Comparative Table Of Personal Information Protection Laws

Canada's proposed Digital Safety Act introduces sweeping new obligations for social media platforms, AI chatbots, and interactive online services, requiring operators to protect children, mitigate harmful content, and implement age-verification measures. Organizations face substantial penalties of up to 5% of global revenue for non-compliance, backed by a new federal regulator with broad enforcement powers. What steps should your organization take now to prepare for this emerging regulatory framework?

Affected U.S. businesses should review their current practices and consider establishing the safeguards set forth in the proposed regulations to avoid monetary penalties.

On March 19, 2015, the United States District Court in the District of Minnesota gave preliminary approval to a proposed settlement for the December 2013 data breach suffered by Target Corporation.

On October 20, 2026, the Office of the Privacy Commissioner of Canada (OPC) released its Children’s Privacy Code (“the Code”). It is not new legislation, but that does not make it optional. The Code lays out how the OPC reads the Personal Information Protection and Electronic Documents Act (PIPEDA) when children’s personal information is involved online, and it is a clear preview of what the regulator will look for in complaints and investigations.

Foreign companies entering Canada often assume their existing privacy programs designed for GDPR or CCPA compliance can simply extend to Canadian operations, but Canada's legal requirements demand targeted modifications. This comprehensive guide examines Canada's private sector privacy legislation, breach reporting obligations, AI governance expectations, and anti-spam regulations that businesses must navigate before launching in the Canadian market.

Canada's privacy regulator has released new draft guidance establishing comprehensive due diligence standards for organizations evaluating third-party service providers under PIPEDA. The framework introduces eleven best practices covering everything from data flow mapping and AI training data sourcing to vendor lock-in risks and ongoing monitoring obligations, signaling heightened expectations for privacy accountability in vendor relationships.

Federal and provincial privacy regulators have concluded a multi-year investigation into OpenAI's data practices, finding contraventions of Canadian privacy legislation in how personal information was collected and used...

Canadian privacy regulators have completed a joint investigation into OpenAI's ChatGPT, examining whether the company's collection, use, and disclosure of personal information complies with federal and provincial private-sector privacy legislation. The investigation involved the Office of the Privacy Commissioner of Canada alongside regulators from Quebec, British Columbia, and Alberta, scrutinizing OpenAI's practices in developing and operating its AI chatbot platform.

Canada's Office of the Privacy Commissioner has launched the country's first Children's Privacy Code, establishing comprehensive guidelines for how organizations must handle the personal information of minors online. The Code introduces strict requirements around consent, data minimization, and prohibits practices like behavioral profiling for marketing purposes, with expectations that organizations implement age-appropriate privacy protections now rather than waiting for upcoming legislative changes.

The Canadian market is ripe with opportunities for U.S. companies seeking to expand beyond domestic borders. Before diving in, however, it can be helpful to have a basic understanding of Canada's legal system...

A regulatory shift now under consideration in Ontario could reshape how the province’s medical aesthetic clinics operate. The proposal, which would change how nurses are authorized to administer medical aesthetic services, invites a broader look at how Ontario currently regulates cosmetic injections and how the proposed changes would align the province more closely with the regulatory frameworks already in place elsewhere in Canada. While these procedures are often marketed as routine “spa” services, they remain medical acts that involve prescription products and carry clinical risks.

Starting November 1, 2026, BC's pay transparency reporting obligation expands to cover employers with 50 or more employees, significantly broadening the scope of the Pay Transparency Act and Pay Transparency Regulation (the "Act").

These ailments are usually short-term conditions, which can be reliably self-diagnosed and managed with minor treatment and minimal follow-up care.

Effective September 8, 2026, Canada implemented retaliatory tariffs on certain U.S. goods in response to the initial 50% tariffs imposed by the US under Section 338 of the Tariff Act of 1930. To operationalize these measures, the Canada Border Services Agency (CBSA) issued Customs Notice 26-23, establishing binding administrative rules on how the surtax will be applied, calculated, and collected.

The Office of the Superintendent of Financial Institutions (OSFI) published its third quarterly release of the year on September 10, 2026, noting that the targeted adjustments made to its guidance were made with a view to supporting a resilient and competitive Canadian financial system.

The Bank of Canada (the “Bank”) has published two proposed guidelines relating to the accreditation process for prospective participants under the Consumer-Driven Banking Framework: the Participating entity accreditation application requirements under the Consumer-Driven Banking Act (the “Participating Entity Guideline”) and the Third-party service provider accreditation application requirements under the Consumer-Driven Banking Act (the “TPSP Guideline”).

On July 29, 2026, Health Canada announced that it had obtained a permanent injunction against a Québec-based company in connection with the sale of unauthorized injectable peptides in Canada. The announcement reflects Health Canada’s continued focus on peptide products and serves as a reminder that injectable peptides intended for human use are regulated as prescription drugs and are subject to Canada's drug regulatory framework.

This Bulletin summarizes key regulatory developments impacting the payments sector in 2025 and looks ahead to 2026.

A new regulatory framework for measuring and monitoring the energy performance of Québec’s building stock took effect on July 8, 2026, under the Regulation respecting the mandatory reporting of the environmental performance of certain buildings (the “Regulation”).

Under Order in Council 1358-2026, the Québec government authorizes, from September 7, 2026 to January 31, 2027, the Centre d'acquisitions gouvernementales (the “CAG”) to depart from the general principle that public calls for tenders must be open and without discrimination to foreign suppliers from jurisdictions bound by an intergovernmental agreement with Québec.