Privacy Control Outcomes · Canada

Privacy Control Outcomes Across Canada’s 14 Jurisdictions

Federal, provincial and territorial privacy requirements mapped to ten evidence-backed technical control outcomes across private-sector, public-sector and health-information obligations. PDI helps organizations make privacy-control evidence reviewable while legal applicability, exceptions and remediation decisions remain with the customer and counsel.

Request a Canada Privacy Control Outcomes briefing

CANADA · 14 JURISDICTIONS · 10 EVIDENCE-BACKED CONTROL OUTCOMES

Technical outcomes support customer and counsel review. Legal applicability and remediation approval remain with the customer and counsel. English edition; French-language product screens and documentation are not represented as currently delivered.

Canada summary

Canada’s privacy landscape at a glance

14

jurisdictions — federal, 10 provinces, 3 territories

4

private-sector statutes — PIPEDA, Quebec, Alberta and British Columbia

27

public-sector and health-information statutes

0

Canadian laws with a fixed 72-hour breach clock

Canada context

What shapes privacy-control evidence in Canada

FEDERAL REFORM

Keep current law separate from proposals

PIPEDA remains the current federal private-sector law described in this view. Proposed federal reform is identified as pending rather than presented as current law.

QUEBEC

Use the strongest current tier carefully

Law 25 represents the strongest current Canadian administrative and penal enforcement tier described in the supplied source content. Applicability remains a customer-and-counsel decision.

BREACH TIMING

No universal Canadian 72-hour clock

Canadian breach obligations use standards such as as soon as feasible, without unreasonable delay, and promptly. The applicable rule and decision remain jurisdiction- and fact-specific.

What are Privacy Control Outcomes for Canada?

Privacy Control Outcomes translate privacy requirements into observable technical evidence: where personal information exists, how it is classified, where copies travel, what review occurred, and what approved action was taken. For Canada, PDI maps those outcomes across federal, provincial and territorial privacy contexts while leaving legal applicability and compliance determinations with the customer and counsel.

Ten Canada control outcomes

Ten privacy-control outcomes for Canadian privacy requirements

Each outcome connects a Canadian obligation or review question to the evidence a data-engineering program can produce. The mapping is a service-level operating view, not a complete legal checklist.

01 / OUTCOME

Personal data inventory and data map

Canadian obligation / context. Canadian privacy programs need a defensible view of what personal information is held, where it is held, and which organization or program owns the processing context.

How Kestryl evidences it. Kestryl can inventory supported systems and source materials, connect findings to locations and record context, and produce an evidence row for customer and counsel review.

02 / OUTCOME

Sensitive-data discovery

Canadian obligation / context. Private-sector, public-sector, and health-information obligations can apply differently to sensitive categories and the environments in which they appear.

How Kestryl evidences it. Kestryl can identify supported sensitive-data patterns, retain the source location and classification context, and distinguish discovery from a legal determination.

03 / OUTCOME

Downstream copy tracking

Canadian obligation / context. Copies in operational systems, exports, attachments, and downstream platforms can change the practical scope of a Canadian privacy-control review.

How Kestryl evidences it. Kestryl can trace supported structured-data copies and record the observed relationship between a finding, its location, and the review scope.

04 / OUTCOME

Data-subject request scoping

Canadian obligation / context. Access and other individual-rights requests require the organization to identify the relevant person, systems, records, exceptions, and response owners.

How Kestryl evidences it. Kestryl can help scope candidate records and supporting evidence across supported systems; the customer and counsel decide the lawful response and any exceptions.

05 / OUTCOME

Deletion and erasure propagation

Canadian obligation / context. A deletion decision may need to account for operational records, copies, holds, and exceptions across multiple systems and jurisdictions.

How Kestryl evidences it. Kestryl can identify supported structured-data locations and evidence the approved action path. It does not decide applicability, holds, exceptions, or approval.

06 / OUTCOME

Opt-out and consent-withdrawal validation

Canadian obligation / context. Consent and choice signals may need to be checked against downstream records, marketing systems, vendors, and the applicable Canadian program context.

How Kestryl evidences it. Kestryl can compare supported records and produce traceable evidence for review of propagation and exceptions; it does not make a legal sufficiency determination.

07 / OUTCOME

Marketing and vendor provenance

Canadian obligation / context. Organizations need to understand how personal information entered a marketing or vendor workflow and which systems retain related copies.

How Kestryl evidences it. Kestryl can retain source, location, classification, and downstream-copy evidence for supported systems so the customer can review provenance and ownership.

08 / OUTCOME

Breach blast-radius analysis

Canadian obligation / context. Canadian breach review depends on the information involved, affected individuals, risk, safeguards, and the applicable reporting and notification standard.

How Kestryl evidences it. Kestryl can help identify candidate records, categories, locations, and copies in supported systems. The customer and counsel determine risk, reportability, and notification.

09 / OUTCOME

Retention and minimization

Canadian obligation / context. Retention and minimization decisions depend on purpose, authority, policy, operational need, holds, and the relevant federal, provincial, territorial, public-sector, or health framework.

How Kestryl evidences it. Kestryl can show observed data categories, locations, and copies to support a policy-led review; it does not set lawful retention periods.

10 / OUTCOME

Regulator audit evidence

Canadian obligation / context. A reviewable record should connect the observed finding, classification, source, decision, approval, and bounded technical outcome.

How Kestryl evidences it. Kestryl can produce technical evidence rows and review history for customer and counsel inspection. The record is not, by itself, proof of statutory compliance.

PDI and Kestryl support

How PDI and Kestryl support privacy-control evidence

Supported actions on structured data
Actions apply only after an approved decision. Mask, Vault, and Strip apply only to approved supported structured working data after review and applicable hold checks. Documents and attachments may be discovered and evidenced within agreed scope; they are not represented as automatically remediated source documents.
Decision ownership and legal review
Keep applicability and approval with the right owners. Applicability, legal interpretation, holds, exceptions, and remediation approvals remain with the customer and counsel.
Consent and known-copy boundaries
Keep the source-system context visible. Consent remains in customer systems. Kestryl may inspect consent-related fields or recorded withdrawal signals within configured scope, while known-copy relationships are customer-declared or catalog-imported and undeclared copies remain outside the operating register.
Current scope and source boundaries
Confirm jurisdiction details before use. The jurisdiction index provides a high-level operating map. Confirm the applicable official federal, provincial, territorial, public-sector, or health-information source before using a detail for a legal or operational decision.

Jurisdiction index

Canadian privacy requirements by jurisdiction

This index preserves the source-content structure while keeping unresolved details visible. It is a high-level operating map, not a completed legal conclusion; confirm the applicable official source before using a detail for a legal or operational decision.

Canada privacy jurisdiction index
Jurisdiction	Private sector	Public sector	Health information	Oversight	Mandatory regulator reporting	Breach threshold / timing	Access response	Penalty ceiling
Federal	PIPEDA — current federal private-sector baseline	Scope varies by federal public-sector framework; confirm the applicable official source	Scope varies by federal and sector-specific health framework; confirm the applicable official source	Office of the Privacy Commissioner of Canada	Confirm the applicable reporting route for the facts and sector	Timing depends on the applicable rule and facts; confirm before use	Confirm the applicable access rule before use	Confirm the current official source before use
Quebec	Quebec private-sector regime / Law 25	Scope varies by Quebec public-sector framework; confirm the applicable official source	Scope varies by Quebec health-information framework; confirm the applicable official source	Commission d’accès à l’information du Québec	Confirm the applicable reporting route for the facts and sector	Timing depends on the applicable rule and facts; confirm before use	Confirm the applicable access rule before use	Confirm the current official source before use
Alberta	Private-sector scope depends on the applicable Alberta regime; confirm the official source	Scope varies by Alberta public-sector framework; confirm the applicable official source	Scope varies by Alberta health-information framework; confirm the applicable official source	Office of the Information and Privacy Commissioner of Alberta	Confirm the applicable reporting route for the facts and sector	Timing depends on the applicable rule and facts; confirm before use	Confirm the applicable access rule before use	Confirm the current official source before use
British Columbia	Private-sector scope depends on the applicable British Columbia regime; confirm the official source	Scope varies by British Columbia public-sector framework; confirm the applicable official source	Scope varies by British Columbia health-information framework; confirm the applicable official source	Office of the Information and Privacy Commissioner for British Columbia	Confirm the applicable reporting route for the facts and sector	Timing depends on the applicable rule and facts; confirm before use	Confirm the applicable access rule before use	Confirm the current official source before use
Ontario	Private-sector applicability depends on the organization and activity; confirm the official source	Scope varies by Ontario public-sector framework; confirm the applicable official source	Scope varies by Ontario health-information framework; confirm the applicable official source	Information and Privacy Commissioner of Ontario	Confirm the applicable reporting route for the facts and sector	Timing depends on the applicable rule and facts; confirm before use	Confirm the applicable access rule before use	Confirm the current official source before use
Manitoba	Private-sector applicability depends on the organization and activity; confirm the official source	Scope varies by Manitoba public-sector framework; confirm the applicable official source	Scope varies by Manitoba health-information framework; confirm the applicable official source	Confirm the current provincial oversight source	Confirm the applicable reporting route for the facts and sector	Timing depends on the applicable rule and facts; confirm before use	Confirm the applicable access rule before use	Confirm the current official source before use
Saskatchewan	Private-sector applicability depends on the organization and activity; confirm the official source	Scope varies by Saskatchewan public-sector framework; confirm the applicable official source	Scope varies by Saskatchewan health-information framework; confirm the applicable official source	Confirm the current provincial oversight source	Confirm the applicable reporting route for the facts and sector	Timing depends on the applicable rule and facts; confirm before use	Confirm the applicable access rule before use	Confirm the current official source before use
New Brunswick	Private-sector applicability depends on the organization and activity; confirm the official source	Scope varies by New Brunswick public-sector framework; confirm the applicable official source	Scope varies by New Brunswick health-information framework; confirm the applicable official source	Confirm the current provincial oversight source	Confirm the applicable reporting route for the facts and sector	Timing depends on the applicable rule and facts; confirm before use	Confirm the applicable access rule before use	Confirm the current official source before use
Nova Scotia	Private-sector applicability depends on the organization and activity; confirm the official source	Scope varies by Nova Scotia public-sector framework; confirm the applicable official source	Scope varies by Nova Scotia health-information framework; confirm the applicable official source	Confirm the current provincial oversight source	Confirm the applicable reporting route for the facts and sector	Timing depends on the applicable rule and facts; confirm before use	Confirm the applicable access rule before use	Confirm the current official source before use
Prince Edward Island	Private-sector applicability depends on the organization and activity; confirm the official source	Scope varies by Prince Edward Island public-sector framework; confirm the applicable official source	Scope varies by Prince Edward Island health-information framework; confirm the applicable official source	Confirm the current provincial oversight source	Confirm the applicable reporting route for the facts and sector	Timing depends on the applicable rule and facts; confirm before use	Confirm the applicable access rule before use	Confirm the current official source before use
Newfoundland and Labrador	Private-sector applicability depends on the organization and activity; confirm the official source	Scope varies by Newfoundland and Labrador public-sector framework; confirm the applicable official source	Scope varies by Newfoundland and Labrador health-information framework; confirm the applicable official source	Confirm the current provincial oversight source	Confirm the applicable reporting route for the facts and sector	Timing depends on the applicable rule and facts; confirm before use	Confirm the applicable access rule before use	Confirm the current official source before use
Yukon	Private-sector applicability depends on the organization and activity; confirm the official source	Scope varies by Yukon public-sector framework; confirm the applicable official source	Scope varies by Yukon health-information framework; confirm the applicable official source	Confirm the current territorial oversight source	Confirm the applicable reporting route for the facts and sector	Timing depends on the applicable rule and facts; confirm before use	Confirm the applicable access rule before use	Confirm the current official source before use
Northwest Territories	Private-sector applicability depends on the organization and activity; confirm the official source	Scope varies by Northwest Territories public-sector framework; confirm the applicable official source	Scope varies by Northwest Territories health-information framework; confirm the applicable official source	Confirm the current territorial oversight source	Confirm the applicable reporting route for the facts and sector	Timing depends on the applicable rule and facts; confirm before use	Confirm the applicable access rule before use	Confirm the current official source before use
Nunavut	Private-sector applicability depends on the organization and activity; confirm the official source	Scope varies by Nunavut public-sector framework; confirm the applicable official source	Scope varies by Nunavut health-information framework; confirm the applicable official source	Confirm the current territorial oversight source	Confirm the applicable reporting route for the facts and sector	Timing depends on the applicable rule and facts; confirm before use	Confirm the applicable access rule before use	Confirm the current official source before use

Related PDI views

Place the Canada view in the wider control framework.

Operationalize the outcomes

Operationalize these outcomes with Kestryl.

Kestryl Cockpit for Canada brings jurisdiction context, known-copy follow-through, approved actions and reviewable evidence into one operating view.

Explore Kestryl Cockpit for Canada →

Next step

Talk to PDI about privacy controls in Canada

Put your systems and Canadian jurisdictions into a reviewable privacy-control model.