--- title: "Ontario, Canada Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/ontario-canada/ source_html: /jurisdictions/ontario-canada/index.html description: "Ontario, Canada data protection and privacy regulation: 10 categories, 84 claims, updated 2026-11-04." generated_at: 2026-11-07T14:58:19Z content_sha256: 5ea9a8d06c748f3162ad8987f2d55c2e6603c0d799ff8d201add3c58375f15db generator: "fe-fleet/md-twin@1.0" --- # Ontario, Canada Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed hybrid regime overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/ontario-canada/), [World Payments](https://payments.gi/jurisdictions/ontario-canada/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 84 claims · 49 sources in the cumulative register Download report (PDF) Expand all Ontario's private-sector data protection landscape is currently defined less by settled law than by overlapping and potentially conflicting federal reform tracks. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Regulator & Framework, Lawful Processing & Special Data, Cross-Border & Adequacy, AdTech & Commercial Privacy, Children & Vulnerable Groups (6 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=ONTARIO-CANADA)[Build Report](/reports/?j=ONTARIO-CANADA)[Compare](/compare/?j=ONTARIO-CANADA) Framework posture Hybrid regime 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Office of the Privacy Commissioner of Canada (OPC) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) 2028-01-01 Next EU Commission periodic review of Canada's PIPEDA adequacy decision Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 9 Probable · 1 Uncertain 10 Categories 1 Red categories 57 Sub-modules 84 Claims 16 Tier-1 sources Traffic-light mix 9 amber 1 red (sums to 10 rendered categories; click to filter) 1 category flagged red Canada federal law that applies in Ontario, Canada is covered once, on the [Canada](/jurisdictions/canada/) page. This page covers Ontario, Canada’s own layer: its own law, regulators and enforcement. ## Jurisdiction lead brief ###### Latest update · 4 November 2026 #### Lead Signal The most consequential activity for Ontario this period sits at the federal level, where the Office of the Privacy Commissioner of Canada moved on several fronts simultaneously. The OPC closed its investigation into WestJet's cyberattack-related security measures on October 14, 2026, separately secured a commitment from Loblaw to strengthen security measures following a privacy breach, and, on October 27, 2026, opened a new investigation into a breach disclosed by Navigate360 (operating in connection with Crime Stoppers) that stemmed from a cybersecurity incident originally occurring in March 2026. A parallel consumer proceeding reportedly alleges violations of both PIPEDA and provincial Consumer Protection Act provisions over delayed notification, though this reporting rests on third-party press coverage rather than the OPC's own case file. Because Ontario has no general private-sector data-protection statute of its own, each of these matters falls to the federal regime: the Information and Privacy Commissioner of Ontario's mandate is confined to the public sector under the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act, and to the health sector under the Personal Health Information Protection Act, while general commercial activity in the province is governed directly by PIPEDA under OPC supervision. The enforcement cadence described above is therefore the operative accountability mechanism for Ontario-based commercial entities, notwithstanding that none of the three matters originates with the provincial regulator. #### Other Developments Third-party service-provider guidance. The OPC published guidance, dated September 10, 2026 and reported October 29, 2026, on assessing third-party service providers. The guidance is understood to state that engaging a service provider does not relieve a PIPEDA-covered organization of responsibility for personal information handled on its behalf, and it sets out due-diligence, contractual, and ongoing-monitoring expectations for organizations operating in Ontario and elsewhere. Call-recording guidance. On October 8, 2026, the OPC published updated guidance on the recording of customer telephone calls, addressing consent, caller choice, and the handling of recordings under PIPEDA. The guidance is reported to state that for organizations not subject to PIPEDA, the guidelines operate as best practices only rather than as binding rules. AI-transparency consultation. The OPC published its comments to a government consultation on AI transparency on October 23, 2026, applicable to PIPEDA-covered organizations including those operating in Ontario. This remains