Canadian Privacy Law by Province: A Guide for Software and App Projects
October 19, 2026
This guide is general information for planning software projects, current as of October 2026. It is not legal advice; confirm your obligations with a privacy lawyer.
Short answer: in most provinces, private-sector companies follow the federal PIPEDA. Three provinces have their own private-sector laws that replace PIPEDA for activity inside the province: Québec (the Private Sector Act as amended by Law 25), Alberta (PIPA) and British Columbia (PIPA). PIPEDA still applies everywhere to personal information that crosses provincial or national borders in commercial activity, and to federally regulated businesses such as banks, airlines and telecoms. Several provinces, including Ontario, also have separate laws for health information.
Which law applies, province by province
| Province or territory | Private-sector privacy law | Mandatory breach reporting |
|---|---|---|
| Québec | Private Sector Act, as amended by Law 25 | Yes: to the Commission d'accès à l'information and affected people, when there is a risk of serious injury |
| Alberta | Personal Information Protection Act (PIPA) | Yes: to the Information and Privacy Commissioner, when there is a real risk of significant harm |
| British Columbia | Personal Information Protection Act (PIPA) | No general statutory duty as of October 2026; reporting serious breaches is recommended |
| Ontario, Manitoba, Saskatchewan, Atlantic provinces, territories | Federal PIPEDA for commercial activity | Yes: to the federal Privacy Commissioner and affected people, when there is a real risk of significant harm, plus a record of every breach for 24 months |
Health information often has its own rules: Ontario's PHIPA, for example, applies to health information custodians such as clinics and the businesses that act for them.
What this means for your software project
- Know where your users and data are. A Calgary customer base brings Alberta PIPA; serving Québec brings Law 25; data moving across provinces or to US cloud services brings PIPEDA.
- Design consent and purpose up front. Every Canadian law expects you to say why you collect data and to collect only what you need.
- Plan for breaches before launch. Logging, alerting and a written response plan let you assess "real risk of significant harm" quickly and report on time.
- Keep data residency simple. Hosting in Canadian cloud regions isn't required by most private-sector laws, but it simplifies contracts and questions from enterprise and public-sector customers.
- CASL for emails and texts. Canada's anti-spam law applies everywhere in Canada: commercial emails and text messages need consent, identification of the sender and a working unsubscribe. Build these into sign-up flows and notification settings.
Province guides
- Ontario: PIPEDA, PHIPA and employee monitoring
- British Columbia: PIPA for apps and websites
- Alberta: PIPA and mandatory breach reporting
- Québec: Law 25 website checklist
What about federal privacy reform?
In June 2026 the federal government introduced Bill C-36, which would replace PIPEDA's private-sector rules with a new Protecting Privacy and Consumer Data Act, with a new regulator and stronger enforcement. As of October 2026 it has only passed first reading, and earlier attempts (Bill C-11 and Bill C-27) died before becoming law. PIPEDA still applies until a new law is in force. Building to good privacy practice now, such as clear consent, minimal data and documented safeguards, keeps you ready either way.
How Algoseed Labs helps
We build web and mobile apps, AI systems and cloud infrastructure for companies across Canada, with privacy designed in: consent flows, data minimization, access controls, breach logging and hosting in Canada when you need it. Tell us about your project.
Frequently asked questions
Does PIPEDA apply in every province?
PIPEDA applies to commercial activity in provinces without a substantially similar private-sector law, such as Ontario and the Prairie and Atlantic provinces. In Québec, Alberta and British Columbia, the provincial law applies inside the province, but PIPEDA still covers personal information crossing provincial or national borders and federally regulated businesses.
Which provinces require reporting privacy breaches?
Québec (Law 25) and Alberta (PIPA) have mandatory reporting, and PIPEDA requires reporting in provinces it covers, each when a breach creates a real or serious risk of harm. As of October 2026, BC's PIPA has no general statutory breach-reporting duty, though reporting serious breaches is recommended.
Do we have to host data in Canada?
Most private-sector privacy laws don't require it, but you must protect data wherever it is stored and be transparent about it, and Québec's Law 25 requires an assessment before personal information leaves Québec. Many companies host in Canada to simplify compliance and customer questions.