Canadian Privacy Law Explained: Which Law Protects You
Canada has no single privacy law. Which one covers you depends on who is holding your information. Below: the federal and provincial split in plain language, a table matching your situation to the statute and the regulator, and every privacy law in force with what it says and what it means for you.
Last verified: 2026-09-02
Federal or provincial: how Canadian privacy law is split
Canada divides privacy law two ways at once: between the federal government and the provinces, and between the public sector and the private sector. The federal Privacy Act covers government institutions such as the CRA, IRCC and the RCMP. The federal PIPEDA covers businesses that collect personal information in the course of commercial activity. Those two laws are the starting point everywhere in the country.
A province can displace PIPEDA for its own businesses by passing a law the federal government deems substantially similar. Three have done it: Quebec, Alberta and British Columbia. In those provinces, an ordinary business answers to the provincial statute and the provincial regulator instead. Four more provinces, Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador, have health privacy laws deemed substantially similar, so health custodians there follow the provincial health statute.
PIPEDA never fully steps aside. It continues to apply to federally regulated businesses, banks, airlines, railways, telecoms and broadcasters, including information about their employees, and to personal information that crosses a provincial or national border. Provincial and municipal government bodies, meanwhile, are outside PIPEDA entirely: each province and territory has its own public-sector access and privacy law, enforced by its own commissioner or ombud. Underneath all of it, sections 7 and 8 of the Charter limit what the state itself may search, seize and disclose.
Which privacy law covers me?
| Who holds your information | The law that governs it | Regulator |
|---|---|---|
| A private business in Ontario, Manitoba, Saskatchewan, New Brunswick, Nova Scotia, Prince Edward Island, Newfoundland and Labrador, or the territories | PIPEDA, the federal private-sector law | Office of the Privacy Commissioner of Canada |
| A private business in Quebec | Act respecting the protection of personal information in the private sector, as amended by Law 25 | Commission d'accès à l'information du Québec |
| A private business in Alberta | Personal Information Protection Act (Alberta) | Office of the Information and Privacy Commissioner of Alberta |
| A private business in British Columbia | Personal Information Protection Act (British Columbia) | Office of the Information and Privacy Commissioner for British Columbia |
| A federally regulated employer or business: a bank, airline, railway, interprovincial trucking firm, telecom or broadcaster | PIPEDA, which covers customer information and, for these employers only, employee information | Office of the Privacy Commissioner of Canada |
| A federal government body: the CRA, IRCC, Service Canada, the RCMP, CSIS | Privacy Act | Office of the Privacy Commissioner of Canada |
| A provincial or municipal government body: a ministry, university, hospital, city, police service or school board | The province's public-sector access and privacy law: FIPPA and MFIPPA in Ontario, FOIPPA in British Columbia, the Protection of Privacy Act in Alberta, the Access Act in Quebec, and the equivalent statute elsewhere | The provincial information and privacy commissioner, or the ombud in Manitoba and New Brunswick |
| A health-care provider: a hospital, doctor, pharmacy, clinic or long-term care home | The province's health privacy law: PHIPA in Ontario, HIA in Alberta, HIPA in Saskatchewan, PHIA in Manitoba, Nova Scotia and Newfoundland and Labrador, PHIPAA in New Brunswick. The Privacy Commissioner has deemed the Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador health laws substantially similar to PIPEDA. | The provincial information and privacy commissioner or ombud |
Bill C-36: proposed, not law
Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts, received first reading in the House of Commons on June 15, 2026 and is at second reading. It is a proposal. Nothing in it applies yet, and PIPEDA continues to govern private-sector privacy in Canada until the bill is passed and brought into force.
- A private right of action: clause 132 of the bill as introduced would allow an individual to claim damages from an organization for a contravention of the Act.
- Breach reporting carried forward: clause 58 would keep the duty to report a breach to the regulator as soon as feasible where there is a real risk of significant harm, and clause 59 the duty to notify other organizations that could reduce the harm.
- A record of every breach would still be required (clause 60), with the details left to regulations.
- The bill would replace Part 1 of PIPEDA and move private-sector enforcement to a new commission rather than the tribunal proposed in the previous Parliament's Bill C-27.
Status checked September 5, 2026. Stage: Second reading, House of Commons. What Bill C-36 would change for you · Track Bill C-36 on LEGISinfo (parl.ca)
Showing 14 of 14 laws
Federal Privacy
Charter Rights
Provincial Privacy
Health Privacy
Sector-Specific
Frequently asked questions about Canadian privacy law
- What are my privacy rights in Canada?
- Canadian privacy law gives an individual a consistent core set of rights, whichever statute applies: to know why personal information is being collected and to consent or refuse, to see the personal information an organization or government body holds about you, to have it corrected when it is wrong, to have it protected by reasonable security safeguards, to be told about a breach that creates a real risk of significant harm in most jurisdictions, and to complain to a privacy commissioner at no cost. Quebec adds portability and de-indexing rights. What changes between statutes is the deadline for a response, the regulator who takes the complaint, and whether that regulator can issue a binding order or only a recommendation.
- What is the main privacy law in Canada?
- There is no single one. PIPEDA is the federal private-sector law and the closest thing to a default: it applies to commercial activity across Canada except where a province has a law the federal government has deemed substantially similar, and it always applies to federally regulated businesses and to information crossing a provincial or national border. The Privacy Act is the separate federal law for government institutions. Alberta, British Columbia and Quebec have their own private-sector statutes, every province and territory has a public-sector access and privacy law, and most have a dedicated health privacy law on top.
- Which privacy law applies to me, the federal one or my province's?
- It depends on who is holding the information rather than where you live. A federal government institution is always the Privacy Act. A bank, airline, railway or telecom is always PIPEDA, including for its employees. A hospital or clinic is the provincial health privacy law. A provincial ministry, municipality, police service or school board is the provincial public-sector law. An ordinary business is PIPEDA, unless it operates in Quebec, Alberta or British Columbia, where the provincial private-sector law applies instead. The table above sets out each case and the regulator that goes with it.
- Is there a right to privacy in the Canadian Constitution?
- Not by that name. The Canadian Charter of Rights and Freedoms contains no section headed privacy. Section 8 guarantees the right to be secure against unreasonable search or seizure, and the Supreme Court of Canada has read it as protecting a reasonable expectation of privacy in your body, home, vehicle, devices, online activity and information held by third parties. Section 7 has been read as protecting informational privacy where disclosure would cause serious harm to dignity or autonomy. Both sections bind the state, not private companies. Privacy against a business comes from PIPEDA and the provincial statutes, and in Quebec also from the Civil Code and the Quebec Charter.
- What privacy legislation is changing in Canada in 2026?
- Bill C-36, the Protecting Privacy and Consumer Data Act, received first reading in the House of Commons on June 15, 2026 and is at second reading. It would replace Part 1 of PIPEDA, add deletion and data-mobility rights and explanations for automated decisions, raise the penalty ceilings, and create a private right of action at clause 132. It is not law and nothing in it applies yet. In the provinces, Ontario's FIPPA breach reporting and privacy impact assessment duties started on July 1, 2025 and the equivalent MFIPPA duties for municipal institutions start on January 1, 2027, and Alberta's Protection of Privacy Act replaced the privacy half of the FOIP Act on June 11, 2025.
Have a Legal Question?
These laws form the foundation of your privacy rights in Canada. For specific questions about how they apply to your situation, consulting a qualified privacy lawyer or accredited privacy professional is advisable.