Canada Privacy Law: PIPEDA, Provincial Acts, and Recording Rules

Canadian privacy law actually asks two different questions, and mixing them up is the fastest way to get the wrong answer. The first is a data question: which statute governs how an organization collects, uses, and discloses your personal information. The second is a recording question: when can someone record a conversation or point a camera at you at all. They come from different sources of law and do not always move together.

The single most important fact for the data question is which body of law applies to you, because Canada does not have one private-sector privacy law. Quebec, Alberta, and British Columbia each passed their own private-sector law that has been declared "substantially similar" to the federal law and displaces it within that province. Everyone else, plus federally regulated employers and information crossing a provincial or international border, falls under the federal Personal Information Protection and Electronic Documents Act (PIPEDA) instead. A separate federal law, the Privacy Act, governs only federal government institutions, not private businesses, and confusing that with PIPEDA is described as the single most common mistake people make about Canadian privacy law.

The recording question has a simpler, nationwide answer. Canada is a one-party consent country under the Criminal Code: if you are a party to a call or a conversation, you can record it without telling anyone else, in every province including Quebec. What changes province to province is not whether you can record, but what happens afterward, since employers, courts, and Quebec's stronger civil-law privacy rules can still treat a recording as a problem even when making it broke no law.

Information last verified on 21 July 2026. This page presents general legal information, not legal advice.

Jurisdiction scope: This hub covers privacy law in Canada under the federal Privacy Act and PIPEDA, the provincial PIPAs of Alberta and British Columbia, Quebec's Law 25 and Civil Code, and the Criminal Code's recording and surveillance rules. It does not cover United States privacy law. It is general information, not legal advice for your situation.

Which Privacy Law Applies to You

Start with who you are dealing with. If it is a federal government department, agency, or many Crown corporations, the Privacy Act governs, not PIPEDA. The Privacy Act gives you a right to request the personal information a federal institution holds about you, free of charge, and to ask that inaccurate information be corrected, but it applies only to institutions listed in the schedule to the Act, never to a private business.

If you are dealing with a private business instead, the default federal answer is PIPEDA. It applies to organizations that collect, use, or disclose personal information in the course of commercial activity, plus every federally regulated employer, and it is built around ten fair information principles covering everything from consent to an individual's right of access. Since November 1, 2018, organizations covered by PIPEDA must report breaches that create a real risk of significant harm to the Office of the Privacy Commissioner (OPC) and keep a record of every breach, even minor ones. The OPC can investigate and publish findings, but it cannot fine an organization directly, a binding order needs a Federal Court application.

Quebec, Alberta, and British Columbia broke from that federal default. Alberta's PIPA and BC's PIPA are each declared substantially similar to PIPEDA and apply instead to private-sector organizations operating within that province, though PIPEDA still governs federally regulated businesses and information crossing a border. Both provincial PIPAs expressly regulate employee personal information, letting employers collect, use, and disclose it without consent for reasonable employment purposes as long as they give notice, which PIPEDA does not do for provincially regulated employers. The two provinces also diverge from each other: Alberta requires mandatory breach notification to its Commissioner when a breach creates a real risk of significant harm, while BC's PIPA has no equivalent private-sector requirement, and both provincial commissioners can issue binding orders directly, unlike the federal Privacy Commissioner. In 2013 the Supreme Court of Canada found Alberta's PIPA unconstitutional as applied to a union's picket-line photography, and Alberta amended the law in response.

Quebec's Law 25 is its own regime again, and the strictest in the country. It received royal assent on September 22, 2021, and phased in through three effective dates, September 22, 2022, September 22, 2023, and September 22, 2024, with penalties far larger than anything available under PIPEDA. The Commission d'acces a l'information (CAI) enforces it through administrative monetary penalties, penal fines, and a private right of action for damages, and as of September 22, 2024, individuals also gained a right to receive their personal information in a structured, portable format. Because Law 25 is considered substantially similar to PIPEDA, it displaces the federal law for information collected, used, or disclosed within Quebec.

The federal law itself is in flux. Bill C-27, which would have replaced PIPEDA's private-sector rules with a new Consumer Privacy Protection Act, died when Parliament was prorogued on January 6, 2025, and was never revived, so PIPEDA remains the operative federal law. Separately, Bill C-15 received Royal Assent on March 26, 2026, adding a data-mobility framework to PIPEDA, the first federal data-portability right, but it is not yet in force and awaits regulations.

Recording Phone Calls and Conversations

Recording a phone call in Canada is governed by the Criminal Code, not by PIPEDA or any provincial privacy act, and the rule is the same in every province: one-party consent, with no exceptions. Section 184(1) makes it an offence to wilfully intercept a private communication, but section 184(2)(a) exempts a recording made by the originator or an intended recipient of the call. Recording a call you are not part of, such as bugging someone else's line, is a separate offence punishable by up to five years in prison.

That exception protects private citizens, not the state. R v Duarte limits the police, not individuals: the state cannot warrantlessly record a conversation even with one party's consent, because that would breach section 8 of the Charter. Lawfully recording a call is also not the same as lawfully using or sharing it afterward. Provincial privacy torts, PIPEDA, and defamation law can still restrict what you do with a recording, and a business recording customer calls needs to give notice of the purpose and obtain consent that satisfies whichever privacy law applies to it, PIPEDA or the Alberta, British Columbia or Quebec statute, on top of the Criminal Code baseline.

