physicians, pharmacists, dentists, optometrists and other designated health professionals, plus Alberta's public health system

  Requires notification of the Commissioner, the Minister of Health and affected individuals when a breach creates a risk of harm, along with privacy impact assessments and privacy management programs. Amendments under the Health Statutes Amendment Act, 2025 (No. 2) came into force on June 22, 2026, and added more professions as custodians, including regulated physiotherapists.

• Protection of Privacy Act (POPA)

  Applies to: Alberta public bodies (ministries, municipalities, school boards, post-secondary institutions) and their contractors

  In force June 11, 2025, replacing the privacy part of the FOIP Act. Requires public bodies to notify affected individuals, the Commissioner and the Minister of breaches with a real risk of significant harm, and to have a privacy management program by June 11, 2026. Vendors handling public-body data should expect these duties in their contracts.

• Personal Information Protection and Electronic Documents Act (PIPEDA)

  Applies to: Federally regulated businesses in Alberta and personal information that crosses provincial or national borders

  Mandatory reporting to the Office of the Privacy Commissioner of Canada and notification of individuals when a breach creates a real risk of significant harm, plus 24 months of breach records.

City pages:CalgaryEdmontonLethbridgeRed Deer

• Personal Information Protection and Electronic Documents Act (PIPEDA)

  Applies to: Private-sector organizations in Saskatchewan collecting, using or disclosing personal information in the course of commercial activity

  Saskatchewan has no substantially similar private-sector law, so PIPEDA applies. Breaches with a real risk of significant harm must be reported to the Office of the Privacy Commissioner of Canada and affected people notified as soon as feasible. Every breach must be recorded and records kept for 24 months.

• The Health Information Protection Act (HIPA)

  Applies to: Trustees of personal health information, including physicians, pharmacies, the provincial health authority and, since August 1, 2023, owners and operators of privately owned facilities where health professionals provide services

  Requires trustees to protect personal health information with administrative, technical and physical safeguards and limits collection, use and disclosure. Includes offences for snooping that can apply to individual employees. The Saskatchewan Information and Privacy Commissioner investigates breaches and strongly expects trustees to notify affected individuals.

• The Freedom of Information and Protection of Privacy Act (FOIP) and The Local Authority Freedom of Information and Protection of Privacy Act (LA FOIP)

  Applies to: Provincial government institutions, Crown corporations, municipalities, school divisions and other local authorities

  Public-sector privacy rules overseen by the Saskatchewan Information and Privacy Commissioner. Vendors supporting these bodies usually inherit security, breach reporting and data handling requirements through their contracts.

City pages:ReginaSaskatoon

• Personal Information Protection and Electronic Documents Act (PIPEDA)

  Applies to: Private-sector organizations in Manitoba engaged in commercial activity

  Manitoba has no private-sector privacy law in force, so PIPEDA applies. Breaches creating a real risk of significant harm must be reported to the Office of the Privacy Commissioner of Canada, affected individuals notified, and all breaches recorded for 24 months.

• The Personal Health Information Act (PHIA)

  Applies to: Trustees of personal health information, including health professionals in private practice, health care facilities, health services agencies and public bodies

  Requires reasonable administrative, technical and physical safeguards. Since January 1, 2022, trustees must notify affected individuals and the Manitoba Ombudsman when a privacy breach creates a real risk of significant harm.

• The Freedom of Information and Protection of Privacy Act (FIPPA)

  Applies to: Provincial government departments and agencies, municipalities, school divisions, universities and other public bodies

  Since January 1, 2022, public bodies must notify affected individuals and the Ombudsman of breaches with a real risk of significant harm. Information managers (contractors) processing personal information for public bodies are bound by the Act through their agreements.

City pages:Winnipeg

• Personal Information Protection and Electronic Documents Act (PIPEDA)

  Applies to: Private-sector organizations in Ontario engaged in commercial activity

  Ontario has no general private-sector privacy law, so PIPEDA applies. Breaches with a real risk of significant harm must be reported to the Office of the Privacy Commissioner of Canada and affected individuals notified as soon as feasible, with records of all breaches kept for 24 months.

