Canada
Tier 2 Comprehensive law AmericasPrincipal framework: PIPEDA + provincial (Quebec Law 25) (2000). Regulator: OPC. Federal reform (Bill C-27) lapsed in 2025, leaving Quebec’s Law 25 the strictest Canadian regime. EU adequacy covers PIPEDA-scope commercial data only.
At a glance
- Principal law
- PIPEDA + provincial (Quebec Law 25)
- Regulator
- OPC
- Breach notification
- Report to the OPC and notify individuals where a real risk of significant harm; keep breach records
- Maximum penalty
- PIPEDA fines are modest; Quebec Law 25 reaches C$25m or 4% of worldwide turnover
- DPO required
- An accountable individual must be designated
- Digital consent age
- No federal age; Quebec sets 14 for own consent
- Extraterritorial reach
- Real-and-substantial-connection test
Structure
- Structural pattern
- Pattern 2 — floor with substitution
- Sub-jurisdictions
- 0 (substituting)
- ISO code
- CA
Transfers and adequacy
- EU member
- No
- EEA member
- No
- Holds EU adequacy
- No
Partial or framework-based arrangement rather than a full adequacy decision.
Instruments
No instrument profiled yet.
Sources
- Primary PIPEDA — Justice Laws
- Regulator OPC — regulator
Never independently verified — seeded from the prototype.