Why Privacy Matters

PIPEDA covers private-sector organizations handling personal information in commercial activity. There is no employee or revenue floor. Since November 1, 2018, any breach that creates a real risk of significant harm must be reported to the Privacy Commissioner and the affected individuals, and every breach must be recorded and kept for 24 months. Knowingly failing to report or record one can bring fines of up to $100,000. In June 2026 Ottawa tabled Bill C-36, which would replace PIPEDA's privacy rules with penalties of up to $10 million or 3% of global revenue. It is a bill, not law. Build to PIPEDA today.

Quebec's Law 25 amended the province's private-sector privacy act and is the strictest regime in Canada. Again, no size threshold. The person with the highest authority is the privacy officer by default unless the role is delegated in writing, and the officer's title and contact details must be published. Incidents presenting a risk of serious injury go to the Commission d'accès à l'information and the people affected, and every incident goes in a register.

Administrative penalties reach $10 million or 2% of worldwide turnover, and penal fines $25 million or 4%, whichever is greater. Individuals can sue too. Punitive damages of at least $1,000 are available only where the infringement was intentional or resulted from gross fault. They are not automatic, and anyone who says otherwise is selling fear. Health data adds provincial laws such as Ontario's PHIPA; see our guide to personal health data security.

This is the part most businesses outside Quebec miss. Law 25 requires a PIA:

The section 17 assessment weighs sensitivity, purposes, safeguards including contracts, and the legal regime where the data lands. The transfer is allowed only if the PIA concludes the data will be adequately protected, backed by a written agreement. You cannot hand this to your cloud provider. In practice, any SaaS company with Quebec customers hosted outside the province needs at least one PIA on file. That is most of the companies we talk to.

There is still no federal US privacy law. Twenty states have comprehensive laws in effect in 2026 (counting Florida's narrower one), with Indiana, Kentucky and Rhode Island added on January 1. "We are too small" is often wrong.

California is also where assessments became mandatory in the US. Rules effective January 1, 2026 require risk assessments for higher-risk processing, with attestations due by April 1, 2028, and cybersecurity audit certifications phase in by revenue through April 1, 2030. A Law 25 PIA and a California risk assessment overlap heavily. Write one document that satisfies both.

For a 30 to 200 person company this should take days, not months. Here is the sequence from our data security and privacy work, scaled down.

Pick the product, vendor or cross-border transfer that triggered the question. A PIA on "the whole company" never finishes.

List each category of personal information, its source, purpose, storage location (vendor and region), who can access it, and when it is deleted. A spreadsheet is fine. This step finds most of the risk, including the shadow AI tools staff paste customer data into.

Draw where data moves, including analytics, support tools and sub-processors. Mark every point where it leaves Quebec, Canada or the US.

For each data element, ask whether you need it. Dropping a field you do not use is the cheapest control there is.

Rate likelihood and harm to the individual, not the company. Then choose safeguards: encryption, access reviews, retention limits, contract terms and a tested incident response plan. Our process, risk and controls work uses the same scoring.

The accountable executive signs. File it where procurement can find it. Revisit it when the system or vendor changes.

Why the cheap rows matter: IBM's Cost of a Data Breach 2026 puts the global average at $4.99 million. A small business will not hit that number, but legal, forensics, notification and lost deals scale down far less than revenue does.

We turn down privacy program engagements regularly. If you sell only to businesses, hold no sensitive data, have no Quebec customers and sit below every US threshold, a one-page inventory, a published privacy contact and a breach register are enough. A 40-page program will sit unread.

If all your personal data lives inside one well-run platform such as payroll or a CRM, your risk lives in that contract. Read the data processing terms and confirm the hosting region first. If you are pre-product, write the inventory as you build. Retrofitting costs more.

What changes the answer: health, financial, biometric or children's data; Quebec customers; crossing a US threshold; an enterprise buyer asking for a PIA; or an ISO 27001 or SOC 2 audit with privacy in scope. Then privacy belongs inside your governance, risk and compliance work, with someone accountable.

For most clients that someone is fractional, not a hire. Our Virtual CISO service starts at the Crawling tier from $2,000 a month, enough to deliver the inventory, first PIA and register in a quarter. Details are on our pricing page.

Yes. There is no size threshold. Quebec, Alberta and British Columbia have their own private-sector laws for activity within those provinces; PIPEDA covers the rest and cross-border flows.

No. Law 25 allows punitive damages of at least $1,000 only for intentional infringement or gross fault. A documented PIA and prompt incident response are your evidence it was neither.

For one system, three to five working days spread over two weeks, mostly on the inventory. If you want help scoping it, book a consultation.