Canada’s federal privacy law, PIPEDA, is principles-based and two decades old. Reform attempts have died twice, and a third bill, C-36, was introduced in June 2026. Québec’s Law 25 is already much stricter, with privacy impact assessments, automated-decision notices and turnover-based fines.
For startups, the most common pitfalls in Canada are marketing emails under CASL, which has some of the world’s strictest consent rules, and Québec-specific obligations.
- Federal law
- PIPEDA (reform: Bill C-36 pending)
- Provinces
- Québec Law 25; Alberta and BC PIPAs
- Marketing
- CASL (express or implied consent)
- AI
- No federal AI law; AIDA lapsed Jan 2025
- Québec penalties
- Up to C$25 million or 4% of worldwide turnover
- Regulators
- OPC; CAI (Québec); CRTC (CASL)
Who needs to comply
Startups collecting personal information in commercial activity in Canada
PIPEDA applies except where a substantially similar provincial law applies.
Startups with Québec users
Law 25 adds PIAs, transfer assessments, ADM notices and stronger consent rules.
Anyone sending commercial emails or texts to Canadians
CASL requires consent, identification and unsubscribe.
The laws, in detail
01PIPEDA
Ten fair information principles for private-sector organisations.
When it applies
Commercial collection, use or disclosure of personal information in Canada.
What you must do
- Meaningful consent
- Accountability and a designated privacy officer
- Safeguards
- Breach reporting to the OPC and notification of real risk of significant harm
- Breach records for 24 months
Regulator
Office of the Privacy Commissioner of Canada
Penalties
Fines for certain breach-reporting offences; reputational and court remedies.
02Québec Law 25
Modernised privacy law for the private sector in Québec.
When it applies
Enterprises collecting personal information of people in Québec.
What you must do
- Person in charge of privacy (by default the CEO)
- PIAs, including before transfers outside Québec
- Confidentiality by default
- Notice of decisions based exclusively on automated processing
- Data portability
Regulator
Commission d’accès à l’information (CAI)
Penalties
Administrative penalties up to C$10 million or 2%, and penal fines up to C$25 million or 4% of worldwide turnover.
03Canada’s Anti-Spam Legislation (CASL)
Commercial electronic messages and installation of software.
When it applies
Sending CEMs to or from Canadian computers.
What you must do
- Express or implied consent
- Identification and contact information
- Unsubscribe processed within 10 business days
Regulator
CRTC
Penalties
Up to C$10 million per violation for businesses.
04Bill C-36 (pending)
Proposed Protecting Privacy and Consumer Data Act replacing PIPEDA’s privacy part.
When it applies
Would apply to the same private-sector organisations if enacted.
What you must do
- Expected: stronger consent and transparency, ADM rules, new enforcement commission
Regulator
Proposed Digital Safety and Data Protection Commission
Penalties
To be determined if enacted.
05Provincial private-sector privacy laws (Alberta, British Columbia)
Substantially similar regimes to PIPEDA for businesses in those provinces, including employee data.
When it applies
Organisations collecting personal information in Alberta or BC.
What you must do
- Consent and reasonable purposes
- Breach notification to the commissioner (Alberta: real risk of significant harm)
- Privacy officer and policies
Regulator
Alberta OIPC; BC OIPC
Penalties
Fines and orders under each Act.
06PCMLTFA (FINTRAC) for crypto and payments
Anti-money laundering registration for money services businesses, including virtual currency dealers.
When it applies
Dealing in virtual currency or providing money services to people in Canada, including foreign MSBs.
What you must do
- Register with FINTRAC
- Compliance programme, KYC and reporting
- Travel Rule for virtual currency transfers
Regulator
FINTRAC
Penalties
Administrative monetary penalties and criminal sanctions.
Compliance checklist
01 · Before you launch
- Designate a privacy officer
- Québec PIA for projects and transfers
- CASL-compliant email consent
- French-language notices for Québec
02 · At launch
- Breach reporting and 24-month breach records
- ADM notices for Québec
- Unsubscribe processing within 10 business days
03 · As you scale
- Track Bill C-36
- Provincial health and public-sector rules for B2G sales
Key dates
- Jul 2014CASL in force
- Sep 2023Most Québec Law 25 obligations
- Sep 2024Québec data portability right
- Jan 2025Bill C-27 (incl. AIDA) lapses
- 15 Jun 2026Bill C-36 introduced
Common mistakes
- Buying email lists (fails CASL)
- Ignoring Québec PIAs for transfers
- English-only consent in Québec
FAQs
Does Canada have an AI law?
Not at federal level; the proposed AIDA lapsed in 2025. Privacy laws, including Québec’s ADM notice, apply to AI.
Do we need consent for every marketing email?
Under CASL, yes, express or implied, with limited exceptions.
In the law library
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.