Does Canadian privacy law apply to you yet
Most free privacy checkers online are built around GDPR or CCPA, both of which gate on a threshold: an EU audience, a revenue figure, a subject count. Canada has none of that. PIPEDA applies the moment you collect one customer’s name and email in the course of business, whatever your size.
The tool below asks five questions and tells you exactly which of PIPEDA, Quebec’s Law 25, and CASL apply, and what each one specifically requires. The article underneath explains how the three relate to each other.
Privacy Obligations Checker
Work out which of PIPEDA, Quebec’s Law 25, and CASL actually apply to what you collect and send, and what each one specifically requires. No revenue threshold, no size cutoff — Canadian privacy law does not have one.
5 questions, about 2 minutes. Your name and email unlock the result.
Built for Canadian companies collecting personal information or sending commercial email, whatever their size. Covers PIPEDA, Quebec Law 25, and CASL.
PIPEDA vs Quebec Law 25 vs CASL
Three regimes, three different triggers, and most startup checklists skip at least one of them entirely.
| Regime | What it actually requires | When it applies |
|---|---|---|
| PIPEDA | The federal baseline: an accessible privacy policy, real consent, safeguards, and a way to challenge how information was handled. No revenue threshold, no small-business exemption. | Any organization collecting, using, or disclosing personal information in the course of commercial activity. In practice: almost every startup with a single customer. |
| Quebec Law 25 | A named privacy officer, a privacy impact assessment before any cross-border data transfer, faster breach notification, and a private right of action an individual can bring directly. | Any business handling a Quebec resident's personal information, wherever the business itself is located. |
| CASL | Opt-in consent before a commercial electronic message, the reverse of the US default. Sender identification, a working unsubscribe mechanism, and specific expiry windows on implied consent. | Any commercial electronic message: marketing emails, promotional texts, even a plain "check out our new feature" note. |
Questions founders ask
No. Unlike GDPR's reach into any EU-facing business or CCPA's revenue and data-volume thresholds, PIPEDA has no small-business exemption and no revenue floor. Collecting one customer's name and email in the course of commercial activity is enough to bring PIPEDA's accountability principle into play.
If any of your customers or users live in Quebec, yes. Law 25 looks at where the individual lives, not where your company is incorporated or headquartered. A Toronto or Vancouver company with Montreal customers is squarely in scope.
Usually yes. CASL's definition of a commercial electronic message is broad: any message that encourages participation in a commercial activity, which covers a feature announcement or a re-engagement nudge as much as a discount code. The safer assumption is that most email from a business to a prospect or customer qualifies, and to have a real consent basis before sending it.
Express consent is an active opt-in, typically a dedicated checkbox, and it does not expire on its own. Implied consent arises automatically from a real transaction, contract, or inquiry, but it is time-limited: CRTC guidance treats a transaction or contract as giving implied consent for two years, and a bare inquiry for six months. After that window closes, sending to that address again needs express consent instead.
Those tools are built around thresholds that do not exist in Canada, an EU audience for GDPR, a revenue or data-volume figure for CCPA, and founders who run through them often conclude they are exempt. PIPEDA has no such floor, Law 25 reaches based on where the customer lives rather than where the business is, and CASL's opt-in default is the reverse of the US rule these tools assume. This one is built for the actual Canadian regime, not adapted from one that was not written for it.
Last reviewed 2026-08-26 by Brooke Ash, Head of Legal, Ruby. This tool gives general information, not legal advice, and using it does not create a solicitor-client relationship. Your situation may turn on facts this assessment does not ask about.
Ready to get this handled?
Tell us about your matter and a Ruby lawyer will follow up directly.