Not publishable as-is. 1 of 6 publication_gate checks fail. The renderer displays the gate rather than suppressing it. Legal review and sub-brief approval are informational and are not part of this test.
CA-KAH Data Protection & Privacy Regulation
CA-KAHschema gdpri-v2trajectory: not yet assessedhybrid regimeoverlaps: Sentinel (AML/CFT), World Payments, artificial-intelligence
Last updated · 10 categories · 49
claims · 31 sources in the cumulative register
Summary answer not yet published for this jurisdiction
Data collected · Data published
AI-assembled from cited sources
Not fully checked this cycle: Regulator & Framework, Enforcement & Redress (2 open gaps).
Evidence re-verified:·Position last changed:·Record history & provenance ▾
Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.
Traffic-light mix(sums to 10 rendered categories; click to filter)
Canada federal law that applies in CA-KAH is covered once, on the Canada page. This page covers CA-KAH’s own layer: its own law, regulators and enforcement.
Jurisdiction brief
CA-KAH operates under a hybrid regime supervised by Office of the Privacy Commissioner of Canada (OPC), with 10 regulatory modules assessed in the current cycle.
D1 · Regulator & Framework: A federal backstop (PIPEDA) is clearly in force and well-documented at T1, but the Quebec-overlay question and the KGC's own confidentiality rules for its gaming licensees could not be verified at T1/T2 in this pass, producing real coverage gaps.
D2 · Lawful Processing: Core consent and appropriateness tests are well documented at T1/T3, but there is no binding, codified special-category regime equivalent to GDPR Art.9, which is a structural gap relative to the question set.
D3 · Data Subject Rights: Core access/correction rights are documented, but PIPEDA's federal deadline framework and an explicit restriction/objection right are not clearly codified, producing a genuine coverage gap distinct from Quebec's more concrete regime.
D4 · Controller & Processor: Breach notification, DPO and DPIA duties are well evidenced for the federal and Quebec-overlay tracks, but ROPA exemption tests and joint-controller/processor-contract mandatory terms were not located in this pass.
All 10 module posture summaries
D1 · Regulator & Framework: A federal backstop (PIPEDA) is clearly in force and well-documented at T1, but the Quebec-overlay question and the KGC's own confidentiality rules for its gaming licensees could not be verified at T1/T2 in this pass, producing real coverage gaps.
D2 · Lawful Processing: Core consent and appropriateness tests are well documented at T1/T3, but there is no binding, codified special-category regime equivalent to GDPR Art.9, which is a structural gap relative to the question set.
D3 · Data Subject Rights: Core access/correction rights are documented, but PIPEDA's federal deadline framework and an explicit restriction/objection right are not clearly codified, producing a genuine coverage gap distinct from Quebec's more concrete regime.
D4 · Controller & Processor: Breach notification, DPO and DPIA duties are well evidenced for the federal and Quebec-overlay tracks, but ROPA exemption tests and joint-controller/processor-contract mandatory terms were not located in this pass.
D5 · Cross-Border & Adequacy: The adequacy scope-gap and PIPEDA's accountability-based transfer model are well evidenced; no data-localisation mandate or Kahnawake-specific TIA practice was located.
D6 · Sectoral Watch: Financial-sector and telecoms overlays are documented; health, credit-scoring, education and insurance sectoral rules specific to this JID were not located in this pass.
D7 · AdTech & Marketing: Direct-marketing consent rules under CASL are well evidenced; cookie-specific pinpoint provisions, dark-pattern prohibitions, and opt-out-signal recognition for this JID were not located in this pass.
D8 · AI, Biometrics & Automated: The Quebec ADM-transparency obligation and the PIPEDA no-go-zone doctrine are documented; a federal AI-specific statute is not currently in force, and no biometric-specific statutory condition for this JID was located.
D9 · Children's Privacy: No binding statutory age-of-consent threshold, age-verification mandate, or minor-profiling ban equivalent to GDPR Art.8/DSA Art.28(2) was located for this JID in this pass; the module rests on interpretive guidance only.
D10 · Enforcement & Redress: Penalty structures, recent enforcement actions, and pending reform are all well evidenced at T1; procedural deadlines, appeal time limits, and a Kahnawake-specific enforcement record are not established in this pass.
Key regulatory facts for CA-KAH
Regulatory Dimension
CA-KAH Standing Position
Jurisdiction
CA-KAH (CA-KAH)
Regulatory Scope
Data Protection & Privacy Regulation (10 modules, 49 sourced findings)
Regulator & Framework
A federal backstop (PIPEDA) is clearly in force and well-documented at T1, but the Quebec-overlay question and the KGC's own confidentiality rules for its gaming licensees could not be verified at T1/T2 in this pass,...
Lawful Processing & Special Data
Core consent and appropriateness tests are well documented at T1/T3, but there is no binding, codified special-category regime equivalent to GDPR Art.9, which is a structural gap relative to the question set.
Data Subject Rights
Core access/correction rights are documented, but PIPEDA's federal deadline framework and an explicit restriction/objection right are not clearly codified, producing a genuine coverage gap distinct from Quebec's more...
Controller/Processor Duties
Breach notification, DPO and DPIA duties are well evidenced for the federal and Quebec-overlay tracks, but ROPA exemption tests and joint-controller/processor-contract mandatory terms were not located in this pass.
Primary Instruments Cited
IAPP, Mohawk Council of Kahnawake, OPC, DataGuidance/OneTrust, OPC
Last Confirmed / Updated
2026-10-25 (31 sources in cumulative register)
10 of 10 categories
Signal
Density
Selections OR within a group, AND across groups. Press / to search.
A federal backstop (PIPEDA) is clearly in force and well-documented at T1, but the Quebec-overlay question and the KGC's own confidentiality rules for its gaming licensees could not be verified at T1/T2 in this pass, producing real coverage gaps.
Primary frameworkPersonal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c.5
Traffic-light rationale — AmberA federal backstop (PIPEDA) is clearly in force and well-documented at T1, but the Quebec-overlay question and the KGC's own confidentiality rules for its gaming licensees could not be verified at T1/T2 in this pass, producing real coverage gaps.
Sub-modules (5)
Regulator And AuthorityAmber
OPC enforces PIPEDA federally; the Kahnawake Gaming Commission is a sectoral licensing authority for the territory's online-gambling industry, not a general-purpose DP regulator.
Claims (3):
The Office of the Privacy Commissioner of Canada administers and investigates complaints under PIPEDA but operates largely as an ombudsman, lacking a general order-making power equivalent to a GDPR-style DPA.
The Kahnawake Gaming Commission, established by the Mohawk Council of Kahnawake, licenses and regulates online-gambling operators domiciled in the territory and imposes confidentiality/data-security conditions on licensees as a matter of licensing practice; the pinpoint provision of its enabling gaming law could not be verified against a live source in this research pass.
Personal Information Protection and Electronic Documents Act (PIPEDA) — PIPEDA applies to organizations/activities within federal jurisdiction engaged in commercial activities; FNIGC analysis states this extends to First Nations governments, organisations and businesses engaged in commercial activity.
Act And InstrumentsAmber
PIPEDA is the operative federal instrument; Quebec's amended Private Sector Act is the provincial 'substantially similar' instrument whose application on reserve land is unresolved; the federal CPPA/AIDA reform package (Bill C-27) died on the order paper.
Claims (3):
PIPEDA (S.C. 2000, c.5), the federal private-sector privacy law, sets ground rules for how private-sector organizations handle personal information in the course of commercial activity across Canada.
Quebec's Act Respecting the Protection of Personal Information in the Private Sector (CQLR c P-39.1), as amended by the 2021 'Law 25'/Bill 64, has been recognized as substantially similar to PIPEDA and displaces PIPEDA for commercial activity carried on in Quebec; whether this provincial statute binds private enterprises operating on Kahnawake reserve land (federal jurisdiction under s.91(24)) is an open question not resolved in any source reviewed.
Bill C-27 (Digital Charter Implementation Act, 2022), which would have replaced PIPEDA with the Consumer Privacy Protection Act and enacted the Artificial Intelligence and Data Act, died on the order paper when Parliament was prorogued in January 2025 and has not been re-enacted in that form.
Material ScopeGreen
PIPEDA covers personal information collected, used or disclosed in the course of commercial activity, plus employee data of federally-regulated businesses.
Claims (1):
PIPEDA applies to the collection, use and disclosure of personal information by private-sector organizations in the course of commercial activity, and also to the employee personal information of federally-regulated businesses such as banks, airlines and telecommunications companies.
Territorial ScopeGreen
PIPEDA is not intended to apply extraterritorially but does reach foreign entities that receive or transmit communications to/from Canada and collect or disclose personal information about individuals in Canada.
Claims (1):
PIPEDA was not intended to apply extraterritorially, but the Federal Court has held it can still cover foreign entities that receive or transmit communications to and from Canada and that collect and disclose personal information about individuals in Canada.
Regulator Registration And FilingAmber
Neither PIPEDA nor Quebec's Private Sector Act impose a GDPR-style general registration/notification-of-processing duty; Quebec's amended Act does require notice to the CAI on creation of a biometric database.
Claims (1):
Quebec's amended Private Sector Act requires notification to the Commission d'acces a l'information (CAI) upon the creation of a biometric database, a duty phased in alongside Law 25's other obligations from 2022.
Category narrative185 words
CA-KAH (Kahnawake Mohawk Territory) presents an unusual compound regulatory picture: there is no single comprehensive 'Kahnawake privacy statute.' The federal Personal Information Protection and Electronic Documents Act (PIPEDA) is the national private-sector backstop, overseen by the Office of the Privacy Commissioner of Canada (OPC). Geographically, Kahnawake sits within Quebec, whose amended Act Respecting the Protection of Personal Information in the Private Sector ('Law 25'/Bill 64) has been deemed substantially similar to PIPEDA for organizations carrying on enterprise in Quebec -- but Kahnawake is federal reserve land under s.91(24) of the Constitution Act, 1867, and whether a provincial privacy statute binds enterprises operating on reserve land is a genuinely unresolved constitutional question not settled in the material reviewed. Layered on top is the Kahnawake Gaming Commission (KGC), the Mohawk Council of Kahnawake's sectoral licensing body for the territory's large online-gambling licensee base, which imposes confidentiality/security conditions on licensees as a matter of licensing practice rather than through a published general-application data-protection code. No seed anchors were injected for this JID, so KGC primary-instrument text could not be verified against a live, allow-listed source in this pass.
Sources and claims (9)
ConfirmedIAPP — The Office of the Privacy Commissioner of Canada administers and investigates complaints under PIPEDA but operates largely as an ombudsman, lacking a general order-making power equivalent to a GDPR-style DPA.observed
Uncertain Mohawk Council of Kahnawake — The Kahnawake Gaming Commission, established by the Mohawk Council of Kahnawake, licenses and regulates online-gambling operators domiciled in the territory and imposes confidentiality/data-security conditions on licensees as a matter of licensing practice; the pinpoint provision of its enabling gaming law could not be verified against a live source in this research pass.observed
ConfirmedOPC — PIPEDA (S.C. 2000, c.5), the federal private-sector privacy law, sets ground rules for how private-sector organizations handle personal information in the course of commercial activity across Canada.observed
UncertainDataGuidance/OneTrust — Quebec's Act Respecting the Protection of Personal Information in the Private Sector (CQLR c P-39.1), as amended by the 2021 'Law 25'/Bill 64, has been recognized as substantially similar to PIPEDA and displaces PIPEDA for commercial activity carried on in Quebec; whether this provincial statute binds private enterprises operating on Kahnawake reserve land (federal jurisdiction under s.91(24)) is an open question not resolved in any source reviewed.observed
ConfirmedOPC — Bill C-27 (Digital Charter Implementation Act, 2022), which would have replaced PIPEDA with the Consumer Privacy Protection Act and enacted the Artificial Intelligence and Data Act, died on the order paper when Parliament was prorogued in January 2025 and has not been re-enacted in that form.observed
ConfirmedOPC — PIPEDA applies to the collection, use and disclosure of personal information by private-sector organizations in the course of commercial activity, and also to the employee personal information of federally-regulated businesses such as banks, airlines and telecommunications companies.observed
ConfirmedOPC — PIPEDA was not intended to apply extraterritorially, but the Federal Court has held it can still cover foreign entities that receive or transmit communications to and from Canada and that collect and disclose personal information about individuals in Canada.observed
ProbableDataGuidance/OneTrust — Quebec's amended Private Sector Act requires notification to the Commission d'acces a l'information (CAI) upon the creation of a biometric database, a duty phased in alongside Law 25's other obligations from 2022.observed
ProbableFirst Nations Information Governance Centre — Personal Information Protection and Electronic Documents Act (PIPEDA) — PIPEDA applies to organizations/activities within federal jurisdiction engaged in commercial activities; FNIGC analysis states this extends to First Nations governments, organisations and businesses engaged in commercial activity.observed
Core consent and appropriateness tests are well documented at T1/T3, but there is no binding, codified special-category regime equivalent to GDPR Art.9, which is a structural gap relative to the question set.
Primary frameworkPIPEDA Schedule 1 (CSA Model Code) and Quebec Private Sector Act as amended by Law 25
Traffic-light rationale — AmberCore consent and appropriateness tests are well documented at T1/T3, but there is no binding, codified special-category regime equivalent to GDPR Art.9, which is a structural gap relative to the question set.
D2 · Lawful Processing — Full Module Record4 sub-modules · 62 words · 5 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Core access/correction rights are documented, but PIPEDA's federal deadline framework and an explicit restriction/objection right are not clearly codified, producing a genuine coverage gap distinct from Quebec's more concrete regime.
Primary frameworkPIPEDA Schedule 1 and Quebec Private Sector Act as amended by Law 25
Traffic-light rationale — AmberCore access/correction rights are documented, but PIPEDA's federal deadline framework and an explicit restriction/objection right are not clearly codified, producing a genuine coverage gap distinct from Quebec's more concrete regime.
Sub-modules (5)
Access RightGreen
PIPEDA Principle 9 (Individual Access) gives people the right to access personal information held about them and challenge its accuracy.
Claims (1):
Under PIPEDA's Schedule 1 fair information principles, people have the right to access their personal information held by an organization and to challenge its accuracy.
Rectification And ErasureAmber
Law 25 introduced a data-portability right and a 'right to be forgotten'-style capability effective in the September 2022 tranche.
Claims (1):
Since Quebec's Law 25 data-privacy requirements entered into force on 22 September 2023, organizations must conduct privacy impact assessments before adopting processing technology and individuals gained an added 'right to be forgotten.'
Restriction And ObjectionRed
No PIPEDA-specific restriction/objection right distinct from consent withdrawal was located in this pass.
Data PortabilityAmber
Quebec's amended Act introduced a data-portability right (Section 3.3 per commentary); the federal equivalent is still only proposed via Bill C-15's data-mobility provisions.
Claims (1):
A federal right to data mobility, allowing individuals to direct disclosure of personal information between organizations subject to a prescribed data-mobility framework, is only proposed (via Bill C-15's new PIPEDA Division 1.2) and not yet in force.
Deadlines And Response WindowsGreen
Quebec's Private Sector Act requires a response to an individual rights request within 30 days.
Claims (1):
Quebec's Private Sector Act (Section 32) requires that an individual rights request be addressed within 30 days.
Category narrative52 words
PIPEDA's Schedule 1 gives individuals rights of access and to challenge accuracy, without a fixed statutory response deadline in the federal Act itself. Quebec's Private Sector Act imposes a concrete 30-day response window and, via Law 25, added a data-portability right and a 'right to be forgotten'-style de-indexing capability from September 2022.
Sources and claims (4)
ConfirmedOPC — Under PIPEDA's Schedule 1 fair information principles, people have the right to access their personal information held by an organization and to challenge its accuracy.observed
ProbableIAPP — Since Quebec's Law 25 data-privacy requirements entered into force on 22 September 2023, organizations must conduct privacy impact assessments before adopting processing technology and individuals gained an added 'right to be forgotten.'observed
ConfirmedOPC — A federal right to data mobility, allowing individuals to direct disclosure of personal information between organizations subject to a prescribed data-mobility framework, is only proposed (via Bill C-15's new PIPEDA Division 1.2) and not yet in force.observed
ProbableIAPP — Quebec's Private Sector Act (Section 32) requires that an individual rights request be addressed within 30 days.observed
Breach notification, DPO and DPIA duties are well evidenced for the federal and Quebec-overlay tracks, but ROPA exemption tests and joint-controller/processor-contract mandatory terms were not located in this pass.
Primary frameworkPIPEDA (Digital Privacy Act amendments) and Quebec Private Sector Act as amended by Law 25
Traffic-light rationale — AmberBreach notification, DPO and DPIA duties are well evidenced for the federal and Quebec-overlay tracks, but ROPA exemption tests and joint-controller/processor-contract mandatory terms were not located in this pass.
D4 · Controller & Processor — Full Module Record7 sub-modules · 73 words · 7 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
The adequacy scope-gap and PIPEDA's accountability-based transfer model are well evidenced; no data-localisation mandate or Kahnawake-specific TIA practice was located.
Primary frameworkPIPEDA Schedule 1 Principle 1 (accountability) and European Commission Decision 2002/2/EC
Traffic-light rationale — AmberThe adequacy scope-gap and PIPEDA's accountability-based transfer model are well evidenced; no data-localisation mandate or Kahnawake-specific TIA practice was located.
D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 77 words · 3 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Financial-sector and telecoms overlays are documented; health, credit-scoring, education and insurance sectoral rules specific to this JID were not located in this pass.
Primary frameworkPIPEDA plus sector-specific federal statutes (CASL, Consumer-Driven Banking Act)
Traffic-light rationale — AmberFinancial-sector and telecoms overlays are documented; health, credit-scoring, education and insurance sectoral rules specific to this JID were not located in this pass.
D6 · Sectoral Watch — Full Module Record8 sub-modules · 99 words · 5 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Direct-marketing consent rules under CASL are well evidenced; cookie-specific pinpoint provisions, dark-pattern prohibitions, and opt-out-signal recognition for this JID were not located in this pass.
Primary frameworkPIPEDA (general consent principle) and Canada's Anti-Spam Legislation (CASL)
Traffic-light rationale — AmberDirect-marketing consent rules under CASL are well evidenced; cookie-specific pinpoint provisions, dark-pattern prohibitions, and opt-out-signal recognition for this JID were not located in this pass.
D7 · AdTech & Marketing — Full Module Record6 sub-modules · 48 words · 2 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
The Quebec ADM-transparency obligation and the PIPEDA no-go-zone doctrine are documented; a federal AI-specific statute is not currently in force, and no biometric-specific statutory condition for this JID was located.
Primary frameworkPIPEDA s.5(3) and Quebec Private Sector Act as amended by Law 25
Traffic-light rationale — AmberThe Quebec ADM-transparency obligation and the PIPEDA no-go-zone doctrine are documented; a federal AI-specific statute is not currently in force, and no biometric-specific statutory condition for this JID was located.
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
No binding statutory age-of-consent threshold, age-verification mandate, or minor-profiling ban equivalent to GDPR Art.8/DSA Art.28(2) was located for this JID in this pass; the module rests on interpretive guidance only.
Traffic-light rationale — RedNo binding statutory age-of-consent threshold, age-verification mandate, or minor-profiling ban equivalent to GDPR Art.8/DSA Art.28(2) was located for this JID in this pass; the module rests on interpretive guidance only.
D9 · Children's Privacy — Full Module Record5 sub-modules · 60 words · 1 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Penalty structures, recent enforcement actions, and pending reform are all well evidenced at T1; procedural deadlines, appeal time limits, and a Kahnawake-specific enforcement record are not established in this pass.
Primary frameworkPIPEDA and Quebec Private Sector Act as amended by Law 25
Traffic-light rationale — AmberPenalty structures, recent enforcement actions, and pending reform are all well evidenced at T1; procedural deadlines, appeal time limits, and a Kahnawake-specific enforcement record are not established in this pass.
D10 · Enforcement & Redress — Full Module Record6 sub-modules · 135 words · 9 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Filters combine as OR inside a group and AND across
groups.
Provenance and declared absence
Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.
Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.
Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.
Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.
Suppressed by doctrine: derived risk score. Not shown on this page.
Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.
Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 58 sub-module(s), 49 claim(s) (49 category placement(s)), 31 source(s) in the cumulative register.
Audit trail
Machine checkChallenged on 3 Nov 2026: upheld (3 confirmed against the cited source). An automated, adversarial test run by a second model; no person has assessed the result.
CA-KAH