Rules
PIPEDA and Quebec Privacy Law: What Canadian Users Must Know
PIPEDA Quebec privacy law splits Canadian users into two privacy regimes. Learn federal and Quebec disclosure duties, records, and penalties.
What to take away
- PIPEDA applies in most provinces, but Quebec's Law 25 creates stronger individual rights and higher penalties.
- Users in Quebec can ask for de-indexing and have a private right of action for damages.
- Organizations must disclose specific details before or at collection, keep records, and report certain breaches.
- Non-compliance can lead to OPC findings, Federal Court orders, or CAI administrative penalties up to $10,000,000 or 2% of worldwide turnover.
Who has jurisdiction
PIPEDA applies to private-sector organizations across Canada except in provinces with substantially similar legislation. The Office of the Privacy Commissioner of Canada (OPC) oversees PIPEDA. Its PIPEDA page explains which organizations fall under the federal act. In Quebec, the private-sector privacy law is the Act respecting the protection of personal information in the private sector, amended by Bill 64, often called Law 25. The Commission d'accès à l'information du Québec (CAI) enforces that law. If a business operates in Quebec, Law 25 applies even if PIPEDA also covers it elsewhere.
What a compliant disclosure contains
A compliant privacy notice must identify the organization, state the purposes for collection, list any third parties that will receive the information, and explain how to contact the privacy officer. Under PIPEDA, this follows the openness and consent principles. Under Quebec Law 25, the notice must also include the user's rights of access, rectification, withdrawal of consent, and the right to file a complaint with the CAI. To check a notice, look for these three items:
- The organization's name and contact details, including its privacy officer.
- The specific purposes for which personal information is collected, not a vague phrase like 'marketing.'
- A clear description of the right to withdraw consent and how to exercise it. When you share less personal information online, the choices in Private vs Public Social Profiles reduce what a company can later disclose.
Records to keep
You do not need to keep binders, but you should save confirmation emails, consent forms, and any privacy notice you saw at sign-up. Organizations must keep records of consent and disclosures for as long as required. Under Quebec Law 25, an organization must be able to demonstrate compliance, including records of privacy impact assessments for certain projects. If you ask for your personal information, the organization must provide it in a structured, commonly used format. The steps in Delete Your Digital Footprint help you request removal from data brokers, though Quebec's de-indexing right gives an extra tool.
What happens if you do not comply
For users, the main consequence of an organization's non-compliance is a regulatory complaint. You can file a complaint with the OPC under PIPEDA. The Commissioner can issue a report, recommend changes, and, if unresolved, take the matter to Federal Court. Under Quebec Law 25, the CAI can impose administrative monetary penalties of up to $10,000,000 or 2% of worldwide turnover for the preceding fiscal year. That is a concrete consequence for a company that ignores access requests or fails to report a breach. A user can also sue for damages for unlawful collection or use.
A privacy notice that hides purposes behind vague language is not a compliant disclosure.
Where the rules differ by place
Quebec treats privacy as a fundamental right under its Charter of human rights and freedoms. This shows up in stronger user rights and higher penalties. The federal OPC also maintains an overview of Canadian privacy laws that places Quebec's distinct regime beside PIPEDA. The table below compares key points.
| Aspect | PIPEDA | Quebec Law 25 |
|---|---|---|
| Regulator | Office of the Privacy Commissioner of Canada | Commission d'accès à l'information du Québec |
| Consent | Implied or express depending on sensitivity and reasonable purposes | Express opt-in for sensitive information, specific consent |
| Access and correction | Yes | Yes, plus de-indexing and data portability |
| Penalties | OPC findings, Federal Court damages, no administrative monetary penalties | CAI administrative monetary penalties up to $10,000,000 or 2% of worldwide turnover |
These differences mean a Quebec resident can force a company to stop using their information in ways that a resident of Ontario cannot. The higher penalty also pushes organizations to build privacy into product design. For users, the practical result is a stronger hand in disputes with Quebec-based platforms. The CAI has also published guidance on de-indexing requests.
Example
For a US counterpart to Quebec's elevated rights, see California privacy rules. A Quebec resident signs up for a loyalty app. The app collects name, email, purchase history, and location. Under Law 25, the app must state each purpose, list any third parties, and allow the user to withdraw consent at any time. If the user asks the app to stop selling their purchase history to a data broker, the app must comply and keep proof. If the app refuses, the user can complain to the CAI, which can impose an administrative monetary penalty. The same request in Ontario would not trigger a de-indexing right, because PIPEDA has no identical provision.
Common questions
Does PIPEDA apply to me if I live in Quebec? PIPEDA may still apply to interprovincial or international transfers, but for private-sector activity inside Quebec, Law 25 is the primary rule. You get stronger rights under Law 25.
What is the difference between PIPEDA and Quebec Law 25? PIPEDA is a federal privacy law based on the ten fair information principles. Quebec Law 25 is a provincial law that adds explicit consent, de-indexing, data portability, and much higher financial penalties. For cross-border activity, the Cross-border creator work guide covers tax and contract basics that sit beside these privacy rules.
Can I ask a company to delete my personal information? Under PIPEDA, you can ask for correction, not always deletion. Under Quebec Law 25, you have a right to de-index personal information and, in some cases, to have it deleted.
Who enforces these laws? The OPC enforces PIPEDA. The CAI enforces Quebec's private-sector privacy law and can issue administrative monetary penalties.
