Selling company data to AI labs in Canada
Before company data goes to an AI lab, the privacy law where the people in it live asks one question: can anyone still be identified from it? This page explains the main laws in Canada, what counts as no longer personal, and what to check first. General information as of 2026-10-27, not legal advice: your counsel confirms what applies to your company.
At a glance
| Main laws | There is no single privacy law. The federal PIPEDA covers private-sector organizations whose personal information crosses provincial or national borders. Alberta, British Columbia and Quebec have their own private-sector laws, and Ontario and some other provinces have health information laws. Federal reform of PIPEDA has been proposed before and is not law at the last check, so check Parliament's site for its current status. |
|---|---|
| What counts as de-identified | It depends on the law. Under PIPEDA, information is personal if it is about an identifiable individual, and the Federal Court has tied this to whether there is a serious possibility that someone could be identified. Quebec has a separate regulation on anonymization, with a very low residual risk test as the government describes it. Ontario health law uses a 'reasonably foreseeable in the circumstances' test. |
| Who enforces | The Office of the Privacy Commissioner of Canada for PIPEDA, and the provincial commissioners in Quebec, Alberta, British Columbia and Ontario for their laws. |
| Moving data abroad | Canada has no general ban. PIPEDA keeps the organization accountable and expects comparable protection by contract. Quebec requires a written privacy assessment before information leaves the province. Alberta requires telling people when a service provider outside Canada is used. |
The main laws, and what each means for selling data
Personal Information Protection and Electronic Documents Act (PIPEDA)
The federal private-sector law. It applies to organizations that handle personal information across provincial or national borders, and it defines personal information as information about an identifiable individual.
Handing customer or employee-linked records to an AI lab is a disclosure of personal information. The consent principle in PIPEDA expects people to know about and agree to the disclosure, unless an exception applies. For example, a software company that wants to license support tickets that contain customer names and email addresses would need to check what customers were told when the tickets were collected, or remove the personal information first.
Source: Justice Laws Website, PIPEDA; Office of the Privacy Commissioner of Canada
Quebec Act respecting the protection of personal information in the private sector (Law 25 amendments)
Quebec's private-sector law, as amended by Law 25. It applies to enterprises that collect, hold or use personal information about people in Quebec, and it is overseen by the Commission d'acces a l'information.
Quebec has a regulation on anonymization, and information that does not meet its standard stays personal information. A company in Montreal that wants to sell a ticket archive would need to check that regulation before treating the data as anonymized, including a documented re-identification risk analysis.
British Columbia Personal Information Protection Act (PIPA)
BC's private-sector law. It covers organizations in BC, and defines personal information as information about an identifiable individual, including employee personal information but not business contact information.
Section 6 sets consent as the general rule for disclosure. The business transaction rule in section 20 is limited to deals such as a sale or merger of an organization or its business assets, and section 20(7) does not allow it where the deal involves no substantial assets beyond the personal information itself. A BC retailer that wants to license customer chat logs should not assume the business transaction rule covers a data-only licence.
Alberta Personal Information Protection Act (PIPA)
Alberta's private-sector law. It covers organizations in Alberta and is overseen by the Office of the Information and Privacy Commissioner of Alberta.
Section 13.1 says that when an organization uses a service provider outside Canada, or transfers personal information outside Canada, it must notify the individual and name a person who can answer questions. An Alberta company that wants to send records to a lab in the United States would need to check that notice duty, along with the consent rules, before the data leaves.
Source: Alberta King's Printer and Office of the Information and Privacy Commissioner of Alberta
Ontario Personal Health Information Protection Act, 2004 (PHIPA)
Ontario's health information law. The Office of the Privacy Commissioner of Canada lists it as declared substantially similar to PIPEDA for health information, and it applies to health information custodians.
PHIPA defines to de-identify as removing information that identifies the individual or for which it is reasonably foreseeable in the circumstances that it could be used, alone or with other information, to identify the individual. In a published decision, the Ontario commissioner treated de-identifying health information as a use, and said a custodian must be open about selling de-identified data. A clinic group that wants to license appointment notes would need to meet that test and tell patients about the practice.
Source: Information and Privacy Commissioner of Ontario, PHIPA Decision 175 and De-identification Guidelines
How Canada decides data is no longer personal
Under PIPEDA, personal information means information about an identifiable individual. The Federal Court has said information is about an identifiable individual when there is a serious possibility that someone could be identified through that information, alone or combined with other available information. That case was decided under a different federal law, so it shows how the courts reason, not a fixed PIPEDA checklist. The Office of the Privacy Commissioner of Canada summarizes it on its site.
Quebec is more specific, with its own regulation on anonymization. As the government and the official listing describe it, the organization sets its purposes first, a qualified person supervises, direct identifiers are removed, and a re-identification risk analysis is done before and after. The result must show that re-identification is no longer reasonably foreseeable, with residual risk very low, and the work is reviewed over time and recorded in a register. The Quebec government describes three tests: no one can be singled out, records cannot be linked, and no new facts about a person can be inferred.
