Law 25 and PIPEDA AI compliance: a practical guide

Law 25 and PIPEDA AI compliance comes down to one idea: if your AI system touches personal information, Canada’s existing privacy laws already apply to it. There is no separate federal AI act in force. What you do have is PIPEDA across the country, Québec’s Law 25 on top of it for business in Québec, and a regulator in each case that expects you to show your work.

In practice, that means five things for any AI project: assess privacy risk before you build, have a lawful purpose and valid consent for the data, be transparent when a machine makes a decision about a person, control where the data goes, and be ready to report incidents. This guide explains what each law requires and how to build those steps into an AI rollout without stalling it.

Which privacy laws apply to AI in Canada?#

Three layers matter for most mid-size and enterprise companies.

PIPEDA (the Personal Information Protection and Electronic Documents Act) governs how private-sector organizations collect, use and disclose personal information in commercial activity. It is built on ten fair information principles: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access and challenging compliance. The Office of the Privacy Commissioner of Canada (OPC) oversees it.

Québec’s Law 25 modernized the province’s Act respecting the protection of personal information in the private sector. It came into force in three phases, on September 22 of 2022, 2023 and 2024, and is overseen by the Commission d’accès à l’information (CAI). Alberta and British Columbia have their own private-sector privacy laws as well, and provincial health information laws apply to health data.

Sector rules sit on top. Federally regulated banks and insurers answer to OSFI, whose model risk guideline E-23 explicitly covers AI and takes effect on May 1, 2027. Québec’s Autorité des marchés financiers published a guideline on the use of AI in April 2026 that takes effect on the same date.

Canada’s privacy regulators also published joint Principles for responsible, trustworthy and privacy-protective generative AI technologies in December 2023. They are not binding law, but they show how regulators read existing law when a complaint involves AI.

What happened to federal AI and privacy reform?

Bill C-27, which would have replaced PIPEDA and created an Artificial Intelligence and Data Act, died when Parliament was prorogued in January 2025. On June 15, 2026, the government tabled Bill C-36, the Protecting Privacy and Consumer Data Act. It would re-enact the private-sector part of PIPEDA with stronger enforcement, but drops the separate AI act. Until it passes, PIPEDA is the law, and the bill’s details can still change.

What does Law 25 require for an AI project?#

Law 25 is the stricter of the two regimes, so it is the right design target even for companies with only part of their business in Québec. The obligations that land on AI projects are these.

A person in charge and a governance policy

Since September 2022, every enterprise has a person in charge of the protection of personal information. By default it is the person with the highest authority, usually the CEO, unless the role is delegated in writing. Their title and contact details must be published. Since September 2023, enterprises must also publish governance policies and practices for personal information in clear language.

For AI, this person should sign off on new systems that use personal information. Put them in the project’s approval path from week one.

A privacy impact assessment before you build

Section 3.3 of the Québec private-sector act requires a privacy impact assessment (PIA) for any project to acquire, develop or overhaul an information system or electronic service delivery system that involves personal information. The assessment must be proportionate to the sensitivity of the information, the purpose, the amount and how it is distributed and stored. An AI assistant that reads customer emails or an agent that updates employee records clearly qualifies.

The CAI publishes a guide to conducting assessments. A useful AI PIA answers questions like:

• What personal information does the system read, generate or store, including prompts, outputs and logs?
• Which model provider processes it, in which country, and is it used to train models?
• Who can see the outputs, and how is access controlled and logged?
• How long is each kind of data kept, and how is it destroyed or anonymized?
• Does the system make or support decisions about individuals?

Consent and purpose

Consent under Law 25 must be manifest, free, enlightened and given for specific purposes, requested separately for each purpose in clear terms. Sensitive information, such as health, financial or biometric data, requires express consent.

The trap for AI teams is secondary use. Personal information collected to service a policy or process a payroll was not necessarily collected to train or fine-tune a model. Using it that way can be a new purpose that needs fresh consent unless a legal exception applies. The safest pattern is to use private model endpoints that do not train on your data, and to keep any model improvement inside the purposes you already disclosed.

Transparency about profiling and privacy by default

Section 8.1 requires an enterprise that uses technology to identify, locate or profile a person to inform them, and to give them a way to activate those functions. Section 9.1 requires technological products and services offered to the public to provide the highest level of confidentiality by default. Customer-facing assistants and personalization features should launch with the privacy-protective settings switched on.

