Your Rights Under PIPEDA + Provincial Privacy Acts (Quebec Law 25, BC/AB PIPA) — Canada
Sourced from Canadian federal statutes and official sources. Provincial information reflects each province's own legislation and court rulings. Written in plain language for general understanding — this is educational content, not legal advice. Our editorial standards
What is this right?
Canadian privacy law is federated. PIPEDA federally + Quebec Law 25 + BC PIPA + AB PIPA for provincial private sector. The applicable law depends on where the organisation operates and where the data subjects reside. Data-subject access, correction, deletion rights. Regulator: OPC federally; provincial Privacy Commissioners. Quebec Law 25 is the strictest — mandatory privacy officer, mandatory PIA, breach notification, fines up to CAD 25 million or 4% of global turnover.
When does it apply?
- An organisation refuses to disclose, correct, or delete your data.
- Data breach.
- Cross-border data transfer of Quebec / Canadian data.
- Privacy concerns about a Canadian-regulated organisation.
Using Your Canadian Privacy Rights
- Send a written request to the organisation.
- If refused, complain to OPC (federal) or provincial Privacy Commissioner.
- For Quebec residents, the Commission d'accès à l'information du Québec is the primary regulator.
- For Canadian deletion requests, our data privacy deletion letter covers the template.
What should you NOT do?
- Don't skip the organisation's internal channel.
- Don't provide more identifying data than necessary.
About Data Privacy & Digital Rights in Canada
Canada's privacy framework is federated. PIPEDA (Personal Information Protection and Electronic Documents Act) covers the federally-regulated private sector. The Privacy Act covers the federal public sector. Quebec's Law 25 (formerly Bill 64) applies stricter rules to private-sector data processing of Quebec residents. BC's PIPA and Alberta's PIPA are substantially similar provincial private-sector laws. Regulator: OPC (Office of the Privacy Commissioner of Canada) federally; provincial Privacy Commissioners in Quebec (Commission d'accès à l'information), BC, AB. For NCII, Criminal Code s.162.1 (in force from Bill C-13, 2014) criminalises non-consensual distribution of intimate images — up to 5 years.
Common Questions
Which law applies to me?
Depends on where the organisation operates and where data subjects reside. PIPEDA applies federally and to provinces without a 'substantially similar' law. Quebec Law 25 applies to private-sector handling of Quebec residents' data. BC PIPA and AB PIPA apply for BC / Alberta. Federally-regulated industries (banks, airlines, telecoms) generally remain under PIPEDA across Canada.
What's the status of CPPA / Bill C-27?
Bill C-27 (Digital Charter Implementation Act 2022) proposed the Consumer Privacy Protection Act (CPPA) to replace PIPEDA. The bill made significant progress but was not enacted before Parliament's prorogation / dissolution events. Reform continues but timeline is uncertain. PIPEDA remains the operative federal law for now.
Is Quebec Law 25 fully in force?
Yes — Quebec Law 25 was phased in across 2022–2024. Major provisions (mandatory privacy officer, breach notification, fines, automated-decision rights) are now operational. Quebec is the strictest privacy jurisdiction in Canada.
What is the your rights under pipeda + provincial privacy acts (quebec law 25, bc/ab pipa) right in Canada?
Canadian privacy law is federated. PIPEDA federally + Quebec Law 25 + BC PIPA + AB PIPA for provincial private sector. The applicable law depends on where the organisation operates and where the data subjects reside. Data-subject access, correction, deletion rights. Regulator: OPC federally; provincial Privacy Commissioners. Quebec Law 25 is the strictest — mandatory privacy officer, mandatory PIA, breach notification, fines up to CAD 25 million or 4% of global turnover.
When does your rights under pipeda + provincial privacy acts (quebec law 25, bc/ab pipa) apply?
An organisation refuses to disclose, correct, or delete your data.Data breach.Cross-border data transfer of Quebec / Canadian data.Privacy concerns about a Canadian-regulated organisation.
What are my privacy rights in Canada?
Send a written request to the organisation.If refused, complain to OPC (federal) or provincial Privacy Commissioner.For Quebec residents, the Commission d'accès à l'information du Québec is the primary regulator.For Canadian deletion requests, our data privacy deletion letter covers the template.
What mistakes should I avoid with your rights under pipeda + provincial privacy acts (quebec law 25, bc/ab pipa)?
Don't skip the organisation's internal channel.Don't provide more identifying data than necessary.