• Personal Health Information Protection Act, 2004 (PHIPA)

  Applies to: Health information custodians, including physicians, dentists, pharmacists, clinics, labs, long-term care homes and hospitals, and their agents and electronic service providers

  Deemed substantially similar to PIPEDA for health custodians. Custodians must notify individuals at the first reasonable opportunity when personal health information is stolen, lost or used or disclosed without authority, notify the IPC in prescribed circumstances, and file annual breach statistics with the IPC.

• Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 (Bill 194)

  Applies to: Ontario public sector entities, including ministries, hospitals, school boards and children's aid societies, and institutions under FIPPA

  Schedule 1 enacted the Enhancing Digital Security and Trust Act, 2024 (in force January 29, 2025), letting the province set cybersecurity program and incident reporting requirements for public sector entities. Schedule 2 amended FIPPA so that from July 1, 2025 institutions must notify the IPC and affected individuals of breaches with a real risk of significant harm and complete privacy impact assessments. Vendors should expect these requirements in contracts.

• Employment Standards Act, 2000 (electronic monitoring policy)

  Applies to: Ontario employers with 25 or more employees

  Employers must have a written policy telling employees whether, how and why they are electronically monitored. Relevant when you deploy endpoint monitoring, email security or data loss prevention tools.

City pages:BramptonHamiltonKitchener-WaterlooLondonMarkhamMississaugaOttawaTorontoVaughanWindsor

• Act respecting the protection of personal information in the private sector, as amended by Law 25

  Applies to: Every private enterprise that collects, holds, uses or communicates personal information in Quebec, including non-profits carrying on an organized economic activity

  Deemed substantially similar to PIPEDA. Law 25 phased in from September 22, 2022 to September 22, 2024. It requires a person in charge of the protection of personal information (the CEO by default), notification of the CAI and affected people for confidentiality incidents that present a risk of serious injury, an incident register, governance policies, privacy impact assessments (including before transferring data outside Quebec), privacy by default and, since September 22, 2024, data portability. Administrative penalties reach CAD 10 million or 2% of worldwide turnover, and penal fines CAD 25 million or 4%.

• Act respecting health and social services information (formerly Bill 3)

  Applies to: Health and social services bodies, including private clinics, pharmacies, medical laboratories and private seniors' residences, and service providers processing health information on their behalf

  Mostly in force since July 1, 2024. Sets Quebec's first comprehensive health information regime, with logging of staff access to health information, governance rules, incident obligations and requirements for certain technology products and services.

• Act respecting Access to documents held by public bodies and the Protection of personal information

  Applies to: Quebec ministries, municipalities, school service centres and other public bodies, and their contractors

  The public-sector counterpart to the Private Sector Act, also strengthened by Law 25, including confidentiality incident reporting. Vendors to public bodies should expect contractual security and confidentiality requirements.

• Charter of the French Language, as amended by Bill 96

  Applies to: Businesses operating in Quebec

  Not a privacy law, but it shapes security programs: workplace communications, policies, training and contracts of adhesion must be available in French, and since June 1, 2025 businesses with 25 to 49 employees in Quebec have francization registration obligations with the OQLF.

City pages:GatineauLavalMontrealQuebec City

• Personal Information Protection and Electronic Documents Act (PIPEDA)

  Applies to: Private-sector organizations in New Brunswick engaged in commercial activity

  New Brunswick has no general private-sector privacy law, so PIPEDA applies. Breaches with a real risk of significant harm must be reported to the Office of the Privacy Commissioner of Canada, affected individuals notified, and all breaches recorded for 24 months.

• Personal Health Information Privacy and Access Act (PHIPAA)

  Applies to: Custodians of personal health information, including physicians, pharmacists, other health professionals, private clinics, regional health authorities and their information managers

  Deemed substantially similar to PIPEDA for health information custodians. Requires reasonable safeguards and requires custodians to notify affected individuals and the Ombud when personal health information is stolen, lost, improperly disposed of or accessed without authorization, subject to limited exceptions.

