Privacy law and transborder data flows in Canada

Privacy law is one of the fastest-changing areas a security leader must track. Sub-domain 1.4 of the CISSP outline lists privacy issues, with examples such as the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), China's Personal Information Protection Law (PIPL) and South Africa's Protection of Personal Information Act (POPIA), together with transborder data flow. This lesson explains the principles that most privacy laws share, the main laws that apply in your country and internationally, breach notification duties, and how organizations manage transfers of personal information across borders.

Privacy principles

Most modern privacy laws trace back to the OECD Privacy Guidelines of 1980, revised in 2013. Their eight principles are collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. Canada's PIPEDA is built on ten fair information principles from the CSA Model Code: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance. The GDPR expresses similar ideas as lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability.

For a security professional, two principles stand out. The safeguards principle requires security measures appropriate to the sensitivity of the information, which makes poor security a privacy violation in itself. The accountability principle requires an organization to remain responsible for personal information it transfers to service providers, which is why vendor contracts and assessments (Lesson 10) are privacy controls as well as security controls.

Privacy law uses some recurring terms. Personal information, or personal data, is information about an identifiable individual. Sensitive categories, such as health, financial, biometric and children's data, usually need stronger protection. The controller (or organization) decides why and how personal data is processed; the processor (or service provider) processes it on the controller's behalf. Pseudonymized data can still be linked back to a person with additional information and usually remains personal data; anonymized data cannot reasonably be linked back, although true anonymization is harder than it looks.

The main laws

In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) governs personal information collected, used or disclosed in the course of commercial activities, and personal information about employees of federally regulated businesses. Alberta, British Columbia and Quebec have their own private-sector laws, deemed substantially similar, which apply instead of PIPEDA for activities within those provinces: Alberta's and BC's Personal Information Protection Acts, and Quebec's Act respecting the protection of personal information in the private sector, heavily amended by Law 25. Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador have health-specific laws, such as Ontario's Personal Health Information Protection Act (PHIPA). The federal Privacy Act and provincial public-sector laws cover government bodies. Bill C-27, which would have replaced PIPEDA with a Consumer Privacy Protection Act and created an AI law, died when Parliament was prorogued in January 2025, so PIPEDA remains in force; watch for a successor bill.

The GDPR applies to organizations established in the EU and to organizations elsewhere that offer goods or services to people in the EU or monitor their behaviour. It requires a lawful basis for processing, such as consent, contract, legal obligation or legitimate interests; gives individuals rights of access, rectification, erasure, restriction, portability and objection; requires data protection impact assessments for high-risk processing; and requires many organizations to appoint a data protection officer. Fines can reach 20 million euros or 4 per cent of worldwide annual turnover, whichever is higher. Many other countries, including Brazil (LGPD), China (PIPL) and South Africa (POPIA), have comprehensive laws with similar features.

Breach notification

Most privacy regimes now require organizations to notify regulators and affected individuals of certain breaches. The details matter: what counts as a breach, what harm threshold triggers notice, how fast notice must be given and what records must be kept. Security teams should build these rules into incident response plans in advance, because the clock usually starts when the organization becomes aware of the breach, not when the investigation ends.

Under PIPEDA, organizations must report to the Office of the Privacy Commissioner, and notify affected individuals, any breach of security safeguards involving personal information under their control if it is reasonable to believe the breach creates a real risk of significant harm (RROSH), as soon as feasible. Significant harm includes humiliation, damage to reputation, financial loss and identity theft; risk is assessed by the sensitivity of the information and the probability of misuse. Organizations must keep a record of every breach, whether or not it was reportable, for 24 months. Quebec's Law 25 requires notifying the Commission d'accès à l'information and affected persons of confidentiality incidents that present a risk of serious injury, and keeping an incident register. Alberta's PIPA has required notification to its commissioner since 2010.

The GDPR requires controllers to notify the supervisory authority within 72 hours of becoming aware of a personal data breach unless it is unlikely to result in a risk to individuals, and to notify individuals without undue delay when the risk is high. Processors must notify the controller without undue delay. A single incident affecting customers in several countries can therefore trigger many different notification duties with different clocks.

Transborder data flows

Personal data crosses borders constantly: cloud services, outsourced support, global human resources systems and analytics platforms all move it. Some laws restrict these transfers to protect individuals when their data leaves the country.

The GDPR permits transfers outside the European Economic Area only under specific mechanisms: an adequacy decision by the European Commission, appropriate safeguards such as standard contractual clauses or binding corporate rules, or narrow derogations. The Court of Justice of the EU invalidated the EU-US Privacy Shield in 2020 (the Schrems II decision), partly because of US surveillance law. The EU-US Data Privacy Framework, adopted in July 2023, restored a route for transfers to US organizations that self-certify, and the EU General Court upheld it in September 2025, although further appeals remain possible. Canada has held an adequacy decision for organizations subject to PIPEDA since 2001, reconfirmed in 2024.

In Canada, PIPEDA does not prohibit transfers abroad, but the organization remains accountable and must use contracts or other means to ensure a comparable level of protection, and should tell individuals that their information may be processed in another country and be accessible to that country's authorities. Quebec's Law 25 goes further: before communicating personal information outside Quebec, an organization must conduct a privacy impact assessment considering the sensitivity of the information, the purposes, the protection measures and the legal framework of the destination, and must have a written agreement. Some provincial public-sector rules, such as those in Nova Scotia and British Columbia, have historically restricted storing certain public-body data outside Canada, although BC relaxed its rule in 2021.

Data localization laws go further by requiring certain data to stay within a country. Russia, China and India have broad or sector-specific localization rules, and some public-sector and financial regulators impose them. Localization affects architecture choices such as which cloud regions to use and where backups are stored.

Privacy as a security leader's concern

Security and privacy teams work closely together. Security provides the safeguards; privacy defines what data may be collected, for what purposes and for how long. Privacy impact assessments (PIAs), or data protection impact assessments under the GDPR, are a joint tool: they map data flows, identify risks to individuals and recommend controls before a system goes live. Data minimization is also a security control, because data that was never collected, or was deleted on schedule, cannot be breached.

Individual rights and privacy operations

Privacy laws give individuals rights that the organization must be able to honour quickly and securely. Common rights include access to the personal information held about them, correction of inaccurate information, deletion in certain cases, withdrawing consent, and objecting to some kinds of processing such as direct marketing or automated decision-making. Each right creates operational and security tasks: verifying the requester's identity so that information is not disclosed to an impostor, finding the person's data across systems and suppliers, responding within legal deadlines, and keeping records of requests.

Data mapping makes these tasks possible. An organization that knows where each category of personal information is collected, stored, processed and shared can answer access requests, plan breach responses, apply retention schedules and complete privacy impact assessments. Without a data map, a simple deletion request can take weeks of searching and still miss copies in backups, analytics platforms or supplier systems. Security teams contribute by maintaining asset inventories, classifying data and supporting secure deletion, so that privacy promises made to customers are actually kept.

Privacy obligations also extend to how long information is kept. Retention schedules should state how long each category of personal information is needed for its purpose or for legal reasons, and how it will be securely destroyed afterwards. Keeping data 'just in case' increases breach impact, complicates access requests and may itself breach the storage limitation principle.

Privacy is therefore both a legal duty and a design discipline that security leaders share.