Canadian privacy law is a patchwork, and it confuses a lot of small business owners. Is it PIPEDA? Quebec's Law 25? Something provincial? The honest answer is that it depends on where you are and what you do, but working out which rules apply to you is not as hard as it looks, and it matters, because you cannot follow rules you have not identified. Here is a plain-language map. This is orientation, not legal advice.
The federal baseline: PIPEDA
For most Canadian businesses, the starting point is PIPEDA, the federal private-sector privacy law. It applies to organizations that collect, use, or disclose personal information in the course of commercial activity, which covers the majority of ordinary businesses, and it governs interprovincial and international data flows. If nothing more specific applies, assume PIPEDA is your baseline.
Where a provincial law takes over
Some provinces have their own private-sector privacy laws that apply instead of PIPEDA for activity within the province. The big one is Quebec's Law 25, now fully in force and the strictest in the country, with real teeth (mandatory breach reporting, consent rules, privacy officers, and rights around automated decisions). British Columbia and Alberta also have their own comparable laws. If you operate in one of these provinces, that law is likely your primary rulebook for local activity, though PIPEDA can still reach your cross-border and interprovincial data.
How to figure out your situation
- Where do you operate, and where are your customers? Quebec, BC, or Alberta activity points toward the provincial law; elsewhere, PIPEDA.
- Do you handle Quebec residents' data? If so, Law 25 likely reaches you even from outside Quebec, and it sets the highest bar, so meeting it usually covers you broadly.
- Do you sell into the EU? Then GDPR may apply on top.
- Are you in health, finance, or another regulated field? Sector rules may add more.
The practical shortcut
You do not need to become a privacy lawyer. For most small businesses, the winning move is to build to the highest standard that plausibly applies to you, in practice, that is usually Law 25 if you touch Quebec, or solid PIPEDA practice otherwise, because good privacy hygiene (get consent, collect less, secure it, honour requests) satisfies the spirit of all of them. Identify your primary law, meet it well, and the patchwork stops being frightening. It fits into a broader compliance picture, and if you are genuinely unsure which regime governs you, that is exactly the kind of question worth a short professional check.