--- title: "New Brunswick, Canada Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/new-brunswick-canada/ source_html: /jurisdictions/new-brunswick-canada/index.html description: "New Brunswick, Canada data protection and privacy regulation: 10 categories, 54 claims, updated 2026-10-25." generated_at: 2026-11-07T14:58:19Z content_sha256: 22be48578b8bfe41426d4fecaadb9b267fcfbdb64e58a72cf96cd6965ea49362 generator: "fe-fleet/md-twin@1.0" --- # New Brunswick, Canada Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed hybrid regime overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/new-brunswick-canada/), [World Payments](https://payments.gi/jurisdictions/new-brunswick-canada/), artificial-intelligence Last updated 2026-10-25 · 10 categories · 54 claims · 32 sources in the cumulative register Download report (PDF) Expand all Bill C-36, introduced in Parliament on 2026-06-15, would enact the Protecting Privacy and Consumer Data Act and, in doing so, repeal Part 1 of PIPEDA and create a new Digital Safety and Data Protection Commission of Canada. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not fully checked this cycle: Sectoral Watch, AdTech & Commercial Privacy, Children & Vulnerable Groups (3 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=NEW-BRUNSWICK-CANADA)[Build Report](/reports/?j=NEW-BRUNSWICK-CANADA)[Compare](/compare/?j=NEW-BRUNSWICK-CANADA) Framework posture Hybrid regime 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Office of the Privacy Commissioner of Canada (OPC) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 3 Red categories 57 Sub-modules 54 Claims 18 Tier-1 sources Traffic-light mix 2 green 5 amber 3 red (sums to 10 rendered categories; click to filter) 3 categories flagged red Canada federal law that applies in New Brunswick, Canada is covered once, on the [Canada](/jurisdictions/canada/) page. This page covers New Brunswick, Canada’s own layer: its own law, regulators and enforcement. ## Jurisdiction brief Jurisdiction lead brief 1,193 Full executive summary 209 ###### Latest update · 25 October 2026 #### Lead Signal New Brunswick's data protection framework moved this period on the strength of a completed legislative review rather than a new enforcement action. A legislated review of the Right to Information and Protection of Privacy Act, with a report dated 18 June 2026, recommends amending the definition of personal information to include biometric information, and recommends defining artificial intelligence, generative artificial intelligence and automated decision-making within the statute. The government has indicated it intends to introduce reform legislation, though no bill has yet been tabled. RTIPPA governs only New Brunswick public bodies; the province has no general private-sector data protection statute, so the federal Personal Information Protection and Electronic Documents Act continues to apply directly to commercial activity in New Brunswick, with the Office of the Ombud having no jurisdiction over that private-sector activity at all. #### Other Developments Rising national complaint volume. The Office of the Privacy Commissioner of Canada recorded 3,044 complaints under PIPEDA in the most recent fiscal year, an increase of 109% over 2024-2025, attributed in part to AI-enhanced search engines increasing public awareness of the complaints process. No New Brunswick-specific breakdown of this figure has been published, so the development is reported here as the national backdrop against which any future New Brunswick-originating complaint would be assessed. AI and automated-decision-making definitions under review. The RTIPPA legislative review's recommendation to define artificial intelligence, generative artificial intelligence and automated decision-making responds to documented public-body use of such systems in New Brunswick's law enforcement, university and municipal sectors. This recommendation remains at the review stage; it has not yet become a tabled bill, still less an enacted provision. #### Cross-Monitor Connections The RTIPPA review's proposed biometric and automated-decision-making definitions touch territory the artificial-intelligence monitor is better placed to analyse for algorithmic-governance implications in New Brunswick's public sector specifically; it is noted here only as a data protection definitional development. The federal PIPEDA penalty and breach-notification framework discussed below also has a commercial-compliance dimension that the financial-integrity monitor's reporting-entity obligations occasionally intersect with, though no such intersection was evidenced in New Brunswick this period. #### Outlook What would move the RTIPPA reform signal from a review recommendation to a binding obligation is the tabling of reform legislation; sources diverge on timing, with some suggesting introduction in the latter part of 2026 and others suggesting early 2027. The rising national PIPEDA complaint volume is a backdrop worth monitoring for any New Brunswick-specific breakdown that may later be published, which would sharpen the current national-only picture into a provincial one. 1 earlier update not shown here. ###### Standing brief · as of 23 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Bill C-36, introduced in Parliament on 2026-06-15, would enact the Protecting Privacy and Consumer Data Act and, in doing so, repeal Part 1 of PIPEDA and create a new Digital