How to figure out whether PIPEDA, a provincial private-sector law, a public-sector law, or a health privacy law applies to your issue.
This page provides legal information, not legal advice. Consult a qualified privacy lawyer or CIPP/C-accredited privacy professional before taking action on access requests, breach response, complaints to a Privacy Commissioner, or Federal Court applications.
Last verified: September 2026
TL;DR
The right law depends on who holds the information (private sector, public sector, health custodian), where the organization operates, and whether the activity is interprovincial or international. PIPEDA fills the gaps but can be displaced by 'substantially similar' provincial laws in BC, Alberta, and Quebec.
Three buckets of law
Canadian privacy law has three main buckets:
Private-sector: PIPEDA federally, BC PIPA, Alberta PIPA, Quebec Law 25 provincially.
Public-sector: Privacy Act federally, FIPPA/ATIPP-type statutes provincially (Alberta's is now the Access to Information Act and Protection of Privacy Act).
Health: dedicated statutes like PHIPA, HIA, HIPA, PHIA.
How PIPEDA interacts with provincial laws
Where a province has 'substantially similar' private-sector legislation, PIPEDA generally does not apply to intraprovincial activities.
PIPEDA still applies to interprovincial and international flows of personal information, and to federally regulated businesses in all provinces.
When multiple laws apply
An incident can involve multiple regimes. For example, a health care organization in BC that sends data to an Ontario service provider triggers BC PIPA, Ontario PHIPA, and potentially PIPEDA for the cross-border flow.