Canada: privacy laws and AI data licensing

Which Canadian privacy law applies to your records: PIPEDA or a provincial law?#

It depends on where the business is regulated and whether the data crosses a border. PIPEDA is the default for private-sector businesses in commercial activity, but provincially regulated organizations in Quebec, Alberta and British Columbia follow their own provincial law for handling inside the province, and four provinces have health information laws that apply to health information custodians instead.

A data license with a buyer in another province or country is a cross-border commercial transfer. The Office of the Privacy Commissioner of Canada (OPC) says Alberta organizations subject to PIPA must follow PIPEDA for those specific transactions, and advises following the stricter requirement where both laws apply.

Does licensing records for AI training need new consent in Canada?#

Usually yes, if the records still contain personal information. PIPEDA's Schedule 1 says that when collected information is to be used for a purpose not previously identified, the new purpose must be identified before use and, unless the use is required by law, the individual's consent is required. Its fifth principle adds that personal information shall not be used or disclosed for other purposes without consent or a legal requirement.

Consent also has to be meaningful. Section 6.1 makes consent valid only if the people the business deals with would reasonably understand the nature, purpose and consequences of the use or disclosure, and Schedule 1 says express consent should generally be sought for sensitive information. Whether an older privacy notice covers licensing to an AI developer is a question for counsel.

Quebec is narrower. Section 12 of its private-sector act allows another use without consent only in listed cases, including purposes consistent with the original ones, uses clearly for the person's benefit, and study, research or statistics using de-identified information. Sensitive information needs express consent.

When is de-identified data outside Canadian privacy law?#

Under PIPEDA, only when there is no serious possibility that a person could be identified from it, alone or combined with other available information. The test comes from the Federal Court's Gordon decision, as the OPC's interpretation bulletin describes it. De-identified data that can later be linked back to a person remains identifiable.

The OPC's 2026 findings on Loblaw show the bar in practice. Retained IP address data and no demonstrated process to remove identifiers from back-up systems meant the information was not shown to be sufficiently anonymized, and the onus is on the organization to ensure and demonstrate that it is.

Quebec uses two tiers. De-identified information no longer allows the person to be directly identified and is still personal information. Anonymized information must be, at all times, reasonably foreseeable in the circumstances to irreversibly no longer allow identification directly or indirectly, following generally accepted best practices and the criteria in Quebec's anonymization regulation. A working checklist:

• 1Write down the purposes for the anonymized data before starting; Quebec's regulation requires this first step.
• 2Run a re-identification risk analysis covering individualization, correlation and inference, plus public data that could be matched.
• 3Check retained technical identifiers such as IP addresses, device IDs and free-text fields, not only names and contact details.
• 4Clean every copy that feeds the release, including exports and back-ups.
• 5Re-check the risk when new data or techniques appear.

What else applies when Canadian records leave the province or the country?#

Quebec businesses must complete a privacy impact assessment before communicating personal information outside Quebec. It weighs the information's sensitivity, the purposes, the contractual and other protections, and the legal framework where the information is going; the transfer may proceed only if the assessment shows adequate protection, and it must be covered by a written agreement.

Federal reform is pending but not law. Bill C-36, introduced on June 15, 2026, would enact the Protecting Privacy and Consumer Data Act and repeal Part 1 of PIPEDA; as of October 13, 2026, Parliament's LEGISinfo tracker showed it at first reading. PIPEDA remains the federal law until a replacement passes and takes effect.

SourceX works with Canadian companies, alongside U.S. and EU companies, that had 50 or more full-time employees at their peak. De-identification is performed by SourceX directly or through its processing partner, and the company approves exactly what is released, once per deal, before anything is shared. Counsel confirms which laws apply to your records.