Canada: compliance overview
3 regulations, 10 mapped obligations and 0 data-transfer routes, organised by when they start to bind you and what you have to do.
Regulatory timeline: what comes next
2025-01-06
The 44th Parliament’s 1st session ends; the bill dies and AIDA never comes into force
Canada’s Artificial Intelligence and Data Act (AIDA, in Bill C-27) — died with the session and never came into force2025-05-26
The 45th Parliament’s 1st session begins; as at the retrieval date the session contains no bill regulating artificial intelligence
Canada’s Artificial Intelligence and Data Act (AIDA, in Bill C-27) — died with the session and never came into force2026-06-15not final
Bill C-36 introduced in the new Parliament: would enact the Protecting Privacy and Consumer Data Act and amend PIPEDA (not passed)
Personal Information Protection and Electronic Documents Act (PIPEDA)2026-09-12
Verified: PIPEDA remains the federal private-sector privacy statute; the Consumer Privacy Protection Act intended to replace it was never enacted
Personal Information Protection and Electronic Documents Act (PIPEDA)
Applicable regulations (3)
Personal Information Protection and Electronic Documents Act (PIPEDA)
Typical triggers for a Chinese AI company: (1) a Canadian subsidiary, R&D centre or sales entity processing customer or user personal information in commercial activities; (2) offering commercial products or services to individuals in Canada from offshore and processing their personal information — the OPC has consistently asserted jurisdiction over foreign organisations with a real and substantial connection to Canada; (3) receiving a Canadian customer’s personal information as its processor for labelling, training, inference or operations, in which case Schedule 1 clause 4.1.3 obliges the customer to impose comparable protection on you by contract, which in practice becomes a DPA, security questionnaires, audit rights and subcontracting limits; (4) employee data — note that PIPEDA covers employee personal information only for federal works, undertakings or businesses, with provincial law applying to provincially regulated employers. Quebec, Alberta and British Columbia have provincial private-sector privacy laws declared substantially similar, which take precedence for commercial activity within those provinces (see the Quebec entry in this corpus).
5 obligations · reviewed 2026-09-12
Québec Law 25 (Act respecting the protection of personal information in the private sector, CQLR c. P-39.1)
It applies to any person carrying on an enterprise in Québec, with no requirement to be established there. Typical triggers for a Chinese AI company: (1) an office, R&D site or employees in Québec; (2) offering online products or services to Québec residents and collecting their personal information — Québec enforces aggressively on French-language service and consumer protection, so consumer AI products need particular care; (3) supplying models, scoring, support automation or data processing to Québec business customers, who will require a written agreement and cooperation on the section 17 assessment; (4) communicating Québec personal information to China, the United States or another province — note that “outside Québec” includes other Canadian provinces, not only other countries, which is a common misreading; (5) making solely automated credit, pricing, screening or account decisions about individuals in Québec.
5 obligations · reviewed 2026-09-12
Canada’s Artificial Intelligence and Data Act (AIDA, in Bill C-27) — died with the session and never came into force
This entry creates no current obligation. It has three practical uses for a Chinese AI company: (1) in investment diligence, customer questionnaires and tender documents, never describe AIDA as an AI law in force in Canada or claim “AIDA compliance”; (2) design the Canadian AI compliance baseline around PIPEDA federally, provincial privacy statutes (notably Québec’s Law 25 and the Alberta and British Columbia statutes), and applicable sectoral regulation; (3) keep tracking the 45th Parliament for successor AI legislation and re-assess when a text appears, since the high-impact system framework may return in a new form — and track Bill C-36, now at second reading, which is not AI legislation but would rewrite the privacy baseline you build on in Canada.
0 obligations · reviewed 2026-09-12
Sources (7)
- Personal Information Protection and Electronic Documents Act (PIPEDA), consolidatedDepartment of Justice Canada — Justice Laws Website · S.C. 2000, c. 5 · retrieved 2026-09-12
- Parliament of Canada LEGISinfo — Bill C-27 (containing the Artificial Intelligence and Data Act, AIDA)Parliament of Canada · retrieved 2026-09-12
- Parliament of Canada LEGISinfo — Bill C-36 (Protecting Privacy and Consumer Data Act; amends PIPEDA)Parliament of Canada · retrieved 2026-09-12
- Parliament of Canada LEGISinfo — full bill list for the 45th Parliament, 1st session (JSON endpoint)Parliament of Canada · retrieved 2026-09-12
- Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), consolidatedÉditeur officiel du Québec / LégisQuébec · retrieved 2026-09-12
- Québec Law 25 (S.Q. 2021, c. 25) — official text (s. 175 sets the phased commencement dates)Publications du Québec · art. 175 · published 2021-09-22 · retrieved 2026-09-12
- Parliament of Canada LEGISinfo overview (current session: 45th Parliament, 1st session, from 26 May 2025)Parliament of Canada · retrieved 2026-09-12
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.