AI and Canadian privacy law: what businesses need to know
By Automation Canada ·
Short answer: Canada does not have an AI-specific law for private businesses. But if your AI tools touch personal information, privacy law already applies, and in Quebec it includes specific rules for automated decisions. Most businesses need an AI policy, a list of the AI tools in use, and a privacy review of anything that processes customer or employee data.
This guide is general information, not legal advice. Laws change, so confirm current requirements with a lawyer or your privacy regulator before relying on them.
Is there an AI law in Canada?
Not for the private sector, at the time of writing. The federal government proposed the Artificial Intelligence and Data Act (AIDA) as part of Bill C-27, but the bill did not pass before Parliament was prorogued in January 2025.
That does not mean AI is unregulated. Using AI usually means using personal information — customer emails, employee records, call recordings, documents — and that is covered by privacy law.
Which privacy law applies to your business?
| Where you operate | Main private-sector privacy law |
|---|---|
| Quebec | Quebec’s private-sector privacy act, as modernized by Law 25 |
| Alberta | Alberta Personal Information Protection Act (PIPA) |
| British Columbia | BC Personal Information Protection Act (PIPA) |
| All other provinces and territories | Federal PIPEDA |
Health information often has its own provincial law (for example, Ontario’s PHIPA or Nova Scotia’s PHIA), and public bodies have separate access-and-privacy laws. If you supply services to government, their rules often flow down to you through your contract.
What PIPEDA means for AI
PIPEDA is built on ten fair information principles. Four matter most for AI:
- Identifying purposes and consent. If you put customer information into an AI tool for a new purpose, ask whether that purpose was covered when you collected it.
- Limiting use and disclosure. Pasting personal information into a public AI tool can be a disclosure to a third party. Know where the data goes and whether the provider can use it to train models.
- Safeguards. You remain accountable for personal information you transfer to a service provider, including AI vendors, and must protect it with contractual and technical safeguards.
- Openness. Be transparent about how you use personal information, including in AI systems.
The Office of the Privacy Commissioner of Canada, together with provincial and territorial commissioners, has published principles for responsible, privacy-protective generative AI. It is a useful reference for what regulators expect.
Quebec’s Law 25: the strictest rules in Canada
If you have customers or employees in Quebec, Law 25 adds specific obligations that matter for AI:
- Automated decisions. If you make a decision about a person based exclusively on automated processing, you must inform them, and on request tell them the personal information and the main factors used, and let them have it reviewed by a person.
- Privacy impact assessments. These are required for certain projects, including information systems that involve personal information and transfers of personal information outside Quebec.
- Privacy by default. Technology products and services must offer the highest level of confidentiality by default.
Data residency: where is your AI processing your data?
Most privacy laws do not ban storing data outside Canada, but some do in specific cases, and many clients now ask. For example:
- Nova Scotia’s PIIDPA restricts public bodies, and the service providers handling their data, from storing or accessing personal information outside Canada, with limited exceptions.
- Quebec’s Law 25 requires an assessment before personal information leaves Quebec.
Major AI platforms now offer Canadian hosting options, such as Microsoft Azure’s Canada Central and Canada East regions. Check where your AI tools store data and where they process prompts. These are not always the same place.
What to do this quarter
- Inventory your AI use. List every AI tool staff use, including free ones, and what data goes into each.
- Write an acceptable-use policy. Cover what tools are approved, what data must never go into them, and who to ask.
- Review your vendors. Check data location, retention, model-training settings and contract terms.
- Assess high-risk uses. Anything that makes or influences decisions about people deserves a privacy impact assessment.
- Tell people. Update your privacy policy to explain how you use AI.
Need help? Our AI Governance & Risk service puts all five in place, aligned with the privacy law that applies to you.