• Right to Information and Protection of Privacy Act (RTIPPA)

  Applies to: Provincial departments, Crown agencies, municipalities, school districts, universities and other public bodies

  Public-sector access and privacy law overseen by the Ombud since 2019. Contractors handling personal information for public bodies take on security and confidentiality duties through their agreements.

City pages:FrederictonMonctonSaint John

• Personal Information Protection and Electronic Documents Act (PIPEDA)

  Applies to: Private-sector organizations in Nova Scotia engaged in commercial activity

  Nova Scotia has no general private-sector privacy law, so PIPEDA applies. Breaches with a real risk of significant harm must be reported to the Office of the Privacy Commissioner of Canada and affected individuals notified, with records of all breaches kept for 24 months.

• Personal Health Information Act (PHIA)

  Applies to: Custodians of personal health information, including physicians, dentists, pharmacists, other regulated health professionals, Nova Scotia Health and private clinics

  Deemed substantially similar to PIPEDA for health information custodians. Custodians must notify affected individuals when personal health information is stolen, lost or accessed without authorization and there is potential for harm or embarrassment. If a custodian decides notification is not required, it must notify the Review Officer (the Information and Privacy Commissioner) as soon as possible.

• Personal Information International Disclosure Protection Act (PIIDPA)

  Applies to: Nova Scotia public bodies and municipalities, and service providers that collect, use or disclose personal information on their behalf

  Requires personal information in the custody of public bodies, including when held by their service providers, to be stored and accessed only in Canada unless a listed exception applies, such as a documented determination by the head of the public body reported to the Minister of Justice. Directly relevant to cloud and IT vendors.

• Freedom of Information and Protection of Privacy Act (FOIPOP)

  Applies to: Provincial public bodies, with Part XX of the Municipal Government Act covering municipalities

  Public-sector access and privacy rules overseen by the Information and Privacy Commissioner for Nova Scotia.

City pages:Halifax

• Personal Information Protection and Electronic Documents Act (PIPEDA)

  Applies to: Private-sector organizations on Prince Edward Island engaged in commercial activity

  PEI has no general private-sector privacy law, so PIPEDA applies. Breaches with a real risk of significant harm must be reported to the Office of the Privacy Commissioner of Canada and affected individuals notified, with all breaches recorded for 24 months.

• Health Information Act

  Applies to: Custodians of personal health information, including physicians, dentists, pharmacists, other health professionals, private clinics and Health PEI

  Custodians must notify the affected individual and the Information and Privacy Commissioner in writing at the first reasonable opportunity when personal health information is stolen, lost, improperly disposed of, or disclosed to or accessed by an unauthorized person, unless the custodian reasonably believes there will be no adverse impact. The Commissioner treats that exception narrowly.

• Freedom of Information and Protection of Privacy Act (FOIPP)

  Applies to: Provincial government departments, agencies, Crown corporations, municipalities and other public bodies

  Public-sector access and privacy law overseen by the PEI Information and Privacy Commissioner. Vendors handling personal information for public bodies inherit confidentiality and security obligations through their contracts.

City pages:Charlottetown

• Personal Information Protection and Electronic Documents Act (PIPEDA)

  Applies to: Private-sector organizations in Newfoundland and Labrador engaged in commercial activity

  The province has no general private-sector privacy law, so PIPEDA applies. Breaches with a real risk of significant harm must be reported to the Office of the Privacy Commissioner of Canada and affected individuals notified, with all breaches recorded for 24 months.

• Personal Health Information Act (PHIA)

  Applies to: Custodians of personal health information, including physicians, dentists, pharmacists, other health professionals, private clinics and the provincial health authority

  Deemed substantially similar to PIPEDA for health information custodians. Custodians must notify affected individuals when personal health information is stolen, lost, disposed of or accessed without authority, and must inform the Information and Privacy Commissioner of material breaches, assessed against factors in the PHIA regulations such as sensitivity and the number of people affected.

