PIPA is the Personal Information Protection Act, the name of both Alberta's and British Columbia's private-sector privacy laws, and PIPEDA is Canada's federal law, the Personal Information Protection and Electronic Documents Act. The two PIPAs and Quebec's private sector act are deemed "substantially similar" to PIPEDA, so in those provinces the provincial law, not PIPEDA, governs personal information collected, used and disclosed entirely within the province. PIPEDA still applies to federally regulated businesses and to personal information that crosses provincial or national borders.
Getting this wrong has consequences. An organisation that assumes PIPEDA covers everything may find a provincial commissioner has jurisdiction over a complaint, or that a data flow it treated as local brings federal rules back in.
What "substantially similar" means
Section 26(2)(b) of PIPEDA lets the Governor in Council exempt organisations from the federal law where a province has passed legislation substantially similar to it. According to the Office of the Privacy Commissioner of Canada (OPC), a provincial law qualifies if it provides equal privacy protection, contains PIPEDA's ten fair information principles, provides independent oversight and redress with the power to investigate, and allows personal information to be collected, used and disclosed only for appropriate or legitimate purposes.
Substantially similar does not mean identical. The laws differ in scope, enforcement powers and specific obligations. Three general private-sector laws hold the designation:
| Province | Law | Oversight body | Substantially similar since |
|---|---|---|---|
| Alberta | Personal Information Protection Act (PIPA) | Office of the Information and Privacy Commissioner of Alberta | 2004 |
| British Columbia | Personal Information Protection Act (PIPA) | Office of the Information and Privacy Commissioner for British Columbia | 2004 |
| Quebec | Act respecting the protection of personal information in the private sector (as amended by Law 25) | Commission d'accès à l'information du Québec (CAI) | 2003 |
Four provincial health information laws, in New Brunswick, Newfoundland and Labrador, Nova Scotia and Ontario, are also substantially similar, but only for personal health information. They do not replace PIPEDA for general commercial activity.
PIPA vs PIPEDA: the main differences
What is the difference between PIPA and PIPEDA? PIPA is provincial and covers private-sector organisations inside Alberta or British Columbia, including their employee data. PIPEDA is federal, covers commercial activity everywhere else and every cross-border flow, and reaches employee data only in federally regulated businesses.
| Area | Alberta and BC PIPA | PIPEDA |
|---|---|---|
| Who it covers | Provincially regulated private-sector organisations within the province | Commercial activity in the other provinces and territories, cross-border flows and federally regulated businesses everywhere |
| Employee information | Covered for provincially regulated employers | Covered only for federally regulated employers |
| Oversight | The provincial Information and Privacy Commissioner | The Privacy Commissioner of Canada |
| Binding orders | The provincial commissioner can issue orders | The OPC makes findings and recommendations, and can apply to the Federal Court |
| Consent | Express or implied depending on context and sensitivity | Express or implied depending on sensitivity and reasonable expectations |
When provincial law applies instead of PIPEDA
If your organisation is provincially regulated and operates in Alberta, British Columbia or Quebec, the provincial law governs personal information handled entirely within that province. A Calgary retailer handling only Alberta customers' data follows Alberta's PIPA, and a Vancouver software company processing data only within BC follows BC's PIPA. A Montreal consultancy serving Quebec clients follows Quebec's private sector act.
Two kinds of activity bring PIPEDA back, wherever the organisation sits.
Federal works, undertakings and businesses
Banks, airlines and other transportation companies, telecommunications companies and other federally regulated businesses always fall under PIPEDA, even inside Alberta, BC or Quebec. PIPEDA also applies in the Northwest Territories, Yukon and Nunavut, where organisations are treated as federally regulated.
Contractors can be caught too. The OPC's example is a BC counselling company that provides an employee assistance programme to an airline: its contract obliges it to follow PIPEDA, and PIPEDA's consent requirements apply to the airline employees' data.
Data that crosses borders
Personal information transferred across provincial or national borders in the course of commercial activity falls under PIPEDA. A BC company selling a mailing list to an Ontario firm, or an Alberta business using a credit bureau in another province, must follow PIPEDA for those transactions. Many organisations in Alberta, BC and Quebec therefore follow both laws: the provincial one for local activity and PIPEDA for anything that leaves the province.
Which Canadian privacy law applies
Alberta's PIPA
Alberta's Personal Information Protection Act came into force on 1 January 2004. It applies to provincially regulated private-sector organisations in Alberta, including non-profits when they carry out commercial activity, and unlike PIPEDA it governs employee information held by provincially regulated employers.
The law has been under review. A committee of the Alberta legislature reported in 2025 with recommendations that include specific protections for minors' information, administrative monetary penalties for the commissioner and anonymisation standards, and a 2025 court decision on PIPA's exception for publicly available information added pressure for change. Check the Alberta legislature for the current status of any amending bill before relying on new rules.
British Columbia's PIPA
BC's Personal Information Protection Act also took effect in 2004 and closely mirrors Alberta's in structure. It covers provincially regulated private-sector organisations and their employee information.
A special committee of the BC legislature recommended a broad modernisation in December 2021. Enforcement remains complaint-driven: the BC commissioner investigates, issues orders and reports publicly, without administrative monetary penalties.
Quebec's Law 25: the strictest regime
Quebec was the first province with a private-sector privacy law, and Law 25, adopted in 2021, has made it the most demanding in Canada. Its changes came into force in stages from 2022 to September 2024.
According to the CAI's summary of Law 25, it requires a privacy impact assessment before personal information leaves Quebec, parental consent to collect information from a minor under 14, and tracking technologies that identify, locate or profile a person to be off until the person turns them on. Other provisions add a person in charge of privacy, notice of confidentiality incidents and duties around privacy impact assessments for new systems. The CAI can impose administrative penalties of up to CAD 10 million or 2% of worldwide turnover, and the act also provides for penal fines.
Where no substantially similar law exists
Ontario, Manitoba, Saskatchewan, New Brunswick, Nova Scotia, Prince Edward Island and Newfoundland and Labrador have no general private-sector law deemed substantially similar, and the territories are treated as federally regulated. In all of them PIPEDA applies directly to commercial activity. Health information laws and public-sector access laws in those provinces do not replace it for commercial data.
Cookie consent under provincial and federal rules
For websites, the layered system raises one practical question: what consent do your cookies need, and for whom? The detail is in PIPEDA cookie consent.
Under PIPEDA, the form of consent depends on sensitivity and reasonable expectations. The OPC accepts implied, opt-out consent for less sensitive tracking when the purpose is clear and the opt-out is easy, immediate and persistent, and expects express consent for sensitive information, children and uses people would not expect.
Quebec is stricter. Tracking technologies that can identify, locate or profile someone must stay off until the person turns them on, which is close to the opt-in model of the EU's ePrivacy Directive. Alberta's and BC's PIPAs follow a consent model closer to PIPEDA's, with express or implied consent depending on context, and neither sets a banner design.
So if your site has visitors in Quebec, build their consent around Law 25's default-off rule. Geo-targeting can show Quebec visitors an opt-in banner while the rest of Canada sees the model you choose, or you can apply opt-in to every Canadian visitor and run one flow. The privacy laws by region overview compares Canada with other countries.
Bill C-36 would reopen the exemption orders
Bill C-27, which would have replaced Part 1 of PIPEDA with the Consumer Privacy Protection Act, died in January 2025. The new attempt is Bill C-36, which would enact the Protecting Privacy and Consumer Data Act and repeal Part 1 of PIPEDA. It was introduced on 15 June 2026 and, as of October 2026, is at second reading.
This matters for substantially similar laws because the existing exemption orders were made under PIPEDA. If C-36 passes, the provincial laws would need to be recognised again under the new Act. Until then, organisations in Alberta, BC and Quebec keep working under the current dual system. The reform guide follows the bill's progress.
Joint investigations across jurisdictions
Federal and provincial commissioners increasingly investigate together. The OPC, the CAI and the Alberta and BC commissioners issued joint findings on TikTok on 23 September 2025 (PIPEDA Findings #2025-003) and on OpenAI on 6 May 2026 (PIPEDA Findings #2026-002). For a business active across Canada, one investigation can therefore apply several laws at once.
Questions about PIPA, PIPEDA and provincial laws
Does PIPEDA apply in Quebec, Alberta, or British Columbia?
Not to provincially regulated organisations for activity entirely within those provinces. PIPEDA still applies there to federally regulated businesses such as banks and telecom companies, and to personal information that crosses provincial or national borders in commercial activity.
What makes a provincial privacy law "substantially similar" to PIPEDA?
According to the OPC, the law must provide equal protection, contain PIPEDA's ten fair information principles, provide independent oversight with the power to investigate, and allow personal information to be used only for appropriate or legitimate purposes.
Do I need a cookie banner if my website only targets visitors in Alberta or BC?
Alberta's and BC's PIPAs require consent before personal information is collected, including through cookies, with express or implied consent depending on context. Neither sets a banner format, but a clear consent mechanism is the practical way to meet the rule, and any visitors from Quebec need tracking off until they turn it on.
How does Quebec Law 25 differ from PIPEDA on cookie consent?
Law 25 requires tracking technologies that identify, locate or profile a person to be off until the person turns them on. PIPEDA allows implied consent for less sensitive cookie uses when the purpose is clear and an easy, immediate opt-out is available.
Will Bill C-36 change the substantially similar framework?
Indirectly. Bill C-36, introduced on 15 June 2026, would repeal Part 1 of PIPEDA, and the existing exemption orders refer to PIPEDA, so provincial laws would need to be recognised again under the new Act if it passes.
Can provincial privacy commissioners investigate organisations based in other provinces?
Provincial commissioners have jurisdiction over activity in their province, and they increasingly investigate with the OPC, as in the joint findings on TikTok (September 2025) and OpenAI (May 2026).
Which Canadian province has the strictest privacy law?
Quebec. Law 25 requires privacy impact assessments, parental consent for minors under 14, tracking off by default and administrative penalties of up to CAD 10 million or 2% of worldwide turnover.
Show Quebec visitors the banner Law 25 calls for
Kukie.io lets you set region rules per site, including one for Quebec, so visitors there get opt-in with tracking off until they choose while the rest of Canada sees the model you pick. Every choice is stored as a consent record.
