Start here
Ask yourself:
- Is the organization a federal government body? -> Office of the Privacy Commissioner of Canada (OPC) under the Privacy Act.
- Is it a federally regulated business (bank, airline, telecom)? -> OPC under PIPEDA.
- Is it a provincial or municipal government body? -> Provincial access-and-privacy commissioner under FIPPA, ATIPP, or (in Alberta) the Access to Information Act and Protection of Privacy Act.
- Is it a health care custodian? -> Provincial health-privacy commissioner (often the same office) under PHIPA/HIA/HIPA/PHIA.
- Is it a private-sector business in BC, Alberta, or Quebec? -> Provincial commissioner under PIPA or Law 25.
- Is it a private-sector business in any other province? -> OPC under PIPEDA.
Common scenarios
Quick answers:
- Your bank: OPC (PIPEDA).
- Your hospital in Ontario: IPC Ontario (PHIPA).
- A federal department: OPC (Privacy Act).
- A Quebec retailer: CAI (Law 25).
- Your provincial ministry (Alberta): OIPC Alberta (Access to Information Act and Protection of Privacy Act, which replaced FOIP in June 2025).
- A social media platform: OPC (PIPEDA).
- A BC employer: OIPC BC (BC PIPA).
Multiple commissioners may apply
An incident can engage multiple regimes. Commissioners sometimes conduct joint investigations. There is no single filing that covers every commissioner; where different aspects fall under different laws, a complaint goes to each, and the commissioners may choose to investigate jointly (as in the Clearview AI and Cadillac Fairview cases).