PIPEDA is Canada's federal private-sector privacy law, governing how organizations collect, use, and disclose personal information in commercial activity. It is built on ten fair information principles. Since 2018, organizations must report breaches posing a real risk of significant harm.

Quebec's Law 25 modernizes the province's private and public sector privacy laws with some of the strictest requirements in Canada. It introduced enhanced consent, transparency, privacy-by-default, mandatory privacy officers, breach reporting, and data portability over a phased rollout from 2022 to 2024.