consultation-stage activity; no new binding rule has resulted from it this period. Children's Privacy Code. The federal Privacy Commissioner launched a Children's Privacy Code on October 20, 2026, described as intended to support strong online protections for youth, applicable to PIPEDA-covered organizations operating in the province. Whether the Code constitutes binding guidance or a voluntary instrument has not yet been confirmed. #### Cross-Monitor Connections The Navigate360/Crime Stoppers investigation, with its parallel consumer litigation alleging delayed breach notification, is a matter a financial-integrity-focused monitor would track only insofar as any financial-sector data is implicated; no such nexus is indicated in the current reporting. The AI-transparency consultation comments touch territory that an artificial-intelligence-focused monitor would track directly with respect to automated-decision-making transparency obligations; this brief does not re-analyse that ground here. #### Outlook The open question for the Navigate360 matter is whether the OPC's investigation, opened October 27, 2026, will proceed in parallel with or independently of the consumer class proceeding alleging delayed notification; as scheduled, no resolution has yet been reported. Whether the Children's Privacy Code acquires binding force, and whether the AI-transparency consultation produces a rule rather than guidance, remain open as at this writing, with Ontario's commercial sector continuing to be governed entirely through the federal PIPEDA/OPC channel regardless of outcome. ###### Standing brief · as of 11 October 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Ontario's private-sector data protection landscape is currently defined less by settled law than by overlapping and potentially conflicting federal reform tracks. Federal PIPEDA continues to govern general private-sector commercial activity directly in Ontario, since there is no substantially-similar provincial private-sector law; the Information and Privacy Commissioner of Ontario's mandate under FIPPA/MFIPPA and PHIPA covers only the public sector and the health sector respectively, leaving PIPEDA as the operative general commercial-privacy statute. Against that backdrop, Bill C-36, the Protecting Privacy and Consumer Data Act, was tabled on 15 June 2026 and would repeal Part 1 of PIPEDA entirely, replacing the Office of the Privacy Commissioner with a new Digital Safety and Data Protection Commission of Canada; as at its Charter Statement of 28 August 2026, the bill remained before Parliament without Royal Assent. Running alongside this is Bill C-15's PIPEDA Division 1.2, the federal data-mobility provision, which received Royal Assent on 26 March 2026 but is not yet in force and has no implementing regulations published. Bill C-36 contains coordinating amendments that would repeal this data-mobility Division if C-36 commences first, meaning organisations planning around a federal data-portability right currently face two mutually exclusive commencement paths with no clarity on which will prevail. #### Other Developments Sectoral financial-data regulation is also advancing on a parallel track. Draft Consumer-Driven Banking Regulations, published 27 June 2026 under the Consumer-Driven Banking Act component of Bill C-15, would set accreditation, security, consent and liability rules for bank-held financial-data sharing, with the Bank of Canada as supervisor; the sixty-day comment period on the draft closed on 26 August 2026, and the regulations are not yet final. Enforcement activity under the health-sector regime continued independently of the federal reform uncertainty: the Information and Privacy Commissioner of Ontario issued its third administrative monetary penalty under the Personal Health Information Protection Act, PHIPA Decision 341, on 26 August 2026, involving a clinical information clerk at Lake of the Woods District Hospital. This sits under the IPC's authority, amended into PHIPA section 61.1 and Ontario Regulation 329/04, to impose administrative monetary penalties on health information custodians up to a maximum of CAD 50,000. The cadence of this being the IPC's third such penalty signals an active, continuing enforcement program under the health-sector statute distinct from the stalled general private-sector reform. #### Cross-Monitor Connections The Consumer-Driven Banking Regulations development connects directly to world-payments' tracking of the same open-banking regime, since the draft regulations' accreditation, security and consent rules for financial-data sharing are the data-protection-facing counterpart to the payment-access and market-structure questions world-payments monitors under its own