Which Canadian Privacy Law Applies to Your Business?
By Yong Du
PIPEDA is the Canadian baseline — Alberta and BC have substantially similar provincial laws that displace it for intraprovincial activity.
Which Canadian privacy law applies to your business?
The answer depends on where your organization is registered and whether your commercial activity crosses provincial borders. PIPEDA is the federal baseline — it applies to all private-sector commercial activity in Canada unless a substantially similar provincial law has been granted jurisdiction. Two provinces have that designation: Alberta and British Columbia.
How the federal and provincial laws interact
PIPEDA s.26(2)(b) allows the Governor in Council to exempt organizations from PIPEDA when they are subject to a substantially similar provincial law. Alberta PIPA and BC PIPA have been granted that designation. PIPEDA steps back for purely intraprovincial commercial activity in those provinces.
The step-back is not complete. PIPEDA re-engages the moment activity crosses a provincial or national border. The practical result:
- Alberta and BC organizations with activity confined to their own province are governed by provincial PIPA alone.
- Alberta and BC organizations with cross-border or interprovincial activity are governed by both — provincial PIPA for intraprovincial activity, PIPEDA for cross-border.
- Organizations in all other provinces — Ontario, Manitoba, Saskatchewan, and others — are governed by PIPEDA for all commercial activity. No substantially similar provincial law exists in those provinces.
- Quebec organizations are subject to Law 25, Quebec's own privacy regime. This is outside ClearBreach scope.
The intraprovincial vs cross-border test
The determining question for each transaction: does it cross a provincial border?
Intraprovincial — governed by provincial PIPA alone (Alberta or BC organizations only):
- A law firm in Edmonton serving only Alberta clients
- A dental practice in Victoria with BC patients only
- A Calgary property manager handling Alberta properties for Alberta landlords
Cross-border — PIPEDA applies (and provincial PIPA for the intraprovincial component, for AB/BC organizations):
- A SaaS company in Calgary with subscribers in Ontario or Manitoba
- A Vancouver consulting firm with federal government contracts
- A manufacturer in Edmonton supplying distributors in multiple provinces
The location of your organization's registration does not determine which law applies to a specific transaction. The nature of the transaction does.
Which law applies — by province
| Province | Substantially similar provincial law? | Applicable legislation |
|---|---|---|
| Alberta | Yes — Alberta PIPA | AB PIPA (intraprovincial) / PIPEDA (cross-border) |
| British Columbia | Yes — BC PIPA | BC PIPA (intraprovincial) / PIPEDA (cross-border) |
| Ontario | No | PIPEDA |
| Manitoba | No | PIPEDA |
| Saskatchewan | No | PIPEDA |
| New Brunswick | No | PIPEDA |
| Nova Scotia | No | PIPEDA |
| PEI | No | PIPEDA |
| Newfoundland | No | PIPEDA |
| Yukon / NWT / Nunavut | No | PIPEDA |
| Quebec | Separate regime — Law 25 | Law 25 / PIPEDA (outside ClearBreach scope) |
Federally regulated sectors — banking, telecommunications, transportation, and broadcasting — are subject to PIPEDA regardless of province.
What the distinction means for breach response
For Alberta and BC organizations with cross-border activity, a breach may trigger reporting obligations to two separate regulators. PIPEDA breaches with RROSH must be reported to the OPC. Alberta PIPA breaches with RROSH must be reported to the OIPC Alberta. BC PIPA breach reporting to the OIPC BC is voluntary — but PIPEDA reporting obligations for the cross-border component remain mandatory.
For Ontario and other PIPEDA-only provinces, there is one regulator: the OPC.
The OPC's 2025–2026 business survey found 28% of Canadian businesses have no designated privacy officer, 23% have no complaint handling procedure, and 45% lack encryption. For Alberta and BC organizations subject to both statutes, these gaps create concurrent exposure under two legislative frameworks simultaneously.
Assess your compliance posture
ClearBreach assesses breach obligations under PIPEDA, Alberta PIPA, and BC PIPA simultaneously — identifying which frameworks apply and producing the correct regulatory reports for each.
Related guides
- Which Privacy Law Applies to My Alberta Business? — the dual-statute situation for Alberta organizations
- Which Privacy Law Applies to My BC Business? — the dual-statute situation for BC organizations
- Which Privacy Law Applies to My Ontario Business? — PIPEDA-only provinces
- PIPEDA Compliance Requirements — federal obligations for all Canadian organizations
- Alberta PIPA Compliance Requirements — obligations for Alberta organizations
- BC PIPA Compliance Requirements — obligations for BC organizations
This guide covers the jurisdiction framework under PIPEDA, Alberta PIPA, and BC PIPA. Quebec's Act respecting the protection of personal information in the private sector (Law 25 / Bill 64) is a separate regime outside ClearBreach scope — Quebec-registered organizations should consult the Commission d'accès à l'information.
Federally regulated organizations — banks, telecommunications carriers, broadcasters, and interprovincial transportation companies — are subject to PIPEDA regardless of province.
If your organization handles personal health information under provincial health legislation — Alberta's Health Information Act, Ontario's PHIPA, or BC health statutes — additional obligations may apply that are not covered here.
Frequently asked questions
Does PIPEDA apply to all Canadian businesses?
PIPEDA applies to all private-sector organizations engaged in commercial activity in Canada — with one exception. Alberta and BC have provincial privacy legislation deemed substantially similar to PIPEDA. For purely intraprovincial activity in those provinces, the provincial law applies instead of PIPEDA. For cross-border or interprovincial activity, PIPEDA applies regardless of province.
Can both PIPEDA and a provincial privacy law apply to the same organization at the same time?
Yes. An Alberta corporation that sells to clients in other provinces is subject to Alberta PIPA for its intraprovincial Alberta activity and to PIPEDA for its cross-border activity. Both statutes govern the same organization simultaneously — they apply to different activities.
Does selling to clients in another province change which law applies?
Yes. If your organization is in Alberta or BC and you sell to clients in other provinces, the cross-border activity is governed by PIPEDA — not your provincial PIPA. Your intraprovincial activity remains under provincial PIPA. If you are in Ontario selling to Alberta clients, PIPEDA governs your activity — you are not subject to Alberta PIPA.
What about Quebec?
Quebec has its own privacy legislation — the Act respecting the protection of personal information in the private sector (Law 25). Quebec has not been granted substantially similar status under PIPEDA, so both may apply. Law 25 is outside ClearBreach scope — Quebec-registered organizations should consult the Commission d'accès à l'information.
This guide is educational and does not constitute legal advice. It is grounded in the text of PIPEDA, Alberta PIPA, and BC PIPA and published guidance from the OPC, OIPC Alberta, and OIPC BC. If your situation involves regulatory investigation, litigation risk, or circumstances not addressed here, engage a qualified privacy lawyer.