Canada Privacy Addendum
Draft Canadian overlay; applicable federal and provincial law depends on the operator, activity and user location.
- Version:
- DRAFT-2026-10-12
- Effective:
- [EFFECTIVE_DATE]
- Updated:
- 2026-10-12
- Language:
- EN
Scope and accountability
PIPEDA may apply to commercial handling of personal information across Canada. Alberta and British Columbia have private-sector PIPA statutes, and Québec has its private-sector privacy law as amended by Law 25. The final applicability analysis is [CANADA_SCOPE_DECISION].
The accountable privacy contact is [PRIVACY_CONTACT].
Purposes and meaningful consent
Purposes, key consequences and any non-obvious disclosures must be explained in understandable form. Collection is limited to information reasonably required for the stated service.
Consent withdrawal is available subject to legal and contractual limits; the consequences of withdrawal must be explained.
Access, correction and complaints
Individuals may request access and correction and challenge compliance through [PRIVACY_CONTACT]. Identity verification, exceptions and response timing follow the law that applies.
Service providers and cross-border processing
Cross-border processing does not remove the operator's accountability. Provider, country, purpose and safeguards must be disclosed with sufficient clarity for meaningful consent where required.
Québec availability remains blocked pending French equivalence, a Law 25 privacy-impact assessment and transfer assessment.
Breach response
Incidents must be assessed for the applicable real-risk-of-significant-harm or provincial threshold. Required reports, individual notices and breach records must be completed within the applicable rules.