licensing and market-access module. The uncertainty over Bill C-36 and Bill C-15's data-mobility Division also has a bearing on financial-integrity's interest in Canada's broader regulatory-architecture trajectory, insofar as the identity of Canada's eventual privacy regulator, whether the continuing Office of the Privacy Commissioner or the proposed Digital Safety and Data Protection Commission, affects the institutional landscape relevant to cross-border data-sharing cooperation. #### Outlook The most consequential open question for Ontario data protection is which of the two federal reform paths commences first: full PIPEDA replacement under Bill C-36 or the narrower data-mobility right under Bill C-15's already-enacted Division 1.2. Until Parliament resolves this sequencing, which remained unresolved as at Bill C-36's 28 August 2026 Charter Statement, organisations cannot reliably plan around a stable federal data-portability obligation. On the sectoral side, the Consumer-Driven Banking Regulations consultation having closed on 26 August 2026 means a finalised rule could follow in the coming months, and the IPC's continuing PHIPA enforcement cadence suggests health information custodians should expect further administrative monetary penalty activity under the existing CAD 50,000 ceiling. Read full brief · 1218 words Key regulatory facts for Ontario, Canada Regulatory Dimension Ontario, Canada Standing Position Jurisdiction Ontario, Canada (CA-ON) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 84 sourced findings) Regulator & Framework Framework is mature and well-documented but structurally fragmented across two regulators and multiple statutes with no unified Ontario private-sector code; federal reform (PIPEDA modernization) remains incomplete. Lawful Processing & Special Data Consent framework is well-established and judicially tested, but the absence of a codified special-categories list and of a statutory anonymization safe-harbour (features recommended by the Commissioner for the... Data Subject Rights Core access/correction rights exist and are enforced, but portability, explicit restriction/objection, and erasure/de-indexing rights are either absent or only proposed, not yet in force. Controller/Processor Duties Breach notification and accountability duties are in force and judicially reinforced, but DPIA/DPO/ROPA equivalents remain non-statutory, and enforcement of breach obligations is indirect (referral-based, no OPC... Primary Instruments Cited OPC, OPC, OPC, OPC, IAPP Last Confirmed / Updated 2026-11-04 (49 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Ontario, Canada: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Framework is mature and well-documented but structurally fragmented across two regulators and multiple statutes with no unified Ontario private-sector code; federal reform (PIPEDA modernization) remains incomplete. Primary framework PIPEDA (federal, private sector) + PHIPA/FIPPA/CYFSA Part X (Ontario sectoral/public sector) Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Amber Framework is mature and well-documented but structurally fragmented across two regulators and multiple statutes with no unified Ontario private-sector code; federal reform (PIPEDA modernization) remains incomplete. #### Sub-modules (5) #### Regulator And AuthorityGreen OPC (federal, Gatineau HQ with a Toronto regional office) enforces PIPEDA; IPC Ontario enforces PHIPA/FIPPA/CYFSA Part X. The two regulators operate under a 2025-updated MOU enabling joint investigations. Claims (5): - The Office of the Privacy Commissioner of Canada oversees compliance with PIPEDA, Canada's federal private-sector privacy law, and maintains a Toronto regional office to promote PIPEDA compliance in Ontario. - The Information and Privacy Commissioner of Ontario has oversight of personal information and personal health information under FIPPA, PHIPA, and Part X of the CYFSA (the 'Ontario Statutes'). - organisations engaged in commercial activities; provincial laws of substantially similar force (Quebec, BC, Alberta) take precedence only in those provinces; Ontario has no such law so PIPEDA governs directly - PIPEDA (federal) — General commercial private-sector processing in Ontario is governed directly by the federal PIPEDA, not by a provincial statute; the IPC's own jurisdiction is limited to the public sector (FIPPA/MFIPPA) and health sector (PHIPA) - Information and Privacy Commissioner of Ontario / Office of the Privacy Commissioner of Canada — Ontario has no general private-sector data-protection statute; the IPC Ontario's statutory mandate is confined to the public sector under FIPPA/MFIPPA and the health sector under PHIPA, while general commercial private-sector activity