AI and Privacy Compliance in Canada: PIPEDA, Law 25, and What's Coming

AI privacy compliance in Canada rests on PIPEDA, Quebec's Law 25 and, for hiring in Ontario, the Employment Standards Act. AIDA died with Bill C-27 in January 2025. Its privacy successor, Bill C-36, is still at first reading.

That means the rules that matter in September 2026 are the ones already in force. The Office of the Privacy Commissioner (OPC) said in its 2024-25 annual report that "Canada's existing privacy laws continue to apply, including for new technologies such as generative AI". This guide explains what those laws require of an AI system, with a separate section on AI in recruitment. It is an overview for operational leaders and does not replace legal advice.

Which privacy laws apply to AI in Canada in 2026?

Three laws do most of the work for a private-sector organization, and one federal bill is pending.

Alberta and British Columbia also have private-sector privacy laws that the OPC treats as substantially similar to PIPEDA. Public bodies follow their own statutes, such as the federal Privacy Act.

Does PIPEDA apply to employers using AI to interview employees?

PIPEDA covers employee personal information only at federally regulated businesses. The OPC's summary says the Act "also applies to the personal information of employees of federally-regulated businesses" and lists banks, airlines, telecommunications companies, interprovincial transportation and broadcasters. A bank that uses an AI interview tool must meet PIPEDA's consent, purpose and accuracy principles for candidate and employee data.

A provincially regulated employer is in a different position. In Ontario, employee data at such an employer generally sits outside PIPEDA. The AI-specific duty there comes from employment law.

Ontario: AI disclosure in job postings. Since January 1, 2026, the Employment Standards Act has required publicly advertised job postings to include a statement disclosing whether the employer uses artificial intelligence "to screen, assess or select applicants". The key conditions:

• The rule applies to employers with 25 or more employees on the day the posting goes up, counting all Ontario locations.
• It excludes general recruitment campaigns, postings open only to current employees and work performed outside Ontario.
• The Ontario definition of AI is broad: a machine-based system that "infers from the input it receives in order to generate outputs such as predictions, content, recommendations or decisions". A CV-ranking feature in an applicant tracking system can fall inside it.

Quebec: automated decisions about candidates. Law 25 applies to personal information "relating to other persons" that an enterprise collects in the course of its business, which includes applicants. If a candidate is rejected by a decision "based exclusively on an automated processing", section 12.1 requires the employer to tell the candidate, explain the main factors on request and let them submit observations to a person who can review the decision. A recruiter who clicks "approve" on every AI ranking without reviewing it is a weak basis for claiming the decision was not exclusively automated.

Federal bill to watch. Bill C-36 would require organizations to be "transparent about their use of automated decision making for significant decisions about individuals". Hiring decisions are a likely fit. The bill is at first reading and may change.

A practical hiring checklist:

1. List every AI feature in your recruiting stack: sourcing, CV screening, chat or video interviews, scoring.
2. Add the Ontario disclosure line to public postings if you have 25 or more employees.
3. For Quebec candidates, decide where a human reviews each rejection and document it.
4. Tell candidates what data the tool uses and keep the records for access requests.
5. Check the vendor contract for training on your data, storage location and deletion.

Our longer guide on AI in HR and recruitment in Canada covers tool selection. A written AI use policy for staff is where these rules become day-to-day instructions for recruiters.

What does PIPEDA require from an AI system?

PIPEDA's ten fair information principles apply to AI the same way they apply to any other processing. The OPC's page on AI for business points to three practices: valid and meaningful consent, openness about how information is used and the risks involved, and privacy by design.

Accountability. You remain responsible for personal information you send to an AI vendor. Vendor contracts need explicit terms on training, retention and location.

Identifying purposes. "Improving our services" is too vague a purpose for feeding customer conversations into a model. State the specific use.

Consent. When AI influences a significant decision about a person, such as credit, insurance or eligibility, people need to understand that AI is involved for consent to be meaningful.

Accuracy. A model that produces systematically wrong outputs about people creates an accuracy problem under the Act. Test outputs before relying on them.

Safeguards and limiting use. Send the model only the fields it needs. Keep access controls and logs.

Openness and access. People can ask what information you hold and how it was used. Keep AI inputs and outputs retrievable.

The OPC has also shown it will apply these principles to AI companies. In PIPEDA Findings #2026-002, published May 6, 2026, the OPC and the Quebec, BC and Alberta commissioners found that OpenAI "did not have implied consent" for using personal information from public websites to train GPT-3.5 and GPT-4. The complaint was found well-founded and conditionally resolved.

What does Quebec Law 25 require for AI?

Law 25 is more prescriptive than PIPEDA on four points that touch AI directly.

• Privacy impact assessment for new systems (s.3.3). Required for "any project to acquire, develop or overhaul an information system" involving personal information. Adopting an AI tool that processes personal data qualifies.
• Notice of identification, location or profiling functions (s.8.1). If you collect personal information with technology that can identify, locate or profile a person, you must first tell them and explain how to activate those functions. Profiling includes analysing "work performance, economic situation, health, personal preferences, interests or behaviour".
• Fully automated decisions (s.12.1). Notice to the person, an explanation of the main factors on request, and a route to human review.
• Transfers outside Quebec (s.17). A privacy impact assessment and a written agreement are required before personal information leaves Quebec. This covers AI and cloud vendors that process data elsewhere.

Penalties are set in sections 90.12 and 91: administrative penalties of up to $10 million or 2% of worldwide turnover, and penal fines of up to $25 million or 4%, doubled for a repeat offence.

How do Law 25 and PIPEDA fit together?

They overlap, and one AI deployment can fall under both. The OPC treats Quebec's private-sector law as substantially similar to PIPEDA, so an organization covered by it is generally exempt from PIPEDA for information handled within Quebec. PIPEDA still applies when information crosses provincial or national borders in commercial activity.

In practice, an Ontario company serving Quebec customers through a US-hosted AI model deals with both. Design to the stricter rule, which is usually Law 25, and you cover most PIPEDA duties along the way.

What happened to AIDA, and what is Bill C-36?

AIDA is gone, and privacy reform restarted in 2026. The OPC's annual report confirms that Bill C-27, which contained AIDA, "died on the order paper with the prorogation of Parliament in January 2025". No stand-alone federal AI act has been tabled since.

Bill C-36, sponsored by Evan Solomon as Minister of Artificial Intelligence and Digital Innovation, received first reading on June 15, 2026. If passed, the Protecting Privacy and Consumer Data Act would:

• replace most of PIPEDA's private-sector rules;
• create the Digital Safety and Data Protection Commission of Canada;
• set administrative penalties of up to $10 million or 3% of global revenue and fines of up to $25 million or 5%;
• require transparency about automated decision-making for significant decisions about individuals.

The same month, the government launched "AI for All", the national AI strategy, which promises new legislation over five years. Until a bill passes, plan against PIPEDA and Law 25.

What should you build into AI systems now?

Five controls cover most of the current and pending requirements.

1. A documented purpose and legal basis for each AI use that touches personal information, written before launch.
2. A privacy impact assessment as a standard step for any new AI system, which Law 25 already requires.
3. Disclosure and human review for AI-influenced decisions about people, including the Ontario job-posting line and a Quebec review route.
4. Data minimization in prompts, retrieval and logs, with deletion dates.
5. Named ownership of AI decisions across legal, privacy, IT and operations.

An AI compliance review for PIPEDA and Law 25 maps these controls to your actual systems. For a first look at where you stand, the AI Readiness Review costs $490 CAD + HST; all fixed-price packages are listed publicly.

Which sectors carry the most exposure?

Sectors that combine sensitive data with high-stakes decisions carry the most risk.

• Healthcare: provincial health privacy laws apply on top of the general framework, and clinical AI touches the most sensitive data.
• Financial services: federally regulated banks fall under PIPEDA for both customer and employee data, and credit or fraud models influence significant decisions.
• Government: federal institutions follow the Privacy Act and the Treasury Board Directive on Automated Decision-Making, which requires an algorithmic impact assessment before an automated decision system goes into production.
• Legal services: client information carries solicitor-client privilege, so data shared with an AI vendor needs a clear contractual and technical boundary.

Sources

• OPC: PIPEDA in brief
• OPC: AI, privacy, and your business
• OPC: Annual report 2024-25
• OPC: PIPEDA Findings #2026-002 (OpenAI)
• Quebec: Act respecting the protection of personal information in the private sector, CQLR c. P-39.1
• CAI: Principaux changements de la Loi 25
• Ontario: Requirements related to publicly advertised job postings (ESA guide)
• LEGISinfo: Bill C-36 (45-1)
• LEGISinfo: Bill C-27 (44-1)
• ISED: Government of Canada introduces legislation to protect Canadians' privacy in the digital age
• Prime Minister: AI for All, Canada's national AI strategy
• TBS: Directive on Automated Decision-Making