Privacy Law for Law Firms in Canada
By Yong Du
PIPEDA and provincial PIPA obligations for Canadian law firms — client file privacy, solicitor-client privilege in access requests, breach reporting, and compliance requirements for practices of any size.
What makes law firms distinct
Law firms hold some of the most sensitive personal information in existence — client files that may contain legal strategies, evidence of wrongdoing, immigration status, family law proceedings, criminal history, financial disputes, and confidences shared in circumstances of legal duress. The solicitor-client relationship creates both the expectation of absolute confidentiality and the legal protection of privilege.
This creates a unique compliance environment: a law firm's privacy obligations under PIPEDA run alongside its duty of confidentiality under law society rules and the legal doctrine of solicitor-client privilege. All three operate simultaneously and must be managed together.
Which laws apply
| Jurisdiction | Applies when | Regulator |
|---|---|---|
| PIPEDA | The firm engages in commercial activity involving personal information; or clients or affected individuals are in provinces without substantially similar legislation | OPC — priv.gc.ca |
| Alberta PIPA | Clients, opposing parties whose information the firm holds, or employees are Alberta residents | OIPC Alberta — oipc.ab.ca / breachnotice@oipc.ab.ca |
| BC PIPA | Clients or employees are BC residents | OIPC BC — oipc.bc.ca |
Law society overlay: Both the Law Society of Alberta and the Law Society of BC have rules governing client confidentiality and may have reporting or notification obligations following a breach that affect client files. These are separate from PIPEDA and must be addressed independently. Contact your law society for guidance on your professional obligations following a breach.
What personal information law firms hold
Client files: Names, addresses, contact information, identity documents, SINs (particularly in real estate, estate, and corporate matters), legal matter details, correspondence, evidence and supporting documents, financial information related to the matter, opposing party information.
Real estate transaction files: Buyer and seller SINs, purchase price and financing details, mortgage information, trust account deposits and disbursements, title documents, identity verification documents (government-issued ID for FINTRAC compliance).
Family law and estate files: Family composition, asset inventories, income disclosure (T4s, NOAs, financial statements), health information (in custody matters), children's information.
Corporate and commercial files: Shareholder and officer information, corporate banking details, financial statements, shareholder agreements.
Trust accounting records: Client name, matter description, transaction amounts, banking details for disbursements.
Employee information: SINs, banking details for payroll, T4s, performance records.
Common breach scenarios
Ransomware: Law firms are high-value ransomware targets because client files contain privileged communications and sensitive personal information that clients may pay to prevent disclosure. A ransomware group that exfiltrates client files before encrypting them has significant leverage. Every client file in the affected system is a potential breach. See Ransomware Attack: What Canadian SMEs Must Do.
Business email compromise — real estate wire fraud: Law firms handling real estate transactions are a primary BEC target. Attackers compromise a lawyer's or conveyancer's email account and redirect closing funds or deposit instructions to a fraudulent account. The BEC incident is both a financial fraud event and a breach of client personal information. See Phishing and Business Email Compromise.
Cloud document platform breach: If the firm uses a cloud document management system or legal practice management platform and that vendor is breached, client files held there are potentially compromised. The firm's accountability does not transfer to the vendor. See Vendor or Third-Party Breach.
Unauthorized staff access: A staff member accessing client files for matters they are not assigned to — or a departing staff member accessing files before their last day. See Unauthorized Employee Access.
RROSH in a law firm breach
The sensitivity of client file contents — particularly files involving financial transactions, family law proceedings, immigration matters, or criminal defence — means RROSH is frequently present when client files are breached. Real estate files are particularly high-risk given the combination of SINs, banking details, and identity documents they contain.
Opposing party information: Law firm files often contain personal information about individuals who are not clients — opposing parties, witnesses, third parties referenced in correspondence. Those individuals also have privacy rights and may be affected parties for notification purposes if their personal information was in a compromised file.
Privilege and RROSH are separate questions: Privilege governs what you disclose to clients in an access request. RROSH governs whether you must notify regulators and affected individuals of a breach. A file may be privileged and still require RROSH notification if it was breached — privilege does not shield the notification obligation.