Safety and Data Protection Commission of Canada. The Office of the Privacy Commissioner of Canada is the primary federal regulator investigating complaints and promoting compliance under the existing PIPEDA regime, and New Brunswick has no independent private-sector privacy regulator standing alongside it: private-sector data protection in the province sits entirely within this federal PIPEDA-to-PPCDA reform track, with the province's Right to Information and Protection of Privacy Act governing only New Brunswick's public bodies rather than extending to private-sector businesses. The introduction of Bill C-36 is the dominant development of the cycle and, if enacted, would be the most significant restructuring of Canada's private-sector privacy regulator and framework since PIPEDA's original enactment. The proposed Commission would replace the current Commissioner model with a body carrying enhanced enforcement powers, consistent with a broader pattern across this cycle of Canadian federal privacy reform moving toward more codified, more heavily enforced obligations across each of the four modules addressed here. #### Other Developments A new data-mobility right has been legislated as an amendment to PIPEDA, giving individuals the ability to request that prescribed organizations, such as banks, provide specified personal information in a structured, commonly used technological format to an authorized recipient. This mobility right is enacted but not yet effective: implementing regulations that would operationalize the right are anticipated in 2026, and until those regulations are in place the right remains a legislated entitlement without an operative mechanism. The mobility right is explicitly targeted at organizations holding data of the kind held by banks, an early signal that Canada's approach to open banking and open finance is being coordinated with, rather than left separate from, privacy-law reform. Bill C-36's proposed Protecting Privacy and Consumer Data Act would require every organization to implement and maintain a formal privacy management program, a more codified accountability obligation than PIPEDA's current principle-based approach. This sits alongside PIPEDA's existing, settled breach-notification regime, in force since November 2018, which requires organizations to report breaches of security safeguards to the Office of the Privacy Commissioner and to notify affected individuals where a breach creates a real risk of significant harm; that breach-notification baseline is unchanged this cycle and continues to operate regardless of the proposed reform. Enforcement exposure under the proposed framework is reported, at assessed rather than confirmed confidence, to include penalties of up to the greater of C$25 million or five percent of gross global revenue, though this penalty ceiling has not been independently confirmed against the bill text this cycle and should be read as an early indication of the reform's intended enforcement severity rather than a settled figure. Read together with the formal privacy management program obligation proposed for controllers and processors, the reported penalty ceiling suggests a reform package oriented toward proactive compliance programs backed by a materially higher enforcement ceiling than PIPEDA currently carries, though the precise consent-threshold and penalty provisions were not confirmed against bill text this cycle. #### Cross-Monitor Connections The financial-integrity monitor separately tracks the federal financial-crimes reform track running in parallel with this privacy reform, including information-sharing arrangements between law enforcement and financial institutions that are understood to leave existing PIPEDA-derived privacy obligations undisturbed rather than superseding them. Readers following both monitors should expect the privacy-reform and financial-crime-reform tracks to be treated as coordinated but analytically distinct developments, with this monitor confined to the privacy-law dimension. #### Outlook The most consequential open questions for the cycle ahead are legislative: whether Bill C-36 advances through the parliamentary process toward the Digital Safety and Data Protection Commission of Canada it would create, and whether the reported C$25-million-or-5-percent-of-global-revenue penalty ceiling survives to enactment in that form. On the data-subject-rights side, the publication of implementing regulations for the PIPEDA data-mobility right, anticipated in 2026, is the concrete marker that would move that right from legislated entitlement to operative mechanism. New Brunswick businesses will experience each of these developments through the federal track alone, since the province's own privacy statute does not extend to the private sector. Because several of this cycle's most consequential figures, the penalty ceiling chief among them, rest on secondary legal-commentary sourcing rather than confirmed bill text, a future cycle in which the bill text itself becomes available for direct citation would materially change the confidence posture of the enforcement and regulator-and-framework modules. Read full brief · 1193 words Standing brief, as of 23 August 2026. #### Regulatory Status New Brunswick's private-sector data protection exposure runs entirely through the federal PIPEDA-to-PPCDA reform track: Bill C-36, introduced 2026-06-15, would repeal Part 1 of PIPEDA and create