• Access to Information and Protection of Privacy Act, 2015 (ATIPPA, 2015)

  Applies to: Provincial departments, agencies, Crown corporations, municipalities, school boards and other public bodies

  Public-sector access and privacy law overseen by the Office of the Information and Privacy Commissioner. Public bodies must report privacy breaches to the Commissioner, and contractors handling their data inherit confidentiality and security duties.

City pages:St. John's

• Personal Information Protection and Electronic Documents Act (PIPEDA)

  Applies to: Private-sector organizations in Yukon engaged in commercial activity; PIPEDA also applies to federal works, undertakings and businesses in the territories

  Yukon has no private-sector privacy law, so PIPEDA applies. Breaches with a real risk of significant harm must be reported to the Office of the Privacy Commissioner of Canada and affected individuals notified, with all breaches recorded for 24 months.

• Health Information Privacy and Management Act (HIPMA)

  Applies to: Custodians of personal health information, including private health care providers such as physicians, dentists, pharmacists and clinics, as well as the Yukon government's health department and hospitals

  Requires custodians to protect personal health information and to notify affected individuals and the Information and Privacy Commissioner after a security breach that creates a risk of significant harm. Applies to small private practices as well as public bodies.

• Access to Information and Protection of Privacy Act (ATIPP Act)

  Applies to: Yukon government departments, Crown corporations, municipalities and other public bodies

  Rewritten in 2018 and brought into force with its regulation in 2021. Public bodies must assess privacy breaches for risk of significant harm, notify affected individuals and the Information and Privacy Commissioner where that risk exists, and keep a record of every breach. Contractors working for public bodies inherit these expectations.

City pages:Whitehorse

• Personal Information Protection and Electronic Documents Act (PIPEDA)

  Applies to: Private-sector organizations in the Northwest Territories engaged in commercial activity

  The NWT has no private-sector privacy law, so PIPEDA applies. Breaches with a real risk of significant harm must be reported to the Office of the Privacy Commissioner of Canada and affected individuals notified, with records of all breaches kept for 24 months.

• Health Information Act (HIA)

  Applies to: Health information custodians, chiefly the Department of Health and Social Services and the territory's health and social services authorities, plus other custodians designated under the Act

  Sets rules for collecting, using, disclosing and protecting personal health information, including breach notification duties. The Information and Privacy Commissioner has repeatedly criticized delays in breach notification, and its 2024 to 2025 annual report records 173 breach notifications under the HIA.

• Access to Information and Protection of Privacy Act (ATIPP Act)

  Applies to: Territorial government departments, agencies, municipalities designated under the Act and other public bodies

  Public-sector access and privacy law overseen by the Information and Privacy Commissioner of the Northwest Territories. Contractors handling personal information for public bodies inherit confidentiality, security and breach reporting obligations through their agreements.

City pages:Yellowknife

• Personal Information Protection and Electronic Documents Act (PIPEDA)

  Applies to: Private-sector organizations in Nunavut engaged in commercial activity

  Nunavut has no private-sector privacy law, so PIPEDA applies. Breaches with a real risk of significant harm must be reported to the Office of the Privacy Commissioner of Canada and affected individuals notified, with records of all breaches kept for 24 months.

• Access to Information and Protection of Privacy Act (ATIPPA)

  Applies to: Government of Nunavut departments, including the Department of Health, territorial corporations, designated municipalities and other public bodies

  Public-sector access and privacy law overseen by the Information and Privacy Commissioner of Nunavut. Because Nunavut has no separate health information law, health providers working within public bodies are bound by this Act. Contractors handling personal information for public bodies take on matching obligations through their agreements.

• Proposed health information legislation

  Applies to: Health care providers and custodians (not yet in force)

  The Information and Privacy Commissioner has identified Nunavut and British Columbia as the only Canadian jurisdictions without a health-sector privacy law, and the Government of Nunavut consulted the public on new health privacy legislation in 2025. No bill was in force as of November 2026.

City pages:Iqaluit