Core compliance obligations
Privacy officer: Designate a named individual — typically the managing partner or administrator — responsible for PIPEDA compliance. Their contact must appear in the firm's privacy policy.
Privacy policy: Your policy must describe what client information you collect and why, how it is used and protected, retention practices, and how clients can access their file or make a complaint. Available to clients on request and on the firm's website if one exists.
Retention: Client files must be retained long enough to satisfy the applicable limitation period for malpractice claims and any regulatory requirements. The Law Society of Alberta and Law Society of BC each have records retention guidelines — those govern minimum retention periods for client files and take precedence over the general PIPEDA retention principle. After the minimum retention period, files should be destroyed securely. See Personal Information Retention and Destruction.
FINTRAC compliance for real estate: Law firms handling real estate transactions are reporting entities under FINTRAC regulations. FINTRAC requires collection and verification of client identity, which creates personal information collection obligations governed by PIPEDA in addition to FINTRAC compliance requirements. The FINTRAC records themselves (identity documents, verification records) are personal information subject to PIPEDA's access and breach obligations.
Safeguards: Encrypted storage for all client files, MFA on all systems holding client data, role-based access limiting staff to their assigned matters, audit logging, and secure destruction of paper files and retired hardware.
Experienced a breach at your firm? ClearBreach walks law firms through their RROSH assessment across PIPEDA, Alberta PIPA, and BC PIPA simultaneously and generates regulator reports and client notification letters in under 15 minutes. Start your assessment →
Related guides
- PIPEDA Breach Reporting Requirements
- Alberta PIPA Breach Notification
- BC PIPA Breach Reporting
- Ransomware Attack: What Canadian SMEs Must Do
- Phishing and Business Email Compromise
- Responding to Individual Access Requests Under Canadian Privacy Law
- Personal Information Retention and Destruction Under Canadian Privacy Law
This guide covers PIPEDA, Alberta PIPA, and BC PIPA obligations for private law firms. Law society professional conduct obligations and duty of confidentiality rules are separate and not covered here. FINTRAC anti-money-laundering obligations are noted but not fully covered here — consult FINTRAC guidance for your specific reporting entity obligations. Quebec's Law 25 is not covered here.
Frequently asked questions
Does PIPEDA apply to law firms?
Yes. Law firms collect, use, and disclose personal information in the course of commercial activity. PIPEDA applies. Alberta PIPA and BC PIPA apply for clients and employees who are Alberta or BC residents. The fact that a law firm also has professional obligations under law society rules does not exempt it from privacy legislation — both sets of obligations apply simultaneously.
Can we refuse an access request on the basis of solicitor-client privilege?
Yes. Solicitor-client privilege is an explicit ground for refusing or limiting an individual's access request under PIPEDA. If a client requests access to their file and the file contains communications that are subject to privilege — legal advice, strategy documents, confidential communications between solicitor and client — the privileged portions may be withheld. However, privilege does not apply to all information in a client file. Factual information, identity documents, and basic transaction details may not be privileged even if they appear in a legal file. Each claim of privilege must be assessed on the specific content, not applied wholesale to the file.
A client file containing real estate transaction details was stolen in a ransomware attack — what are our obligations?
You must conduct a RROSH assessment immediately. A real estate transaction file typically contains: buyer and seller names, SINs (for title transfer), banking and mortgage details, purchase price, trust account details, legal descriptions, and identity documents. This combination almost certainly meets the RROSH threshold. You must notify the OPC and any applicable provincial regulator, and notify affected clients directly. Law society notification obligations may also apply — check with your provincial law society.
Does our trust accounting information count as personal information under PIPEDA?
Trust accounting records contain personal information about clients — client names, transaction amounts, banking details, and matter descriptions. To the extent those records contain personal information about identifiable individuals, they are subject to PIPEDA's requirements including the right of individual access (subject to privilege) and the breach notification obligation if they are compromised.
This guide is educational and does not constitute legal advice. It is grounded in the text of PIPEDA, Alberta PIPA, and BC PIPA and published guidance from the OPC, OIPC Alberta, and OIPC BC. If your situation involves regulatory investigation, litigation risk, or circumstances not addressed here, engage a qualified privacy lawyer.