Canada (Federal) — data protection and AI governance
Personal Information Protection and Electronic Documents Act (PIPEDA), in force since 2001-01-01. Supervisory authority: Office of the Privacy Commissioner (OPC).
Data protection
- Instrument
- Personal Information Protection and Electronic Documents Act (PIPEDA)
- In force since
- 2001-01-01
- Penalties
- Jusqu'à 100 000$ CAD par infraction
- Key obligations
- 10 principes CSA
- Consentement valable
- Notification des atteintes
- Accès 30 jours
- Réforme : projet C-36 (PPCDA) déposé juin 2026 — amendes jusqu'à 25M$ ou 5% CA mondial
What the engine decides here
These three attributes are what an agent decision depends on in this jurisdiction. They are modelled, sourced and dated.
- Transfer regime
- Conditional
Moving data out is possible under conditions — a contractual mechanism, a prior assessment or equivalent safeguards depending on the case.
- Localisation mandate
- Not modelled
- Automated decision rights
- Not modelled
- Verified on
- 2026-08-14
Three decisions, computed just now
Same actions, this jurisdiction's context. These answers come out of the engine as the page renders — the same function the API calls.
- ALLOW
Read an internal contract
Low-risk operation
- ALLOW
Send a customer record to US_FED
Low-risk operation
- DENY
Decide on a job application
Decision reserved for a human
Conditional regime: the engine does not require a prior mechanism here. The law may still impose safeguards — contractual accountability, comparable protection at the recipient. The engine does not substitute for them.
Advisory decisions. StructureClerk decides; your infrastructure enforces.
AI governance
- Framework
- Aucune loi IA fédérale
- Status
- guidance
- Key points
- AIDA (C-27) mort au feuilleton à la prorogation (jan. 2025)
- C-36 (juin 2026) ne contient pas de volet IA
- Directive sur la prise de décision automatisée (secteur public fédéral)
Cybersecurity
- Framework
- CyberSecure Canada
- Key points
- Contrôles de base
- Plan d'incidents
Do your agents operate in Canada (Federal)?
The authority API makes these attributes executable: an ALLOW, APPROVE, DENY or ESCALATE decision before the agent acts, with signed evidence any third party can verify.