Automated decisions

Section 12.1 is the rule most directly aimed at AI. When an enterprise makes a decision based exclusively on automated processing of personal information, it must inform the person no later than when it tells them about the decision. On request, it must explain:

1. The personal information used to make the decision.
2. The reasons and the principal factors and parameters that led to it.
3. The person’s right to have the personal information corrected.

The person must also be able to submit observations to a member of staff who is in a position to review the decision.

This is one reason we design most production systems with a person approving decisions that affect customers or employees. It is good risk management, and a decision with meaningful human review is not one made exclusively by automated processing. Where full automation is the right call, log the inputs, factors and model version for every decision so you can answer a request in days, not weeks.

Transfers outside Québec

Section 17 requires a PIA before personal information is communicated outside Québec, and that includes other provinces. The enterprise must consider the sensitivity of the information, the purposes, the protection measures (including contractual ones) and the legal framework in the destination. The information may be communicated only if the assessment shows it will receive adequate protection, and the arrangement must be set out in a written agreement.

Sending prompts to a model endpoint in another country is a communication outside Québec. Our article on Canadian data residency for AI covers the architecture choices in detail.

Confidentiality incidents

Since September 2022, an enterprise must notify the CAI and the affected people promptly when a confidentiality incident presents a risk of serious injury, and must keep a register of all incidents. For AI systems, an incident might be a model returning one customer’s data to another, or logs exposed through a misconfigured storage bucket.

Retention and portability

Once the purposes are achieved, personal information must be destroyed or anonymized. Since September 2024, individuals can also ask for their computerized personal information in a structured, commonly used technological format. Both rules apply to AI logs, embeddings and vector stores, which teams often forget to include in retention schedules.

How does PIPEDA treat AI and cross-border processing?#

PIPEDA has no AI-specific section, but its principles map directly onto AI work.

• Accountability. You remain responsible for personal information you transfer to a third party for processing, including a cloud or model provider. The OPC’s guidance on processing across borders treats such a transfer as a use, not a disclosure, so the protection must be comparable and set by contract.
• Openness. You must tell people that their information may be processed in another country and may be accessible to that country’s authorities.
• Limiting use. Information can be used only for the purposes it was collected for, which brings back the secondary-use question for model training.
• Safeguards. Security must match the sensitivity of the data: encryption, access control, logging.
• Breach reporting. Since November 1, 2018, organizations must report breaches of security safeguards that create a real risk of significant harm to the OPC, notify affected individuals, and keep a record of every breach for 24 months.

Law 25 vs PIPEDA: what changes for an AI system#

A compliance checklist for your next AI project#

1. Inventory the data. List every field the system reads, every output it generates and every log it keeps. Mark which items are personal or sensitive information.
2. Name the owner. Confirm the person in charge of personal information and the business owner of the system, and add both to the approval path.
3. Run the PIA early. Start it during discovery, not after the build. Update it when the model, provider or data changes.
4. Choose the hosting deliberately. Prefer Canadian cloud regions and private model endpoints with no training on your data. Document any communication outside Québec or Canada with an assessment and a contract.
5. Design the decision path. Decide which outputs are recommendations a person approves and which are automated decisions. For the latter, build the notice, explanation and review process before launch.
6. Log for accountability. Record inputs, outputs, model version and approver for every material action, with least-privilege access to the logs themselves.
7. Set retention. Apply your retention schedule to prompts, outputs, embeddings and backups, with destruction or anonymization at the end.
8. Rehearse incidents. Add AI-specific scenarios to your incident response plan and confirm who notifies the CAI and the OPC.

Our security and data handling practices follow this pattern by default: systems built in your own cloud account, Canadian regions, private model endpoints, full audit logs and a privacy impact assessment as a standard deliverable. You can see where each step sits in our phased delivery process.

Where companies usually get stuck#

The legal text is rarely the problem. The common failure is sequencing. A team builds a promising AI assistant on company knowledge, then discovers during the privacy review that prompts are sent to a foreign endpoint, logs keep full customer records indefinitely, and nobody can explain how a recommendation was produced. Fixing that late costs weeks.

Teams that move quickly treat privacy as a design input: the PIA starts in discovery, the hosting decision is made before the prototype, and the human review step is part of the workflow from day one. Compliance then becomes a document you update, not a gate you fail.

If you want to see what that looks like for your use case, our free AI blueprint outlines a solution, the systems involved and the data questions to settle first. Or book a call with a senior engineer to walk through your project.