Canada (private sector)
PIPEDA and Bill C-36
Applies to: Private-sector organizations under federal privacy law.
Bill C-36 is before Parliament and may change.
PIPEDA does not prohibit sending personal information abroad for processing. The organization stays accountable and must use "contractual or other means to provide a comparable level of protection" while a third party processes it, according to the Privacy Commissioner's 2009 guidelines.
Bill C-36, the proposed Protecting Privacy and Consumer Data Act, would add a duty to carry out a privacy impact assessment before disclosing or transferring personal information outside Canada (proposed s. 57). It had first reading on 2026-06-15 and is at second reading. It is not law.
What to check in a listing
- Where is the data processed, not only stored? (the Processing field)
- Do the vendor's terms commit to comparable protection, and name subprocessors?
The law and the regulator
- OPC: Guidelines for processing personal data across borders · checked 2026-10-13
- Bill C-36 on LEGISinfo · checked 2026-10-13
- Bill C-36, first reading text · checked 2026-10-13
A summary, not legal advice. Laws change; report a correction.