PIPEDA

The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's federal private-sector privacy law. It sets the ground rules for how private businesses collect, use, and disclose personal information in the course of for-profit, commercial activity across Canada. It also covers the personal information of employees of federally regulated businesses such as banks, airlines, and telecom companies. The Office of the Privacy Commissioner of Canada (OPC) oversees and enforces it.

Why it matters for sovereign operators

If you run a Bitcoin mining shop, a hosting facility, or any online store that handles customer data, PIPEDA likely applies to you. It is built on ten fair information principles set out in Schedule 1: accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and challenging compliance. In plain terms: tell people why you collect their data, get meaningful consent, secure it, and let them see and correct it.

How it applies in Quebec and across provinces

Quebec, British Columbia, and Alberta have their own private-sector privacy laws deemed "substantially similar" to PIPEDA. Where those apply, organizations are generally exempt from PIPEDA for activity occurring within that province. A D-Central operating in Longueuil, Quebec is primarily governed by Quebec's Law 25, while PIPEDA still reaches cross-border and inter-provincial commercial data flows. PIPEDA does not force data to stay in Canada, but it does require that information sent to a third party for processing receive comparable protection wherever it goes.

This is general information, not legal advice — consult a qualified professional before making compliance decisions. For the Quebec-specific picture see Quebec Law 25 and on-premise AI, and for where your data physically lives see Quebec data residency.