Colorado ADMT rules: hearing and last day for written comments · Oct 26, 2026 · See what changes
Dates and status re-checked against primary sources on . How we verify
Canada's federal private-sector privacy law, in force in stages from January 1, 2001 and fully in force since January 1, 2004, governing how organizations collect, use, and disclose personal information in the course of commercial activity. The Office of the Privacy Commissioner has issued guidance on how PIPEDA applies to AI, including automated decision-making and AI training data. Quebec's Law 25 (phased in over three years starting September 22, 2022) is stricter and acts as the provincial overlay for Quebec residents.
If you collect, use, or disclose personal information of Canadians in commercial activity, PIPEDA applies. A government bill to replace much of it, C-36, was introduced on June 15, 2026 and is not yet law. AI tools that process Canadian personal data must comply with PIPEDA's consent and accountability requirements. Quebec's Law 25 adds stricter requirements: a privacy impact assessment for any project to acquire, develop or overhaul an information system or electronic service that involves personal information, and before sending personal information outside Quebec; notice when a decision is based exclusively on automated processing, no later than when you tell the person about the decision, with a chance to present observations to a staff member who can review it; and notice to Quebec's privacy regulator (the Commission d'accès à l'information) and to the people affected of any privacy incident that presents a risk of serious injury. If you serve Quebec customers, treat Quebec Law 25 as your compliance floor. Correction, October 22, 2026: an earlier version said Law 25 requires a privacy impact assessment before processing that poses a significant privacy risk; the trigger is a project to acquire, develop or overhaul an information system or electronic service involving personal information, or a transfer outside Quebec.