Ontario health law has its own wording. De-identify means removing information that identifies the individual or for which it is reasonably foreseeable in the circumstances that it could be used, alone or with other information, to identify them. The Ontario commissioner published updated de-identification guidelines for structured data in October 2025. A re-identification check in practice means testing the cleaned data against what outsiders could realistically combine it with, and writing down the result.
Sources: OPC, summary of Gordon v. Canada (Health), Legis Quebec, Regulation respecting the anonymization of personal information, Gouvernement du Quebec, Anonymisation, Information and Privacy Commissioner of Ontario, PHIPA Decision 175, Information and Privacy Commissioner of Ontario, De-identification Guidelines for Structured Data (October 2025)
Records that carry extra rules
Health records
Ontario's PHIPA applies to custodians and uses a reasonably foreseeable test for de-identification. In a published decision the Ontario commissioner said custodians must be open with patients about de-identifying and selling data.
Employee information
BC PIPA treats employee personal information as personal information with its own disclosure rules in section 19, and requires notice to the employee before disclosure without consent.
First Nations data (OCAP)
OCAP stands for Ownership, Control, Access and Possession. The First Nations Information Governance Centre presents it as a set of principles for how First Nations data is handled. It is not a statute, but a company holding records about a First Nation or its members should consider it before licensing them.
Sensitive data in general
PIPEDA expects safeguards to match sensitivity, and the Privacy Commissioner has said highly sensitive information may not be suitable for any transfer abroad.
Sending data to an AI lab in another country
PIPEDA does not ban sending personal information to another country. The Privacy Commissioner's guidance says the organization stays accountable and should use contracts or other means to give a comparable level of protection, and should be open with people that their information may be handled abroad and be reachable by foreign authorities. That guidance is written about a third party processing information for the organization. A sale or licence where the buyer uses the data for its own purposes is a different arrangement, so check how the consent and accountability rules apply.
Quebec goes further. Before personal information is communicated outside Quebec, the enterprise must run a privacy impact assessment covering sensitivity, purpose, safeguards and the destination's legal framework, and a written agreement must reflect the result. Alberta requires notice to individuals when a service provider outside Canada is used or information is transferred outside Canada.
Sources: OPC, Guidelines for processing personal data across borders, OPC, Privacy laws in Canada and substantially similar provincial laws, Legis Quebec, Act respecting the protection of personal information in the private sector, section 17, Alberta King's Printer, Personal Information Protection Act, section 13.1
Who enforces it
- Office of the Privacy Commissioner of Canada
- Commission d'acces a l'information du Quebec
- Office of the Information and Privacy Commissioner of Alberta
- Office of the Information and Privacy Commissioner for British Columbia
- Information and Privacy Commissioner of Ontario
- First Nations Information Governance Centre
Questions about selling data from Canada
Is it legal to sell company data to an AI company in Canada?
It depends on what is in the data. Business records with no personal information are not covered by the privacy laws. Records about identifiable people are, and a disclosure generally needs consent or another legal basis. This is general information, not legal advice, and it does not promise any deal will meet the law.
Do I need consent from customers to license support tickets or emails?
If the tickets or emails contain information about identifiable people, PIPEDA and the provincial laws generally expect knowledge and consent for disclosure, unless an exception applies. Removing personal information first can change the answer, but only if the removal meets the legal test where you operate. This is general information, not legal advice, so check your own facts.
What is the difference between de-identified and anonymized data in Canada?
Personal information is information about an identifiable individual. Information that has been properly anonymized, so that no one can reasonably be identified from it, is generally outside the privacy laws, and Quebec has a formal anonymization regulation. De-identified information, where identifiers are removed but people could still be identified, can stay personal information. This is general information, not legal advice.
Can I send Canadian data to an AI company in the United States?
Canada has no general ban on sending personal information abroad. PIPEDA expects accountability and comparable protection, Quebec requires a written privacy assessment first, and Alberta requires notice to individuals. This is general information, not legal advice.
Is there a new federal privacy law in Canada?
Not at the last check. PIPEDA and the provincial laws still apply, and a federal bill to replace part of PIPEDA has been before Parliament without becoming law. Its stage can change, so check the Parliament of Canada site for the current status. This is general information, not legal advice.
Didn't find your question? Ask us directly.
What we do about it
We find and remove the personal information in your company data, test whether anyone could still be identified, and write down how it was done for your counsel. If you license the data through us, the AI lab usually pays for that work, and the AI lab pays our broker fee, only after the deal closes. See how de-identification works and how licensing your data works.
Rules in other regions
- United States: HIPAA, California and other state laws, the FTC, and the records that carry extra rules.
- United Kingdom: The UK GDPR, the Data Protection Act 2018, the 2025 Act and the ICO anonymisation guidance.
- European Union: The GDPR, the EDPB on anonymisation and AI models, and the EU AI Act.
- Australia: The Privacy Act 1988, the Australian Privacy Principles, OAIC guidance and health records laws.