Two layers of privacy law
PIPEDA is the federal law for private-sector organizations, while Alberta, British Columbia and Quebec have their own private-sector laws. Quebec’s Law 25 is the strictest: it asks for clear consent, a named privacy officer, privacy impact assessments for some projects and fast breach handling, and its penalties can reach CA$25 million or 4% of worldwide turnover.
What a compliant site does
- Explains in plain words what data is collected, why and for how long
- Asks for consent before optional cookies and tracking load
- Lets people access, correct and delete their data
- Keeps a record of every breach and reports serious ones
Under PIPEDA, a breach that creates a real risk of significant harm must be reported to the Office of the Privacy Commissioner and to the people affected, and records of all breaches are kept for 24 months. If you email marketing messages, Canada’s anti-spam law CASL also requires consent and a working unsubscribe link.
How we build for it
Forms collect only what is needed, consent choices are stored with a date, data can be hosted in a Canadian region on request, and every project documents where personal information lives and who can reach it. This is design guidance rather than legal advice, so involve a lawyer for contracts and policies.