GRCLibrary.ai

Annex

Canada Privacy Regulatory Requirements

This annex defines privacy and AI regulatory requirements applicable to processing of personal data in Canada under PIPEDA (current), the lapsed Consumer Privacy Protection Act and Artificial Intelligence and Data Act (Bill C-27, which died on the 2025-01-06 prorogation; a privacy successor, Bill C-36 (Protecting Privacy and Consumer Data Act), was introduced 2026-06-15 and is proposed, not in force; see below), and Quebec Law 25. It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.

Type
Annex
Version
1.1.33
Date
2026-11-07
Owner
Data Protection Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Privacy
Review frequency
Annual and upon material privacy, regulatory, or AI governance change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • Purpose
  • Applicable laws and regulatory authorities
  • Bill C-36 (Protecting Privacy and Consumer Data Act, PPCDA): the proposed framework in detail
  • AI and privacy obligations
  • Employment and workforce monitoring
  • Operational requirements (PIPEDA)
  • Cross-border transfer mechanisms
  • Enforcement and fines
  • Limitations

Related documents