The same one-party rule covers recording a meeting or a conversation with your boss, since you are almost always a party to it. Leaving a recorder running in a room you have left, though, or bugging a conversation you are not part of, can itself be a criminal offence under section 184(1). Being legally allowed to record something does not make it consequence-free at work: courts and arbitrators have found covert recording of coworkers or a manager to be just cause for dismissal, entirely separate from whether the recording itself broke any law. A secretly made recording is also not automatically excluded from a wrongful dismissal, human rights, or arbitration case, adjudicators weigh its relevance and reliability against the harm admitting it would cause. Written, contemporaneous notes and a same-day follow-up email create a paper trail with far less legal and workplace risk than a hidden recording, and Quebec's privacy rules under the Civil Code add an extra layer of exposure for employees and employers there.

Cameras, Doorbells, and Workplace Monitoring

Silent video is the easy case. Security cameras and doorbell cameras are legal everywhere in Canada for recording your own property. No province requires consent for silent video surveillance of your own driveway, porch, or yard. Audio is the trip wire: section 184(1) makes it an offence to wilfully intercept a private communication, and many doorbell cameras record audio by default even though buyers usually focus on the video feature.

Where you point the camera matters as much as what it records. Aiming at your own property is fine, but continuously capturing a neighbour's window, backyard, or interior can support a civil claim for intrusion upon seclusion under Jones v Tsige. Homeowners recording for personal, non-commercial reasons generally fall outside PIPEDA under its domestic-use exemption, but a business, landlord, or condo corporation running the same cameras does not get that exemption. Quebec adds its own layer again: Civil Code articles 35 and 36 and the Quebec Charter of human rights and freedoms give Quebec residents a stronger, freestanding privacy right than most of the country, and recording somewhere a person has a reasonable expectation of privacy, such as through a bathroom or bedroom window, can cross into voyeurism under Criminal Code section 162, a criminal offence distinct from any privacy tort.

Workplace surveillance layers the data question back on top of the recording question. PIPEDA covers employee personal information only at federally regulated employers, such as banks, airlines, and telecoms, so it does not reach employee privacy at most private-sector workplaces. Alberta's and BC's PIPAs fill that gap directly, letting an employer collect, use, and disclose employee information without consent for employment purposes if it gives reasonable notice. Quebec combines Civil Code articles 35 and 36 with Law 25, enforced by the CAI, making it the strongest employee privacy protection of any province. Ontario and most other provinces have no general private-sector privacy statute covering employees at all, so limits on monitoring come mainly from arbitration case law and the tort of intrusion upon seclusion. Ontario's Working for Workers Act requires employers with 25 or more employees to have a written policy disclosing their electronic monitoring practices, but it does not restrict or prohibit the monitoring itself. And as above, recording a workplace conversation you are personally part of remains lawful across Canada under Criminal Code section 184(2)(a), even though it can still be a valid reason for discipline or dismissal.

Health Privacy and Your Medical Records

Health information has its own privacy layer on top of PIPEDA and the provincial private-sector acts. PHIPA explained covers Ontario's health privacy law, the one the "phipa" searches are about: who it binds, your access and correction rights, and what custodians risk for breaches. How to access your medical records in Canada maps every province and territory's health-information statute, the response deadlines, and the complaint routes when a clinic will not hand over your chart.

Records Held by Government

Privacy laws cover businesses; requests for records held by governments run under separate freedom of information laws. See access to information requests in Canada, including the federal ATIP request process.

Spam, Telemarketing and Robocalls

Commercial email and text messages are governed by Canada's anti-spam law (CASL), which requires consent, sender identification and a working unsubscribe. Telemarketing calls are governed separately by the CRTC's rules and the National Do Not Call List, including what registration stops and what it does not.

Frequently Asked Questions

Does PIPEDA apply in my province?

It depends on the province. Quebec, Alberta, and British Columbia each have their own private-sector privacy law declared substantially similar to PIPEDA, which displaces PIPEDA within that province. Everywhere else, PIPEDA governs private-sector businesses directly, and it always governs federally regulated employers and information crossing a provincial or international border, regardless of province.

Can I record a phone call in Canada without telling the other person?

Yes. Canada uses one-party consent nationwide under Criminal Code section 184(2)(a): if you are the originator or an intended recipient of the call, you can record it without the other person's knowledge. A business recording customer calls has separate obligations to give notice and obtain consent under whichever privacy law applies to it, PIPEDA or the Alberta, British Columbia or Quebec statute, on top of that Criminal Code baseline.

Is it legal to record a conversation at work?

Recording a meeting or conversation you are personally part of is lawful across Canada under Criminal Code section 184(2)(a). That does not make it risk-free, though. Courts and arbitrators have found covert recording of coworkers or a manager to be just cause for dismissal, separate from whether the recording itself was legal.

Do businesses have to report a data breach in Canada?

Organizations covered by PIPEDA must report breaches that create a real risk of significant harm to the Office of the Privacy Commissioner and keep a record of every breach, even minor ones, a requirement in place since November 1, 2018. Alberta's PIPA has its own mandatory notification requirement to its Commissioner for similar breaches, while BC's PIPA has no equivalent private-sector requirement.

What is the difference between PIPEDA and the Privacy Act?

PIPEDA is the federal law for private-sector businesses. The Privacy Act is a separate federal law that applies only to federal government institutions, such as departments and many Crown corporations, not to businesses. Mixing the two up is described as the single most common mistake people make about Canadian privacy law.

Can a security camera or doorbell camera get me in legal trouble in Canada?

Video of your own property is legal everywhere in Canada. The risk is audio, since many doorbell cameras record it by default and the Criminal Code's interception rules can apply. Continuously pointing a camera at a neighbour's window, backyard, or interior can also support a civil claim for intrusion upon seclusion, and recording somewhere with a reasonable expectation of privacy can cross into voyeurism.