PIPEDA and Your AI Stack: The Vendor Isn't Liable — You Are
Pushing customer data into an AI tool does not push the liability with it. PIPEDA makes you the "organization" — the 5 places AI tools break compliance, and why Quebec's Law 25 is the sharper knife.
Under PIPEDA — Canada's federal privacy law — the legal responsibility for your customers' personal data stays with you, not with the AI vendor you pushed that data into. OpenAI, HubSpot, and every other tool in your stack are third-party processors. You are the "organization." When something goes wrong, the Privacy Commissioner comes to your door.
That single sentence is the whole reason a slide in my talk says "customer data is your asset." It isn't a motivational line. It's a description of where liability sits.
What is PIPEDA?
PIPEDA stands for the Personal Information Protection and Electronic Documents Act. It is Canada's federal law governing how private-sector organizations collect, use, and disclose personal information in the course of commercial activity. It came into full force in 2004.
It applies to every private business — including small ones, freelancers, and two-person agencies. There is no revenue threshold and no employee-count exemption. If you have a customer list, PIPEDA applies to you.
The provincial exception: Quebec, Alberta, and British Columbia have their own private-sector privacy laws deemed "substantially similar," which replace PIPEDA for intra-provincial transactions. Quebec's is Law 25, and it is materially stricter than PIPEDA. But the moment data crosses a provincial border or leaves the country, PIPEDA is back in play.
The 10 principles, reduced to what you actually have to do
PIPEDA's Schedule 1 lists ten fair information principles. In practice they collapse into six obligations:
| Principle | What it means on a Tuesday |
|---|---|
| Consent | Consent must be meaningful — the person has to understand what they agreed to. Sensitive data requires express opt-in, not a line buried in your Terms of Service |
| Identifying purposes | State why you're collecting, at or before the moment you collect |
| Limiting collection & use | Take only what the stated purpose needs. A new purpose requires new consent |
| Accuracy & safeguards | Keep data correct, and protect it proportionally to its sensitivity — encryption, access control, the basics |
| Individual access | Customers can demand to see their data and correct it if it's wrong |
| Openness & accountability | A public privacy policy, plus a named person who is accountable for compliance |
That last one surprises people. PIPEDA requires you to designate an individual — by name — who is responsible for the organization's compliance. Not a department. A person.
Where AI tools break this
Here is the part most founders get wrong, and it's the reason I put this on a slide instead of leaving it in a footnote.
1. The vendor is not liable. You are. You are the "organization" under PIPEDA. Your AI vendor is a third-party processor. Legal responsibility does not transfer with the data. You cannot point at OpenAI, Anthropic, or HubSpot when a regulator asks who was accountable — the answer is you, by law.
2. Accountability follows the data out the door. The accountability principle requires you to secure, by contract, a "comparable level of protection" from any third party you hand personal information to. That means reading the vendor's DPA, not clicking through it.
3. Cross-border transfer is legal — but only if you disclose it. Storing Canadian customer data on U.S. servers is permitted under PIPEDA. What is not permitted is doing it silently. You must tell customers their data may be processed outside Canada and may therefore be subject to foreign jurisdiction.
4. Feeding customer data into an AI tool for training is a NEW purpose. This is the most common trap right now. You collected an email address to fulfill an order. Pasting that customer's support conversation into a model that trains on it is a different purpose than the one you disclosed — and a different purpose requires fresh consent.
5. Vendor lock-in is a compliance risk, not just a business risk. If you can't export your data, you cannot satisfy a customer's access, correction, or deletion request. A tool that traps your data doesn't just make switching expensive — it makes you non-compliant the first time someone exercises their rights.
What are the penalties under PIPEDA?
Honestly? Weaker than most people assume — and that's an argument for looking at provincial law, not for relaxing.
- The Office of the Privacy Commissioner of Canada (OPC) investigates and issues findings and recommendations, but cannot levy fines on its own.
- Specific offences — obstructing an investigation, failing to report a breach — carry fines up to $100,000 CAD.
- Breach reporting has been mandatory since November 2018. Any breach posing a "real risk of significant harm" must be reported to the OPC and to affected individuals, and you must keep records of every breach for 24 months, harmful or not.
For scale: GDPR reaches 4% of global revenue. Quebec's Law 25 reaches $25 million CAD or 4% of worldwide turnover, whichever is higher. If any part of your customer base is in Quebec, Law 25 — not PIPEDA — is the sharp end of the knife.
Isn't PIPEDA being replaced?
It was supposed to be. Bill C-27 would have replaced PIPEDA with the Consumer Privacy Protection Act (CPPA) and introduced AIDA, Canada's first AI-specific statute, along with penalties reaching 5% of global revenue. The bill died on the order paper when Parliament was prorogued in January 2025.
So PIPEDA remains the law in force. But this is an actively moving file — verify the current legislative status before you put a number on a slide.
The one-line version
Your customer data is an asset you are legally responsible for. Every AI tool you add to your stack borrows that asset without taking on the liability. Before the next integration, ask three questions: Can I export everything? Did I tell customers where this data goes? Is this the purpose they consented to?
FAQ
Does PIPEDA apply to a one-person business? Yes. There is no size or revenue exemption. Any private-sector organization collecting personal information for commercial activity is covered.
If my AI vendor has a breach, who is responsible? You are. Under PIPEDA you remain accountable for personal information transferred to a third-party processor, and you must ensure comparable protection by contract.
Can I store Canadian customer data on U.S. servers? Yes, PIPEDA permits cross-border transfers. But you must notify customers that their data may be processed outside Canada and subject to foreign law.
Do I need new consent to put customer data into an AI tool? If the AI use is a different purpose than the one originally disclosed — training a model, for example — then yes, a new purpose requires new consent.
How much can PIPEDA fine me? Up to $100,000 CAD for specific offences. The OPC cannot issue administrative fines directly. Quebec's Law 25, by contrast, reaches $25M CAD or 4% of worldwide turnover.
Reference: Office of the Privacy Commissioner of Canada — PIPEDA
#PIPEDA #DataPrivacy #CanadianBusiness #AIGovernance #Compliance #Law25 #SmallBusiness
✍️ The Author: Do Ngoc Hoan Founder of CookConnects.ca & Wizy.ca. Bridging the gap between advanced algorithms and business execution. I write for technical founders looking to scale their impact with AI and robust engineering.