a new Digital Safety and Data Protection Commission of Canada, while the province's own Right to Information and Protection of Privacy Act governs only New Brunswick's public bodies and does not extend to private businesses. Within this federal track, three developments are material this cycle: a legislated data-mobility right giving individuals the ability to request that prescribed organizations, such as banks, provide specified information in a structured, portable format; a proposed formal privacy-management-program obligation for every organization under Bill C-36's Protecting Privacy and Consumer Data Act, sitting alongside PIPEDA's existing, unchanged breach-notification regime in force since November 2018; and enforcement exposure reported, at assessed confidence, to reach the greater of C$25 million or five percent of global gross revenue under the proposed framework. #### Outlook All of the material developments tracked for New Brunswick this cycle originate at the federal level, and the province's regulatory trajectory will continue to track Bill C-36's legislative progress directly, with implementing regulations for the data-mobility right and confirmation of the proposed penalty ceiling the two concrete markers to watch. Read full brief · 209 words Key regulatory facts for New Brunswick, Canada Regulatory Dimension New Brunswick, Canada Standing Position Jurisdiction New Brunswick, Canada (CA-NB) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 54 sourced findings) Regulator & Framework Regulator identity, governing instruments and material/territorial scope are clearly documented across multiple official OPC sources. Lawful Processing & Special Data Lawful bases, consent and sensitive-data coverage are well evidenced; anonymisation/pseudonymisation specifics are an evidence gap. Data Subject Rights Only the access-right sub-module has direct evidentiary support; the remaining four sub-modules are gaps. Controller/Processor Duties Breach notification, accountability and security-safeguard duties are strongly evidenced; DPO/ROPA/joint-controller sub-modules are gaps because PIPEDA does not impose GDPR-style discrete obligations of this kind. Primary Instruments Cited Office of the Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada, GNB Last Confirmed / Updated 2026-10-25 (32 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### New Brunswick, Canada: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Regulator identity, governing instruments and material/territorial scope are clearly documented across multiple official OPC sources. Primary framework PIPEDA (federal, private sector) + Right to Information and Protection of Privacy Act, SNB 2009 c R-10.6 (public sector) + Personal Health Information Privacy and Access Act, SNB 2009 c P-7.05 (health sector) Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Green Regulator identity, governing instruments and material/territorial scope are clearly documented across multiple official OPC sources. #### Sub-modules (5) #### Regulator And AuthorityGreen OPC enforces PIPEDA nationally including in NB; the NB Ombud separately enforces RTIPPA (public sector) and PHIPAA (health sector). Claims (5): - Office of the Privacy Commissioner of Canada (OPC) oversees compliance with PIPEDA, the federal private-sector privacy law applicable to commercial-activity personal information handling in New Brunswick. Central M1 regulator-identity claim. Challenger f-001 flagged an internal metadata inconsistency (0 T1-T3 sources declared vs. Confirmed rating) — escalated to gdpri-int-1 for human verification; underlying OPC government source independently corroborates the substance of the claim itself. - Office of the Ombud for New Brunswick oversees and enforces RTIPPA (NB public-sector privacy law) and PHIPAA (NB health-sector privacy law). Also implicated by Challenger f-001 metadata inconsistency; escalated to gdpri-int-1. - New Brunswick has no provincial private-sector data-protection statute equivalent to Alberta's or BC's PIPA; private-sector commercial activity in NB is governed directly by the federal PIPEDA. - Office of the Ombud, New Brunswick — New Brunswick's provincial Ombud oversees only public-sector access-to-information and privacy matters under RTIPPA; it has no jurisdiction over private-sector commercial personal-information handling, which is governed directly by federal PIPEDA. - New Brunswick data protection regime — New Brunswick has no provincial private-sector data-protection statute; private-sector commercial activity is governed directly by the federal PIPEDA, while the Ombud NB oversees only public-sector information/privacy under RTIPPA. #### Act And InstrumentsGreen Three instruments together constitute NB's regime: PIPEDA, RTIPPA, and PHIPAA. Claims (3): - PIPEDA, RTIPPA and PHIPAA (NB three-instrument framework) together constitute New Brunswick's data-protection regime: PIPEDA (federal, private-sector commercial activity), RTIPPA (NB public bodies), PHIPAA (NB health information custodians). Foundational M1 architecture claim; layered federal/provincial construct, no single omnibus NB statute. - Right to Information and Protection of Privacy Act (RTIPPA) — A completed legislated review of RTIPPA (report dated 18 June 2026) recommends amending the definition of 'personal information' to include biometric information, and defining 'artificial intelligence', 'generative artificial intelligence' and 'automated decision-making' in RTIPPA; the government has indicated it intends to introduce reform legislation, with no bill yet tabled. - Ontario, New Brunswick and Newfoundland and Labrador hold a 'substantially similar' designation to PIPEDA for health-privacy law only, not for general private-sector commercial activity; NB has no substantially-similar general private-sector statute, so PIPEDA continues to apply directly to NB private-sector commercial activity. #### Material ScopeGreen PIPEDA's commercial-activity scope fills NB's private-sector gap since no NB-specific substantially-similar private sector statute exists. Claims (2): - PIPEDA applies to private-sector organizations across Canada, including New Brunswick, collecting, using or disclosing personal information in commercial activity. Material scope anchor claim. - New Brunswick has not enacted a general private-sector privacy statute deemed 'substantially similar' to PIPEDA (unlike AB, BC, QC); PIPEDA therefore continues to govern private-sector commercial data outside the health sector. Sub-national divergence signal: NB is a PIPEDA-default province. #### Territorial ScopeGreen PIPEDA applies to any business handling personal information crossing provincial/national borders regardless of home province. Claims (1): - PIPEDA applies regardless of home province to businesses operating in Canada that handle personal information crossing provincial or national borders in commercial activity. Territorial scope claim. #### Regulator Registration And FilingRed No general controller registration or filing regime was identified for NB under PIPEDA, RTIPPA, or PHIPAA in this research pass. #### Key findings (3) - — source on file - — source on file - — source on file New Brunswick's data-protection position is a layered federal/provincial construct rather than a single provincial omnibus statute. The federal Personal Information Protection and Electronic Documents Act (PIPEDA) governs private-sector commercial-activity data across the province because New Brunswick has not enacted a general private-sector statute deemed 'substantially similar' to PIPEDA (unlike Alberta, BC and Quebec). Two New Brunswick statutes overlay this: the Right to Information and Protection of Privacy Act (RTIPPA) for public bodies, and the Personal Health Information Privacy and Access Act (PHIPAA) for health information custodians (the latter deemed substantially similar to PIPEDA for that sector). Both provincial statutes are overseen by the Office of the Ombud for New Brunswick; PIPEDA is overseen federally by the Office of the Privacy Commissioner of Canada (OPC). Periodic update · new data 2026-10-25 #### Regulator & Framework New Brunswick's data protection framework is split along a public/private line. The Office of the Ombud, New Brunswick oversees access-to-information and privacy matters only for public bodies, under the Right to Information and Protection of Privacy Act; it has no jurisdiction over private-sector commercial personal-information handling. That commercial activity is governed directly by the federal Personal Information Protection and Electronic Documents Act, because New Brunswick, unlike Quebec, British Columbia and Alberta, has no general private-sector statute that has received a substantially-similar designation. New Brunswick does hold a substantially-similar designation alongside Ontario and Newfoundland and Labrador for health-privacy law specifically, but this narrower designation does not extend to general commercial activity, so PIPEDA's ten Fair Information Principles under Schedule 1 continue to bind every New Brunswick private-sector organization that collects personal information for commercial activity, with no employee-count or revenue threshold. The framework is now under review at the public-body level. A legislated review of RTIPPA, with its report dated 18 June 2026, recommends amending the statute's definition of personal information to include biometric information, and recommends defining artificial intelligence, generative artificial intelligence and automated decision-making. The government has indicated an intention to introduce reform legislation responding to these recommendations, but as of the review date no bill has been tabled, and the regulatory horizon record notes that sources diverge on expected timing, with estimates ranging between the latter part of 2026 and spring 2027. #### Outlook The framework's next material step would be the actual tabling of RTIPPA reform legislation responding to the June 2026 review. Until that occurs, the structural public/private split — Ombud oversight of public bodies under RTIPPA, and direct federal PIPEDA application to the private sector absent any substantially-similar general statute — remains the governing arrangement for New Brunswick. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (11) - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/) — Office of the Privacy Commissioner of Canada (OPC) oversees compliance with PIPEDA, the federal private-sector privacy law applicable to commercial-activity personal information handling in New Brunswick. Central M1 regulator-identity claim. Challenger f-001 flagged an internal metadata inconsistency (0 T1-T3 sources declared vs. Confirmed rating) — escalated to gdpri-int-1 for human verification; underlying OPC government source independently corroborates the substance of the claim itself. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/about-the-opc/what-we-do/provincial-and-territorial-collaboration/provincial-and-territorial-privacy-laws-and-oversight/) — Office of the Ombud for New Brunswick oversees and enforces RTIPPA (NB public-sector privacy law) and PHIPAA (NB health-sector privacy law). Also implicated by Challenger f-001 metadata inconsistency; escalated to gdpri-int-1. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/about-the-opc/what-we-do/provincial-and-territorial-collaboration/provincial-and-territorial-privacy-laws-and-oversight/) — PIPEDA, RTIPPA and PHIPAA (NB three-instrument framework) together constitute New Brunswick's data-protection regime: PIPEDA (federal, private-sector commercial activity), RTIPPA (NB public bodies), PHIPAA (NB health information custodians). Foundational M1 architecture claim; layered federal/provincial construct, no single omnibus NB statute. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief/) — PIPEDA applies to private-sector organizations across Canada, including New Brunswick, collecting, using or disclosing personal information in commercial activity. Material scope anchor claim. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/prov-pipeda/) — New Brunswick has not enacted a general private-sector privacy statute deemed 'substantially similar' to PIPEDA (unlike AB, BC, QC); PIPEDA therefore continues to govern private-sector commercial data outside the health sector. Sub-national divergence signal: NB is a PIPEDA-default province. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief/) — PIPEDA applies regardless of home province to businesses operating in Canada that handle personal information crossing provincial or national borders in commercial activity. Territorial scope claim. - [GNB](https://www.gnb.ca/en/news/n-b.2026.06.report-released-following-review-right-information-and-protection-privacy-act.html) — Right to Information and Protection of Privacy Act (RTIPPA) — A completed legislated review of RTIPPA (report dated 18 June 2026) recommends amending the definition of 'personal information' to include biometric information, and defining 'artificial intelligence', 'generative artificial intelligence' and 'automated decision-making' in RTIPPA; the government has indicated it intends to introduce reform legislation, with no bill yet tabled. - [https://clearbreach.ca/guides/pipeda-breach-reporting-requirements/](https://clearbreach.ca/guides/pipeda-breach-reporting-requirements/) — New Brunswick has no provincial private-sector data-protection statute equivalent to Alberta's or BC's PIPA; private-sector commercial activity in NB is governed directly by the federal PIPEDA. - [Ombud NB](https://www.ombudnb.ca/) — Office of the Ombud, New Brunswick — New Brunswick's provincial Ombud oversees only public-sector access-to-information and privacy matters under RTIPPA; it has no jurisdiction over private-sector commercial personal-information handling, which is governed directly by federal PIPEDA. - [https://fusioncomputing.ca/pipeda-compliance-small-business-canada/](https://fusioncomputing.ca/pipeda-compliance-small-business-canada/) — Ontario, New Brunswick and Newfoundland and Labrador hold a 'substantially similar' designation to PIPEDA for health-privacy law only, not for general private-sector commercial activity; NB has no substantially-similar general private-sector statute, so PIPEDA continues to apply directly to NB private-sector commercial activity. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/about-the-opc/what-we-do/provincial-and-territorial-collaboration/provincial-and-territorial-privacy-laws-and-oversight/) — New Brunswick data protection regime — New Brunswick has no provincial private-sector data-protection statute; private-sector commercial activity is governed directly by the federal PIPEDA, while the Ombud NB oversees only public-sector information/privacy under RTIPPA. ### New Brunswick, Canada: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Lawful bases, consent and sensitive-data coverage are well evidenced; anonymisation/pseudonymisation specifics are an evidence gap. Primary framework PIPEDA Schedule 1 (10 Fair Information Principles) Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Amber Lawful bases, consent and sensitive-data coverage are well evidenced; anonymisation/pseudonymisation specifics are an evidence gap. D2 · Lawful Processing — Full Module Record 4 sub-modules · 69 words · 5 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### New Brunswick, Canada: D3 Data Subject Rights5 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only the access-right sub-module has direct evidentiary support; the remaining four sub-modules are gaps. Primary framework PIPEDA Schedule 1, Principle 9 (Individual Access); RTIPPA (public sector access/correction, NB) Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Red Only the access-right sub-module has direct evidentiary support; the remaining four sub-modules are gaps. #### Sub-modules (5) #### Access RightAmber PIPEDA permits refusal of access only in narrow, enumerated circumstances (e.g., solicitor-client privilege). Claims (2): - PIPEDA s.9(3) permits refusal of access only in limited enumerated circumstances, e.g. solicitor-client privilege or formal dispute-resolution process information. Only well-evidenced data_subject_rights sub-module this cycle; rectification, restriction, portability and deadlines remain gaps (gdpri-int-2). - Under RTIPPA, an applicant refused access has the right to file a complaint with the Ombud or refer the matter to the Court of King's Bench of New Brunswick for review. #### Rectification And ErasureRed No PIPEDA/RTIPPA-specific rectification or erasure provision text was retrieved in this pass; searched OPC guidance and provincial-law summary pages. #### Restriction And ObjectionRed No restriction/objection-specific provision was retrieved for PIPEDA, RTIPPA or PHIPAA in this pass. #### Data PortabilityRed No portability right currently exists under PIPEDA; a proposed portability mechanism under the Consumer Privacy Protection Act (part of Bill C-27) never came into force after the Bill died on prorogation. #### Deadlines And Response WindowsRed Statutory response-deadline specifics for PIPEDA/RTIPPA/PHIPAA access requests were not retrieved in this pass. #### Key findings (3) - — source on file - — source on file - — source on file PIPEDA's access-right framework (with narrow statutory exceptions under s.9(3)) is documented, but rectification/erasure, restriction/objection, portability and statutory response-deadline specifics under PIPEDA/RTIPPA/PHIPAA were not confirmed in this research pass; Canada's proposed portability and ADM-contest rights (under the now-dead Bill C-27 CPPA) never took effect. No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (2) - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/privacy-topics/business-privacy/gd_phl_201106/) — PIPEDA s.9(3) permits refusal of access only in limited enumerated circumstances, e.g. solicitor-client privilege or formal dispute-resolution process information. Only well-evidenced data_subject_rights sub-module this cycle; rectification, restriction, portability and deadlines remain gaps (gdpri-int-2). - [Government of New Brunswick](https://laws.gnb.ca/en/showdoc/cs/R-10.6) — Under RTIPPA, an applicant refused access has the right to file a complaint with the Ombud or refer the matter to the Court of King's Bench of New Brunswick for review. ### New Brunswick, Canada: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Breach notification, accountability and security-safeguard duties are strongly evidenced; DPO/ROPA/joint-controller sub-modules are gaps because PIPEDA does not impose GDPR-style discrete obligations of this kind. Primary framework PIPEDA (breach-of-security-safeguards regime, s.10.1; Schedule 1 Principles 4.1 (Accountability) and 4.7 (Safeguards)); PHIPAA (NB health-sector breach notification) Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Amber Breach notification, accountability and security-safeguard duties are strongly evidenced; DPO/ROPA/joint-controller sub-modules are gaps because PIPEDA does not impose GDPR-style discrete obligations of this kind. D4 · Controller & Processor — Full Module Record 7 sub-modules · 105 words · 9 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### New Brunswick, Canada: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Transfer mechanism, adequacy-received status and NB health-sector localisation rule are evidenced; SCC/BCR, TIA and adequacy-granted sub-modules are gaps because Canada's regime does not operate GDPR-equivalent instruments in these areas. Primary framework PIPEDA (accountability-based transfer regime); EU Commission adequacy decision for Canada (organizations subject to PIPEDA); PHIPAA s.19 (NB, cross-border health-data consent) Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Amber Transfer mechanism, adequacy-received status and NB health-sector localisation rule are evidenced; SCC/BCR, TIA and adequacy-granted sub-modules are gaps because Canada's regime does not operate GDPR-equivalent instruments in these areas. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 96 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### New Brunswick, Canada: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Financial, health, employment, credit and insurance overlays are evidenced; telecoms/ePrivacy and education sub-modules are gaps in this pass. Primary framework PIPEDA plus sectoral overlays: Bank Act (financial); PHIPAA (health); provincial consumer-credit-reporting statutes (credit) Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Amber Financial, health, employment, credit and insurance overlays are evidenced; telecoms/ePrivacy and education sub-modules are gaps in this pass. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 84 words · 6 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### New Brunswick, Canada: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only one of six sub-modules (dark patterns) has direct evidentiary support in this pass. Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Red Only one of six sub-modules (dark patterns) has direct evidentiary support in this pass. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 35 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### New Brunswick, Canada: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ The historical/current non-force status of AIDA and ADM-contest proposals is well evidenced; profiling, genetic-data and surveillance-carveout sub-modules remain gaps. Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Amber The historical/current non-force status of AIDA and ADM-contest proposals is well evidenced; profiling, genetic-data and surveillance-carveout sub-modules remain gaps. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 74 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### New Brunswick, Canada: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only the education_settings sub-module has direct evidentiary support; the remaining four sub-modules are gaps. Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Red Only the education_settings sub-module has direct evidentiary support; the remaining four sub-modules are gaps. D9 · Children's Privacy — Full Module Record 5 sub-modules · 59 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### New Brunswick, Canada: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Regulator powers, penalties, recent enforcement activity, private right of action, and 180-day developments are all well evidenced from primary OPC sources. Primary framework PIPEDA ss.10.1-14 (enforcement, breach offences, Federal Court recourse) Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Green Regulator powers, penalties, recent enforcement activity, private right of action, and 180-day developments are all well evidenced from primary OPC sources. Periodic update · new data 2026-10-25 #### Enforcement & Redress No New Brunswick-specific enforcement action under either RTIPPA or PIPEDA was identified this period. The material development is national: the Office of the Privacy Commissioner of Canada recorded 3,044 complaints under PIPEDA in the most recent fiscal year, an increase of 109% over the prior year, which the Commissioner's office attributes in part to AI-enhanced search engines increasing public awareness of the complaints process. No New Brunswick-specific breakdown of this national complaint total has been published, so it is reported here as the national enforcement-activity backdrop against which any future New Brunswick-originating PIPEDA complaint would be assessed. PIPEDA's maximum statutory penalty is CA$100,000 per offence, and this applies directly to New Brunswick private-sector organizations since no New Brunswick-specific penalty tier exists. Separately, PIPEDA section 10.1 requires an organization to report a breach of security safeguards to the Privacy Commissioner, and to notify affected individuals, whenever the breach creates a real risk of significant harm, with the statute requiring this be done as soon as feasible after the organization determines the breach occurred, rather than fixing a specific deadline such as the seventy-two-hour window found in the EU's General Data Protection Regulation. PIPEDA section 10.3 separately requires an organization to retain a record of every breach, whether or not it created a real risk of significant harm, for twenty-four months from the date the organization determined the breach occurred. #### Outlook What would sharpen the New Brunswick enforcement picture is a published provincial breakdown of the national PIPEDA complaint total, or a disclosed enforcement action naming a New Brunswick organization specifically. Absent either, the enforcement record for this jurisdiction remains governed entirely by the national PIPEDA framework and its rising complaint volume. Periodic update · new data 2026-09-28 #### Enforcement & Redress Bill 46, An Act to Amend the Right to Information and Protection of Privacy Act, received Royal Assent in the 58th Legislature, 1st Session, a confirmed legislative development for New Brunswick's public-sector information and privacy regime. The precise commencement date of this amendment was not resolved this cycle, so it is not yet possible to state when its provisions take practical effect. This sits within a public-sector framework where an applicant refused access under RTIPPA already has the right to file a complaint with Ombud NB or to refer the matter to the Court of King's Bench of New Brunswick for review, and where public bodies have, since 2018-04-01, been required by the RTIPPA Regulations to notify affected individuals and the Ombud of certain privacy breaches involving personal information. Ombud NB submitted input as part of a 2025 legislative review of RTIPPA on 2026-01-28. The outcome of that review, including whether it recommends any expansion of New Brunswick's data-protection jurisdiction to cover the private sector, a jurisdiction currently held entirely by the federal PIPEDA regime, was not resolved this cycle. Taken together, the confirmed Bill 46 Royal Assent and the pending 2025 legislative review outcome are read as an escalating trajectory for this module: New Brunswick's public-sector redress framework is actively under legislative reconsideration. #### Outlook Two concrete items to track: the coming-into-force date of Bill 46's amendments, and the substantive outcome of Ombud NB's 2025 legislative review, particularly any recommendation touching private-sector jurisdiction. Either development would materially change the shape of this module's baseline. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 124 words · 11 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (14 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 13-22 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 32-34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 37-39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44-49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77-84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties