For Canadian private-sector organizations, PIPEDA governs personal information sent to an AI service: consent, purpose limitation, safeguards (Schedule 1, principles 4.1.3, 4.2, 4.3 and 4.7), and cross-border transfer. Quebec's Law 25 adds stricter duties: a privacy impact assessment is mandatory before any communication of personal information outside Quebec (s. 17). Additionally, a further assessment applies to any project to acquire, develop or overhaul an information system handling personal information (s. 3.3), and transparency is owed where a decision is based exclusively on automated processing (s. 12.1). Keeping processing in-country and, better, cloaking personal values on-device so they never reach the model, materially narrows this exposure.
Why Canadian firms can't just read US guidance
The public conversation about "compliant AI" is dominated by HIPAA and US enterprise terms. A consultant in Montréal or Toronto operates under a different regime: federally, PIPEDA; in Quebec, the substantially stricter Law 25. Both apply to personal information, and both are engaged the moment that information is processed by, or transferred to, a third-party AI service. US-framed advice simply doesn't answer the questions a Canadian privacy officer will ask.
What each regime requires, briefly
| PIPEDA (federal) | Quebec Law 25 | |
|---|---|---|
| Scope | Private-sector handling of personal information in commercial activity. | Organizations handling the personal information of people in Quebec: stricter across the board. |
| Consent & purpose | Meaningful consent; use limited to identified purposes. | Heightened consent standards; explicit purpose limits. |
| AI / automated processing | General principles apply to AI use and transfers. | Transparency duties around automated decision-making; individuals can ask about it. |
| Cross-border transfer | Permitted with comparable protection and transparency. | A privacy impact assessment is required before any communication outside Quebec, which must also be the subject of a written agreement (s. 17). |
| Teeth | Ombudsman model; reforms proposed to add penalties. | Two separate regimes. Monetary administrative penalties, imposed by the Commission: up to $10,000,000 or 2% of worldwide turnover for the preceding fiscal year, whichever is greater (s. 90.12). Penal offences, which require a prosecution: fines of $15,000 to $25,000,000 or 4% of worldwide turnover, whichever is greater (s. 91). |
The through-line: sending a Canadian's personal information to an AI model is a use, usually a transfer, and for most models, and almost all US-hosted ones, a cross-border transfer. Each of those is something the two laws have rules about.
Two ways to reduce the exposure
- Data residency. Keeping AI processing on Canadian infrastructure removes the cross-border-transfer question, the harder of the Law 25 triggers. A tool that offers Canadian residency lets you avoid the international-transfer analysis entirely for that processing.
- Don't transmit the personal values at all. If personal information is cloaked on the user's device before any text reaches the model, the personal data is not sent to the AI vendor. The transfer and third-party-use questions narrow to non-identifying markers. This doesn't erase your duties for the data you still hold, but it shrinks what actually leaves your environment, often to nothing personal at all.
In combination, Canadian residency for what must be transmitted, and cloaking so that personal values aren't among it. In this case, a Canadian consultancy can use frontier AI while keeping the PIPEDA and Law 25 analysis narrow and defensible. That posture is also exactly what a privacy-impact assessment is meant to document, so building it in makes the assessment easier, not harder.
Where s. 12.1 starts to bite: agents, not chatbots
The automated-decision duty looks narrow today because of one word. Section 12.1 applies where a decision is based exclusively on automated processing of personal information, so a consultant using a model to draft, with their own judgment applied before anything is acted on, sits outside it. The human in the loop is what keeps the processing from being exclusive.
That assumption is the thing most likely to stop being true. Agentic systems, models that call tools, read and write files, query databases and pass data between services without a person reviewing each step, are built precisely to remove the human from the loop. Where such a pipeline reaches a decision about an identified individual, exclusivity stops being a technicality that excuses you and becomes a condition that is met. Two further conditions still have to hold: the processing must involve personal information, and there must be a decision about the person concerned rather than a document produced about a subject. An agent drafting a report does not engage s. 12.1. An agent determining an outcome for a named individual plausibly does.
This is our reading rather than settled interpretation, and we would expect it to be tested before it is confirmed. But the direction is not subtle: a duty written for automated decision systems lands naturally on autonomous agents (including MCP), and the organisations adopting those agents fastest are rarely the ones asking which statutes are involved. The practical consequence is the one that runs through this whole page. If the personal values never reach the model, the analysis stays narrow however autonomous the pipeline becomes.
A note on scope
This is an orientation, not legal advice, and the statutes are more detailed than a summary can ever be. Law 25 in particular phased in obligations across 2022–2024 and continues to be interpreted. Confirm specifics with Canadian privacy counsel, especially before any cross-border transfer of personal information or deployment of automated decision-making.
Frequently asked questions
Does PIPEDA apply to using AI on client data?
If the data includes personal information about identifiable individuals and you're a private-sector organization operating in Canada, PIPEDA's rules on consent, purpose limitation, and safeguards apply, including when that data is processed by a third-party AI service. Sending personal information to an AI vendor is a use and often a transfer, both of which PIPEDA governs. This is not legal advice, please consult a business attorney for more details.
What does Quebec's Law 25 add for AI?
Law 25 (the Act to modernize legislative provisions respecting the protection of personal information) adds stricter obligations for organizations handling Quebecers' personal information: a mandatory privacy impact assessment before any communication of personal information outside Quebec (s. 17), which must also be the subject of a written agreement. Also, generating a privacy impact assessment for any project to acquire, develop or overhaul an information system involving personal information (s. 3.3) is required. Transparency is needed where a decision is based exclusively on automated processing (s. 12.1). And finally, heightened consent standards are asked, and not following the law involves significant penalties. Using an AI service on Quebecers' personal information most often engages the assessment duties. The s. 12.1 heightened transparency duty appears to be triggered by decisions made exclusively by automated processing, so AI used as a drafting aid under human review generally does not engage it. This is not legal advice, please consult a business attorney for more details.
Can I send Canadians' personal data to a US-based AI model?
It depends on the data and the safeguards. Cross-border transfer is not prohibited. Under PIPEDA a transfer for processing is a use rather than a disclosure, and the Office of the Privacy Commissioner's position is that additional consent for the transfer is not required, what is required is comparable protection, secured primarily by contract (Schedule 1, principle 4.1.3), and transparency about the practice. Quebec's Law 25 is stricter: a privacy impact assessment is mandatory before any communication of personal information outside Quebec. The communication must also be the subject of a written agreement (s. 17). Data-residency controls (keeping processing in Canada) and, better, not transmitting the personal values at all, materially reduce this exposure. This is not legal advice, please consult a business attorney for more details.
How does client-side cloaking help with PIPEDA and Law 25?
If personal values are cloaked on the user's device before any text reaches the AI model, the personal information is not transmitted to the AI vendor, so the cross-border-transfer and third-party-use questions that PIPEDA and Law 25 raise are reduced at the source. It does not remove your obligations for holding the data, but it narrows what leaves your environment to non-identifying markers. This is not legal advice, please consult a business attorney for more details.
About the author
Gabriel Tremblay, DBA, Founder & CEO, Untraceable. Gabriel holds a doctorate in business administration (DBA) specialising in decision-making, and has published health economics and outcomes research on de-identification, cloaking methods and AI writing quality. Publications and DOIs are listed on the publications page.
This guide is general information about how AI tools interact with confidentiality obligations. It is not legal advice, and it does not create any professional relationship. Confidentiality agreements vary, so review your own agreements with qualified counsel before relying on any framework described here.
Work with AI on data you can't share with it.
Untraceable cloaks confidential values on your computer before any AI model sees the text. The model never receives the secret at all.