in Ontario is governed directly by federal PIPEDA under OPC supervision. #### Act And InstrumentsGreen Core instruments: PIPEDA (Royal Assent 2000-04-13); PHIPA 2004; FIPPA R.S.O. 1990; CYFSA 2017 Part X. Claims (4): - PIPEDA is the complete version that received Royal Assent on April 13, 2000, and Schedule 1 contains the 10 fair information principles referred to throughout the Act. - Bill 97, A Plan to Protect Ontario Act (Budget Measures), 2026 — Amended FIPPA and MFIPPA with further amendments in force 2026-07-01 and 2026-09-15, and additional provisions scheduled to commence 2027-01-01; as a result some IPC guidance is under review and subject to change - Bill C-36 (Protecting Privacy and Consumer Data Act) — received first reading in the House of Commons June 15, 2026; not yet in force; would replace Part 1 of PIPEDA and create the Digital Safety and Data Protection Commission of Canada - Bill C-15 PIPEDA Division 1.2 (data mobility) — Received Royal Assent 26 March 2026 but not yet in force; no implementing regulations published; Bill C-36's coordinating amendments would repeal this Division if C-36 commences first #### Material ScopeGreen PIPEDA covers factual or subjective recorded/unrecorded information about an identifiable individual collected in commercial activity. Claims (1): - Under PIPEDA, personal information includes any factual or subjective information, recorded or not, about an identifiable individual, collected in the course of commercial activity. #### Territorial ScopeGreen PIPEDA applies to interprovincial/international transfers and to organizations doing business in/into Canada regardless of headquarters location, as confirmed by Federal Court/FCA rulings on Google's search service. Claims (1): - The Federal Court (2021) and Federal Court of Appeal (2023) confirmed PIPEDA applies to Google's search engine service, establishing that PIPEDA's application is not limited by an organization's foreign incorporation where it collects, uses, or discloses personal information in the course of commercial activities connected to Canada. #### Regulator Registration And FilingAmber PIPEDA imposes no general registration/filing regime on controllers; the only affirmative filing-adjacent duty is mandatory breach record-keeping (2-year retention, producible to OPC on request). Claims (1): - PIPEDA requires organizations to keep and maintain a record of every breach of security safeguards involving personal information under their control, regardless of harm level, for at least two years. CA-ON sits inside Canada's federated privacy architecture: the federal Office of the Privacy Commissioner of Canada (OPC) enforces PIPEDA as the general private-sector omnibus statute across Ontario (no substantially-similar provincial private-sector law exists in Ontario, unlike AB/BC/QC), while the Ontario Information and Privacy Commissioner (IPC) enforces three Ontario-specific sectoral/public statutes: PHIPA (health), FIPPA (provincial public sector access/privacy) and Part X of the CYFSA (child welfare privacy). This creates a dual-regulator, sector-stacked model rather than a single comprehensive Ontario private-sector statute. Periodic update · new data 2026-10-25 #### Regulator & Framework Federal PIPEDA governs general private-sector commercial activity directly in Ontario, since no substantially-similar provincial private-sector law exists; the Information and Privacy Commissioner of Ontario's mandate under FIPPA/MFIPPA and PHIPA is limited to the public sector and the health sector respectively, so PIPEDA remains the applicable general commercial-privacy statute for Ontario organisations. Two federal reform tracks are now in motion simultaneously. Bill C-36, the Protecting Privacy and Consumer Data Act, was tabled on 15 June 2026 and would repeal Part 1 of PIPEDA in full, replacing the Office of the Privacy Commissioner with a newly created Digital Safety and Data Protection Commission of Canada; as at its Charter Statement of 28 August 2026, the bill remained before Parliament without Royal Assent. Separately, Bill C-15's PIPEDA Division 1.2, the data-mobility provision, received Royal Assent on 26 March 2026 but is not yet in force, with no implementing regulations yet published. Bill C-36 contains coordinating amendments that would repeal this data-mobility Division if C-36 commences first, creating a direct sequencing conflict between the two reform paths. #### Outlook Which bill commences first, and whether Bill C-36 is enacted at all, will determine whether Ontario organisations plan around an enhanced single federal regulator model or around the existing OPC structure with an added data-mobility right. The current reading or committee stage of Bill C-36 following its 28 August 2026 Charter Statement was not located, leaving the near-term legislative trajectory uncertain. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (12) - [OPC](https://www.priv.gc.ca/en/about-the-opc/) — The Office of the Privacy Commissioner of Canada oversees compliance with PIPEDA, Canada's federal private-sector privacy law, and maintains a Toronto regional office to promote PIPEDA compliance in Ontario. - [OPC](https://www.priv.gc.ca/en/about-the-opc/what-we-do/provincial-and-territorial-collaboration/memorandums-of-understanding-with-provinces/mou_on_2025/) — The Information and Privacy Commissioner of Ontario has oversight of personal information and personal health information under FIPPA, PHIPA, and Part X of the CYFSA (the 'Ontario Statutes'). - [OPC](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief/) — PIPEDA is the complete version that received Royal Assent on April 13, 2000, and Schedule 1 contains the 10 fair information principles referred to throughout the Act. - [OPC](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief/) — Under PIPEDA, personal information includes any factual or subjective information, recorded or not, about an identifiable individual, collected in the course of commercial activity. - [OPC](https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2025/pipeda-2025-002/) — The Federal Court (2021) and Federal Court of Appeal (2023) confirmed PIPEDA applies to Google's search engine service, establishing that PIPEDA's application is not limited by an organization's foreign incorporation where it collects, uses, or discloses personal information in the course of commercial activities connected to Canada. - [IAPP](https://iapp.org/news/a/the-new-pipeda-data-breach-notification-requirements-twelve-years-in-the-making) — PIPEDA requires organizations to keep and maintain a record of every breach of security safeguards involving personal information under their control, regardless of harm level, for at least two years. - [Information and Privacy Commissioner of Ontario](https://www.ipc.on.ca/en/resources/guidance) — Bill 97, A Plan to Protect Ontario Act (Budget Measures), 2026 — Amended FIPPA and MFIPPA with further amendments in force 2026-07-01 and 2026-09-15, and additional provisions scheduled to commence 2027-01-01; as a result some IPC guidance is under review and subject to change - [Questa AI](https://www.questa-ai.com/privacy-cafe/canadas-new-ai-privacy-law-what-businesses-must-know) — Bill C-36 (Protecting Privacy and Consumer Data Act) — received first reading in the House of Commons June 15, 2026; not yet in force; would replace Part 1 of PIPEDA and create the Digital Safety and Data Protection Commission of Canada - [recordinglaw.com](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/canada-data-privacy-laws/) — Bill C-15 PIPEDA Division 1.2 (data mobility) — Received Royal Assent 26 March 2026 but not yet in force; no implementing regulations published; Bill C-36's coordinating amendments would repeal this Division if C-36 commences first - [callsphere.ai](https://callsphere.ai/blog/vw6f-canada-pipeda-cppa-2026-ai-voice) — organisations engaged in commercial activities; provincial laws of substantially similar force (Quebec, BC, Alberta) take precedence only in those provinces; Ontario has no such law so PIPEDA governs directly - [Information and Privacy Commissioner of Ontario](https://www.ipc.on.ca/) — PIPEDA (federal) — General commercial private-sector processing in Ontario is governed directly by the federal PIPEDA, not by a provincial statute; the IPC's own jurisdiction is limited to the public sector (FIPPA/MFIPPA) and health sector (PHIPA) - [Information and Privacy Commissioner of Ontario](https://www.ipc.on.ca/) — Information and Privacy Commissioner of Ontario / Office of the Privacy Commissioner of Canada — Ontario has no general private-sector data-protection statute; the IPC Ontario's statutory mandate is confined to the public sector under FIPPA/MFIPPA and the health sector under PHIPA, while general commercial private-sector activity in Ontario is governed directly by federal PIPEDA under OPC supervision. ### Ontario, Canada: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Consent framework is well-established and judicially tested, but the absence of a codified special-categories list and of a statutory anonymization safe-harbour (features recommended by the Commissioner for the stalled CPPA reform) leaves gaps relative to GDPR-equivalent regimes. Primary framework PIPEDA Schedule 1 (Fair Information Principles) + PHIPA (health data) Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Amber Consent framework is well-established and judicially tested, but the absence of a codified special-categories list and of a statutory anonymization safe-harbour (features recommended by the Commissioner for the stalled CPPA reform) leaves gaps relative to GDPR-equivalent regimes. Periodic update · new data 2026-10-25 #### Lawful Processing & Special Data Bill C-36 proposes expanded consent exceptions alongside de-identification provisions as part of its broader restructuring of the federal privacy framework, though the bill remained before Parliament without Royal Assent as at its 28 August 2026 Charter Statement. These proposed exceptions would sit within the same Bill that would repeal Part 1 of PIPEDA and create the Digital Safety and Data Protection Commission of Canada, meaning the lawful-processing framework currently governing PIPEDA-regulated organisations continues to apply unchanged until any such replacement takes effect. No enacted change to the lawful-basis or special-category-data provisions currently binding Ontario commercial organisations under PIPEDA was identified. #### Outlook Whether Bill C-36's proposed consent-exception and de-identification provisions advance will depend on the bill's progress through Parliament following its 28 August 2026 Charter Statement, the current stage of which was not located. Organisations should continue to apply PIPEDA's existing consent and lawful-processing requirements pending any enactment. D2 · Lawful Processing — Full Module Record 4 sub-modules · 67 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Ontario, Canada: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Uncertain▾ Core access/correction rights exist and are enforced, but portability, explicit restriction/objection, and erasure/de-indexing rights are either absent or only proposed, not yet in force. Primary framework PIPEDA Schedule 1 (Principles 4.9-4.9.4) + proposed Bill C-15 data-mobility provisions Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Amber Core access/correction rights exist and are enforced, but portability, explicit restriction/objection, and erasure/de-indexing rights are either absent or only proposed, not yet in force. #### Sub-modules (5) #### Access RightGreen PIPEDA Principle 4.9.4 requires organizations to respond to individual access requests within a reasonable time frame and at minimal or no cost. Claims (1): - Principle 4.9.4 of PIPEDA Schedule 1 requires an organization to respond to an individual's request for access to personal information within a reasonable time frame and at minimal or no cost to the individual. #### Rectification And ErasureAmber PIPEDA's 'challenging compliance' principle allows individuals to dispute accuracy, but the OPC/Federal Court found no extension of accuracy obligations to underlying linked article content, leaving broad erasure/de-indexing rights unresolved. Claims (1): - After investigating a complaint, the OPC found that Google's accuracy-related obligations under PIPEDA do not extend to the underlying content of linked articles, leaving the scope of any de-indexing/erasure right unsettled at the federal level. #### Restriction And ObjectionRed No explicit statutory restriction-of-processing or objection-to-profiling right exists under PIPEDA in force today. #### Data PortabilityAmber Bill C-15 proposes a new Division 1.2 in PIPEDA requiring an organization, on request, to disclose an individual's collected personal information to a designated organization under a data-mobility framework — not yet in force. Claims (1): - Bill C-15 would add a new Division 1.2 to PIPEDA requiring an organization, upon an individual's request, to disclose personal information collected from them to a designated organization under a data-mobility framework, subject to regulations. #### Deadlines And Response WindowsAmber Access requests must be answered within a reasonable time and at minimal or no cost under Principle 4.9.4; no fixed statutory day-count deadline (e.g., 30 days) was identified for PIPEDA generally. Claims (1): - Principle 4.9.4 of PIPEDA Schedule 1 requires an organization to respond to an individual's request for access to personal information within a reasonable time frame and at minimal or no cost to the individual. PIPEDA provides an access right and a 'challenging compliance' right functioning as an implicit correction mechanism, with a 'reasonable time and minimal/no cost' response standard (Principle 4.9.4). There is no explicit statutory restriction/objection right or portability right in force; a right to data mobility is only now being proposed via Bill C-15 amendments to PIPEDA. De-indexing/erasure remains contested — the OPC/Federal Court found Google's accuracy obligations do not extend to underlying linked content, leaving right-to-be-forgotten scope unresolved. No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (3) - [OPC](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief/) — Principle 4.9.4 of PIPEDA Schedule 1 requires an organization to respond to an individual's request for access to personal information within a reasonable time frame and at minimal or no cost to the individual. - [OPC](https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2025/pipeda-2025-002/) — After investigating a complaint, the OPC found that Google's accuracy-related obligations under PIPEDA do not extend to the underlying content of linked articles, leaving the scope of any de-indexing/erasure right unsettled at the federal level. - [OPC](https://www.priv.gc.ca/en/opc-actions-and-decisions/advice-to-parliament/2026/parl_260126/) — Bill C-15 would add a new Division 1.2 to PIPEDA requiring an organization, upon an individual's request, to disclose personal information collected from them to a designated organization under a data-mobility framework, subject to regulations. ### Ontario, Canada: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Breach notification and accountability duties are in force and judicially reinforced, but DPIA/DPO/ROPA equivalents remain non-statutory, and enforcement of breach obligations is indirect (referral-based, no OPC fining power). Primary framework PIPEDA Schedule 1 (Accountability, Safeguards) + Breach of Security Safeguards Regulations (2018) Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Amber Breach notification and accountability duties are in force and judicially reinforced, but DPIA/DPO/ROPA equivalents remain non-statutory, and enforcement of breach obligations is indirect (referral-based, no OPC fining power). D4 · Controller & Processor — Full Module Record 7 sub-modules · 90 words · 14 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Ontario, Canada: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Adequacy status is currently confirmed and stable, but is explicitly conditioned by the European Commission on further legislative modernization of PIPEDA that has stalled since the death of Bill C-27 in 2025. Primary framework PIPEDA (no dedicated transfer chapter) + EU Commission Decision 2002/2/EC as reviewed 2024 Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Amber Adequacy status is currently confirmed and stable, but is explicitly conditioned by the European Commission on further legislative modernization of PIPEDA that has stalled since the death of Bill C-27 in 2025. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 87 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Ontario, Canada: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Health sector overlay is robust and actively enforced (first PHIPA AMPs issued 2025); employment-data overlay is a documented, commissioner-flagged legislative gap; credit-scoring/insurance sectoral rules could not be confirmed in this pass. Primary framework PHIPA (health) + CASL (telecoms/e-marketing) + PIPEDA (federally-regulated employment) Supervisory authority [Information and Privacy Commissioner of Ontario (IPC)](https://www.ipc.on.ca/) Traffic-light rationale — Amber Health sector overlay is robust and actively enforced (first PHIPA AMPs issued 2025); employment-data overlay is a documented, commissioner-flagged legislative gap; credit-scoring/insurance sectoral rules could not be confirmed in this pass. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 81 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Ontario, Canada: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Direct marketing and address-harvesting rules are mature and actively enforced via CASL/CRTC precedent, but adtech-specific concepts (opt-out signals, clean rooms, cross-context advertising) have no dedicated CA-ON statutory analogue. Primary framework CASL + PIPEDA (address harvesting provisions) Supervisory authority [Canadian Radio-television and Telecommunications Commission (CRTC)](https://crtc.gc.ca/) Traffic-light rationale — Amber Direct marketing and address-harvesting rules are mature and actively enforced via CASL/CRTC precedent, but adtech-specific concepts (opt-out signals, clean rooms, cross-context advertising) have no dedicated CA-ON statutory analogue. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 84 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Ontario, Canada: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No comprehensive AI statute is in force federally following AIDA's death; ADM transparency rights remain proposal-stage only, while active regulator guidance (OPC biometrics, IPC-OHRC AI principles) partially fills the gap without statutory force. Primary framework None in force (AIDA/CPPA died with Bill C-27, 2025) — governed ad hoc via PIPEDA general principles and IPC/OPC guidance Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Red No comprehensive AI statute is in force federally following AIDA's death; ADM transparency rights remain proposal-stage only, while active regulator guidance (OPC biometrics, IPC-OHRC AI principles) partially fills the gap without statutory force. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 104 words · 9 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Ontario, Canada: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A concrete statutory protection exists for children in provincial care (CYFSA Part X) and regulator attention to children's/EdTech privacy is active, but general age-verification, parental-consent, and dependent-adult regimes were not confirmed in this pass. Primary framework CYFSA Part X (children in care) + PIPEDA general consent principles Supervisory authority [Information and Privacy Commissioner of Ontario (IPC)](https://www.ipc.on.ca/) Traffic-light rationale — Amber A concrete statutory protection exists for children in provincial care (CYFSA Part X) and regulator attention to children's/EdTech privacy is active, but general age-verification, parental-consent, and dependent-adult regimes were not confirmed in this pass. D9 · Children's Privacy — Full Module Record 5 sub-modules · 77 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Ontario, Canada: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Ontario's IPC now has and is actively using real monetary-penalty power (PHIPA), but the federal OPC — the primary regulator for most Ontario private-sector data — still lacks direct fining authority, and PIPEDA modernization (to add order-making/AMP powers via the stalled CPPA) remains unresolved. Primary framework PIPEDA enforcement provisions (ss.11-17, s.28) + PHIPA s.61.1 AMP regime Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/en/) Traffic-light rationale — Amber Ontario's IPC now has and is actively using real monetary-penalty power (PHIPA), but the federal OPC — the primary regulator for most Ontario private-sector data — still lacks direct fining authority, and PIPEDA modernization (to add order-making/AMP powers via the stalled CPPA) remains unresolved. Periodic update · new data 2026-11-04 #### Enforcement & Redress Federal enforcement activity touching Ontario-based or Ontario-operating organizations was notably active this period, even though none of it originates with the province's own regulator. The Office of the Privacy Commissioner of Canada closed its investigation into WestJet's cyberattack-related security measures on October 14, 2026, marking the conclusion of that matter. Separately, the OPC secured a commitment from Loblaw to strengthen its security measures following a privacy breach, announced October 26, 2026. Most recently, the OPC opened a new investigation on October 27, 2026 into a breach disclosed by Navigate360, which operates in connection with Crime Stoppers, stemming from a cybersecurity incident that originally occurred in March 2026. A parallel consumer proceeding is reported to allege violations of both PIPEDA and a provincial Consumer Protection Act arising from delayed notification of that breach, though this account rests on third-party press reporting rather than the OPC's own case file, and the precise scope of the investigation itself has not been independently confirmed from the regulator's own materials this period. Taken together, the closure of the WestJet matter, the Loblaw security commitment, and the newly opened Navigate360 investigation describe an escalating federal enforcement cadence over the period, with three distinct organizations subject to federal privacy-regulator attention in close succession. None of this activity falls to the Information and Privacy Commissioner of Ontario, whose own enforcement mandate remains confined to the public sector under the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act, and to the health sector under the Personal Health Information Protection Act. #### Outlook Whether the Navigate360 investigation proceeds independently of, or in coordination with, the reported parallel consumer litigation over delayed notification remains to be seen; as scheduled, no outcome has yet been reported for either the investigation or the class proceeding. The closure of the WestJet matter and the Loblaw commitment stand as concluded or settled this period, while Navigate360 remains an open matter going into the next period. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 122 words · 17 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (33 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties