--- title: "CA-KAH Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/ca-kah-data-protection-privacy-regulation/ source_html: /jurisdictions/canada-kahnawake/index.html description: "CA-KAH data protection and privacy regulation: 10 categories, 49 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 3a0185920c21c152adec986c9ab8b0c75377c6a2c317c3f088a9329d7fa616a6 generator: "fe-fleet/md-twin@1.0" --- # CA-KAH Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed hybrid regime overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/canada-kahnawake/), [World Payments](https://payments.gi/jurisdictions/canada-kahnawake/), artificial-intelligence Last updated 2026-10-25 · 10 categories · 49 claims · 31 sources in the cumulative register Download report (PDF) Expand all Summary answer not yet published for this jurisdiction Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not fully checked this cycle: Regulator & Framework, Enforcement & Redress (2 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=CANADA-KAHNAWAKE)[Build Report](/reports/?j=CANADA-KAHNAWAKE)[Compare](/compare/?j=CANADA-KAHNAWAKE) Framework posture Hybrid regime 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Office of the Privacy Commissioner of Canada (OPC) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 9 Probable · 1 Uncertain 10 Categories 1 Red categories 58 Sub-modules 49 Claims 18 Tier-1 sources Traffic-light mix 9 amber 1 red (sums to 10 rendered categories; click to filter) 1 category flagged red Canada federal law that applies in CA-KAH is covered once, on the [Canada](/jurisdictions/canada/) page. This page covers CA-KAH’s own layer: its own law, regulators and enforcement. ## Jurisdiction brief Standing operating brief 313 words CA-KAH operates under a hybrid regime supervised by Office of the Privacy Commissioner of Canada (OPC) , with 10 regulatory modules assessed in the current cycle. - D1 · Regulator & Framework: A federal backstop (PIPEDA) is clearly in force and well-documented at T1, but the Quebec-overlay question and the KGC's own confidentiality rules for its gaming licensees could not be verified at T1/T2 in this pass, producing real coverage gaps. - D2 · Lawful Processing: Core consent and appropriateness tests are well documented at T1/T3, but there is no binding, codified special-category regime equivalent to GDPR Art.9, which is a structural gap relative to the question set. - D3 · Data Subject Rights: Core access/correction rights are documented, but PIPEDA's federal deadline framework and an explicit restriction/objection right are not clearly codified, producing a genuine coverage gap distinct from Quebec's more concrete regime. - D4 · Controller & Processor: Breach notification, DPO and DPIA duties are well evidenced for the federal and Quebec-overlay tracks, but ROPA exemption tests and joint-controller/processor-contract mandatory terms were not located in this pass. All 10 module posture summaries - D1 · Regulator & Framework: A federal backstop (PIPEDA) is clearly in force and well-documented at T1, but the Quebec-overlay question and the KGC's own confidentiality rules for its gaming licensees could not be verified at T1/T2 in this pass, producing real coverage gaps. - D2 · Lawful Processing: Core consent and appropriateness tests are well documented at T1/T3, but there is no binding, codified special-category regime equivalent to GDPR Art.9, which is a structural gap relative to the question set. - D3 · Data Subject Rights: Core access/correction rights are documented, but PIPEDA's federal deadline framework and an explicit restriction/objection right are not clearly codified, producing a genuine coverage gap distinct from Quebec's more concrete regime. - D4 · Controller & Processor: Breach notification, DPO and DPIA duties are well evidenced for the federal and Quebec-overlay tracks, but ROPA exemption tests and joint-controller/processor-contract mandatory terms were not located in this pass. - D5 · Cross-Border & Adequacy: The adequacy scope-gap and PIPEDA's accountability-based transfer model are well evidenced; no data-localisation mandate or Kahnawake-specific TIA practice was located. - D6 · Sectoral Watch: Financial-sector and telecoms overlays are documented; health, credit-scoring, education and insurance sectoral rules specific to this JID were not located in this pass. - D7 · AdTech & Marketing: Direct-marketing consent rules under CASL are well evidenced; cookie-specific pinpoint provisions, dark-pattern prohibitions, and opt-out-signal recognition for this JID were not located in this pass. - D8 · AI, Biometrics & Automated: The Quebec ADM-transparency obligation and the PIPEDA no-go-zone doctrine are documented; a federal AI-specific statute is not currently in force, and no biometric-specific statutory condition for this JID was located. - D9 · Children's Privacy: No binding statutory age-of-consent threshold, age-verification mandate, or minor-profiling ban equivalent to GDPR Art.8/DSA Art.28(2) was located for this JID in this pass; the module rests on interpretive guidance only. - D10 · Enforcement & Redress: Penalty structures, recent enforcement actions, and pending reform are all well evidenced at T1; procedural deadlines, appeal time limits, and a Kahnawake-specific enforcement record are not established in this pass. Key regulatory facts for CA-KAH Regulatory Dimension CA-KAH Standing Position Jurisdiction CA-KAH (CA-KAH) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 49 sourced findings) Regulator & Framework A federal backstop (PIPEDA) is clearly in force and well-documented at T1, but the Quebec-overlay question and the KGC's own confidentiality rules for its gaming licensees could not be verified at T1/T2 in this pass,... Lawful Processing & Special Data Core consent and appropriateness tests are well documented at T1/T3, but there is no binding, codified special-category regime equivalent to GDPR Art.9, which is a structural gap relative to the question set. Data Subject Rights Core access/correction rights are documented, but PIPEDA's federal deadline framework and an explicit restriction/objection right are not clearly codified, producing a genuine coverage gap distinct from Quebec's more... Controller/Processor Duties Breach notification, DPO and DPIA duties are well evidenced for the federal and Quebec-overlay tracks, but ROPA exemption tests and joint-controller/processor-contract mandatory terms were not located in this pass. Primary Instruments Cited IAPP, Mohawk Council of Kahnawake, OPC, DataGuidance/OneTrust, OPC Last Confirmed / Updated 2026-10-25 (31 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### CA-KAH: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A federal backstop (PIPEDA) is clearly in force and well-documented at T1, but the Quebec-overlay question and the KGC's own confidentiality rules for its gaming licensees could not be verified at T1/T2 in this pass, producing real coverage gaps. Primary framework Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c.5 Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Amber A federal backstop (PIPEDA) is clearly in force and well-documented at T1, but the Quebec-overlay question and the KGC's own confidentiality rules for its gaming licensees could not be verified at T1/T2 in this pass, producing real coverage gaps. #### Sub-modules (5) #### Regulator And AuthorityAmber OPC enforces PIPEDA federally; the Kahnawake Gaming Commission is a sectoral licensing authority for the territory's online-gambling industry, not a general-purpose DP regulator. Claims (3): - The Office of the Privacy Commissioner of Canada administers and investigates complaints under PIPEDA but operates largely as an ombudsman, lacking a general order-making power equivalent to a GDPR-style DPA. - The Kahnawake Gaming Commission, established by the Mohawk Council of Kahnawake, licenses and regulates online-gambling operators domiciled in the territory and imposes confidentiality/data-security conditions on licensees as a matter of licensing practice; the pinpoint provision of its enabling gaming law could not be verified against a live source in this research pass. - Personal Information Protection and Electronic Documents Act (PIPEDA) — PIPEDA applies to organizations/activities within federal jurisdiction engaged in commercial activities; FNIGC analysis states this extends to First Nations governments, organisations and businesses engaged in commercial activity. #### Act And InstrumentsAmber PIPEDA is the operative federal instrument; Quebec's amended Private Sector Act is the provincial 'substantially similar' instrument whose application on reserve land is unresolved; the federal CPPA/AIDA reform package (Bill C-27) died on the order paper. Claims (3): - PIPEDA (S.C. 2000, c.5), the federal private-sector privacy law, sets ground rules for how private-sector organizations handle personal information in the course of commercial activity across Canada. - Quebec's Act Respecting the Protection of Personal Information in the Private Sector (CQLR c P-39.1), as amended by the 2021 'Law 25'/Bill 64, has been recognized as substantially similar to PIPEDA and displaces PIPEDA for commercial activity carried on in Quebec; whether this provincial statute binds private enterprises operating on Kahnawake reserve land (federal jurisdiction under s.91(24)) is an open question not resolved in any source reviewed. - Bill C-27 (Digital Charter Implementation Act, 2022), which would have replaced PIPEDA with the Consumer Privacy Protection Act and enacted the Artificial Intelligence and Data Act, died on the order paper when Parliament was prorogued in January 2025 and has not been re-enacted in that form. #### Material ScopeGreen PIPEDA covers personal information collected, used or disclosed in the course of commercial activity, plus employee data of federally-regulated businesses. Claims (1): - PIPEDA applies to the collection, use and disclosure of personal information by private-sector organizations in the course of commercial activity, and also to the employee personal information of federally-regulated businesses such as banks, airlines and telecommunications companies. #### Territorial ScopeGreen PIPEDA is not intended to apply extraterritorially but does reach foreign entities that receive or transmit communications to/from Canada and collect or disclose personal information about individuals in Canada. Claims (1): - PIPEDA was not intended to apply extraterritorially, but the Federal Court has held it can still cover foreign entities that receive or transmit communications to and from Canada and that collect and disclose personal information about individuals in Canada. #### Regulator Registration And FilingAmber Neither PIPEDA nor Quebec's Private Sector Act impose a GDPR-style general registration/notification-of-processing duty; Quebec's amended Act does require notice to the CAI on creation of a biometric database. Claims (1): - Quebec's amended Private Sector Act requires notification to the Commission d'acces a l'information (CAI) upon the creation of a biometric database, a duty phased in alongside Law 25's other obligations from 2022. CA-KAH (Kahnawake Mohawk Territory) presents an unusual compound regulatory picture: there is no single comprehensive 'Kahnawake privacy statute.' The federal Personal Information Protection and Electronic Documents Act (PIPEDA) is the national private-sector backstop, overseen by the Office of the Privacy Commissioner of Canada (OPC). Geographically, Kahnawake sits within Quebec, whose amended Act Respecting the Protection of Personal Information in the Private Sector ('Law 25'/Bill 64) has been deemed substantially similar to PIPEDA for organizations carrying on enterprise in Quebec -- but Kahnawake is federal reserve land under s.91(24) of the Constitution Act, 1867, and whether a provincial privacy statute binds enterprises operating on reserve land is a genuinely unresolved constitutional question not settled in the material reviewed. Layered on top is the Kahnawake Gaming Commission (KGC), the Mohawk Council of Kahnawake's sectoral licensing body for the territory's large online-gambling licensee base, which imposes confidentiality/security conditions on licensees as a matter of licensing practice rather than through a published general-application data-protection code. No seed anchors were injected for this JID, so KGC primary-instrument text could not be verified against a live, allow-listed source in this pass. Sources and claims (9) - [IAPP](https://iapp.org/news/a/federal-privacy-reform-in-canada-the-consumer-privacy-protection-act) — The Office of the Privacy Commissioner of Canada administers and investigates complaints under PIPEDA but operates largely as an ombudsman, lacking a general order-making power equivalent to a GDPR-style DPA. - Mohawk Council of Kahnawake — The Kahnawake Gaming Commission, established by the Mohawk Council of Kahnawake, licenses and regulates online-gambling operators domiciled in the territory and imposes confidentiality/data-security conditions on licensees as a matter of licensing practice; the pinpoint provision of its enabling gaming law could not be verified against a live source in this research pass. - [OPC](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/) — PIPEDA (S.C. 2000, c.5), the federal private-sector privacy law, sets ground rules for how private-sector organizations handle personal information in the course of commercial activity across Canada. - [DataGuidance/OneTrust](https://www.dataguidance.com/jurisdiction/quebec) — Quebec's Act Respecting the Protection of Personal Information in the Private Sector (CQLR c P-39.1), as amended by the 2021 'Law 25'/Bill 64, has been recognized as substantially similar to PIPEDA and displaces PIPEDA for commercial activity carried on in Quebec; whether this provincial statute binds private enterprises operating on Kahnawake reserve land (federal jurisdiction under s.91(24)) is an open question not resolved in any source reviewed. - [OPC](https://www.priv.gc.ca/en/opc-actions-and-decisions/ar_index/202425/ar_202425/) — Bill C-27 (Digital Charter Implementation Act, 2022), which would have replaced PIPEDA with the Consumer Privacy Protection Act and enacted the Artificial Intelligence and Data Act, died on the order paper when Parliament was prorogued in January 2025 and has not been re-enacted in that form. - [OPC](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/02_05_d_15/) — PIPEDA applies to the collection, use and disclosure of personal information by private-sector organizations in the course of commercial activity, and also to the employee personal information of federally-regulated businesses such as banks, airlines and telecommunications companies. - [OPC](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/lbe_080523/) — PIPEDA was not intended to apply extraterritorially, but the Federal Court has held it can still cover foreign entities that receive or transmit communications to and from Canada and that collect and disclose personal information about individuals in Canada. - [DataGuidance/OneTrust](https://www.dataguidance.com/opinion/quebec-overview-law-25-part-one) — Quebec's amended Private Sector Act requires notification to the Commission d'acces a l'information (CAI) upon the creation of a biometric database, a duty phased in alongside Law 25's other obligations from 2022. - [First Nations Information Governance Centre](https://fnigc.ca/wp-content/uploads/2023/07/PIPEDA-and-FN-Report_PROOF-002.pdf) — Personal Information Protection and Electronic Documents Act (PIPEDA) — PIPEDA applies to organizations/activities within federal jurisdiction engaged in commercial activities; FNIGC analysis states this extends to First Nations governments, organisations and businesses engaged in commercial activity. ### CA-KAH: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core consent and appropriateness tests are well documented at T1/T3, but there is no binding, codified special-category regime equivalent to GDPR Art.9, which is a structural gap relative to the question set. Primary framework PIPEDA Schedule 1 (CSA Model Code) and Quebec Private Sector Act as amended by Law 25 Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Amber Core consent and appropriateness tests are well documented at T1/T3, but there is no binding, codified special-category regime equivalent to GDPR Art.9, which is a structural gap relative to the question set. D2 · Lawful Processing — Full Module Record 4 sub-modules · 62 words · 5 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### CA-KAH: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Uncertain▾ Core access/correction rights are documented, but PIPEDA's federal deadline framework and an explicit restriction/objection right are not clearly codified, producing a genuine coverage gap distinct from Quebec's more concrete regime. Primary framework PIPEDA Schedule 1 and Quebec Private Sector Act as amended by Law 25 Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Amber Core access/correction rights are documented, but PIPEDA's federal deadline framework and an explicit restriction/objection right are not clearly codified, producing a genuine coverage gap distinct from Quebec's more concrete regime. #### Sub-modules (5) #### Access RightGreen PIPEDA Principle 9 (Individual Access) gives people the right to access personal information held about them and challenge its accuracy. Claims (1): - Under PIPEDA's Schedule 1 fair information principles, people have the right to access their personal information held by an organization and to challenge its accuracy. #### Rectification And ErasureAmber Law 25 introduced a data-portability right and a 'right to be forgotten'-style capability effective in the September 2022 tranche. Claims (1): - Since Quebec's Law 25 data-privacy requirements entered into force on 22 September 2023, organizations must conduct privacy impact assessments before adopting processing technology and individuals gained an added 'right to be forgotten.' #### Restriction And ObjectionRed No PIPEDA-specific restriction/objection right distinct from consent withdrawal was located in this pass. #### Data PortabilityAmber Quebec's amended Act introduced a data-portability right (Section 3.3 per commentary); the federal equivalent is still only proposed via Bill C-15's data-mobility provisions. Claims (1): - A federal right to data mobility, allowing individuals to direct disclosure of personal information between organizations subject to a prescribed data-mobility framework, is only proposed (via Bill C-15's new PIPEDA Division 1.2) and not yet in force. #### Deadlines And Response WindowsGreen Quebec's Private Sector Act requires a response to an individual rights request within 30 days. Claims (1): - Quebec's Private Sector Act (Section 32) requires that an individual rights request be addressed within 30 days. PIPEDA's Schedule 1 gives individuals rights of access and to challenge accuracy, without a fixed statutory response deadline in the federal Act itself. Quebec's Private Sector Act imposes a concrete 30-day response window and, via Law 25, added a data-portability right and a 'right to be forgotten'-style de-indexing capability from September 2022. Sources and claims (4) - [OPC](https://www.priv.gc.ca/media/2038/guide_org_e.pdf) — Under PIPEDA's Schedule 1 fair information principles, people have the right to access their personal information held by an organization and to challenge its accuracy. - [IAPP](https://iapp.org/news/a/canadian-privacy-tech-vendors-release-joint-quebec-law-25-compliance-solution) — Since Quebec's Law 25 data-privacy requirements entered into force on 22 September 2023, organizations must conduct privacy impact assessments before adopting processing technology and individuals gained an added 'right to be forgotten.' - [OPC](https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/banc_20251204/is_20251204/) — A federal right to data mobility, allowing individuals to direct disclosure of personal information between organizations subject to a prescribed data-mobility framework, is only proposed (via Bill C-15's new PIPEDA Division 1.2) and not yet in force. - [IAPP](https://iapp.org/news/a/a-quick-comparative-survey-of-quebecs-proposed-privacy-legislation) — Quebec's Private Sector Act (Section 32) requires that an individual rights request be addressed within 30 days. ### CA-KAH: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Breach notification, DPO and DPIA duties are well evidenced for the federal and Quebec-overlay tracks, but ROPA exemption tests and joint-controller/processor-contract mandatory terms were not located in this pass. Primary framework PIPEDA (Digital Privacy Act amendments) and Quebec Private Sector Act as amended by Law 25 Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Amber Breach notification, DPO and DPIA duties are well evidenced for the federal and Quebec-overlay tracks, but ROPA exemption tests and joint-controller/processor-contract mandatory terms were not located in this pass. D4 · Controller & Processor — Full Module Record 7 sub-modules · 73 words · 7 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### CA-KAH: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ The adequacy scope-gap and PIPEDA's accountability-based transfer model are well evidenced; no data-localisation mandate or Kahnawake-specific TIA practice was located. Primary framework PIPEDA Schedule 1 Principle 1 (accountability) and European Commission Decision 2002/2/EC Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Amber The adequacy scope-gap and PIPEDA's accountability-based transfer model are well evidenced; no data-localisation mandate or Kahnawake-specific TIA practice was located. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 77 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### CA-KAH: D6 Sectoral Watch8 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Financial-sector and telecoms overlays are documented; health, credit-scoring, education and insurance sectoral rules specific to this JID were not located in this pass. Primary framework PIPEDA plus sector-specific federal statutes (CASL, Consumer-Driven Banking Act) Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Amber Financial-sector and telecoms overlays are documented; health, credit-scoring, education and insurance sectoral rules specific to this JID were not located in this pass. D6 · Sectoral Watch — Full Module Record 8 sub-modules · 99 words · 5 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### CA-KAH: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Direct-marketing consent rules under CASL are well evidenced; cookie-specific pinpoint provisions, dark-pattern prohibitions, and opt-out-signal recognition for this JID were not located in this pass. Primary framework PIPEDA (general consent principle) and Canada's Anti-Spam Legislation (CASL) Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Amber Direct-marketing consent rules under CASL are well evidenced; cookie-specific pinpoint provisions, dark-pattern prohibitions, and opt-out-signal recognition for this JID were not located in this pass. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 48 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### CA-KAH: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ The Quebec ADM-transparency obligation and the PIPEDA no-go-zone doctrine are documented; a federal AI-specific statute is not currently in force, and no biometric-specific statutory condition for this JID was located. Primary framework PIPEDA s.5(3) and Quebec Private Sector Act as amended by Law 25 Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Amber The Quebec ADM-transparency obligation and the PIPEDA no-go-zone doctrine are documented; a federal AI-specific statute is not currently in force, and no biometric-specific statutory condition for this JID was located. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 73 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### CA-KAH: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Probable▾ No binding statutory age-of-consent threshold, age-verification mandate, or minor-profiling ban equivalent to GDPR Art.8/DSA Art.28(2) was located for this JID in this pass; the module rests on interpretive guidance only. Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Red No binding statutory age-of-consent threshold, age-verification mandate, or minor-profiling ban equivalent to GDPR Art.8/DSA Art.28(2) was located for this JID in this pass; the module rests on interpretive guidance only. D9 · Children's Privacy — Full Module Record 5 sub-modules · 60 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### CA-KAH: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Penalty structures, recent enforcement actions, and pending reform are all well evidenced at T1; procedural deadlines, appeal time limits, and a Kahnawake-specific enforcement record are not established in this pass. Primary framework PIPEDA and Quebec Private Sector Act as amended by Law 25 Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Amber Penalty structures, recent enforcement actions, and pending reform are all well evidenced at T1; procedural deadlines, appeal time limits, and a Kahnawake-specific enforcement record are not established in this pass. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 135 words · 9 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) foreign authority access Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties