Failure Patterns and Official Sources
ERP privacy in Canada: PIPEDA, Quebec Law 25 and data residency
What PIPEDA and Quebec Law 25 require when your ERP SaaS holds personal information: accountability, privacy officer, PIAs for transfers outside Quebec, and hosting choices.
An ERP holds customer contacts, employee records, payroll summaries and sometimes payment details, so choosing a SaaS vendor is also a privacy decision. Under the federal PIPEDA, you remain accountable for personal information you transfer to a vendor for processing and must protect it through contracts and safeguards; hosting outside Canada is not banned, but you should be transparent about it. If your business is subject to Quebec's private-sector privacy act as amended by Law 25, there are further duties: a person in charge of personal information protection, a privacy impact assessment (PIA) for information-system projects involving personal information, and an assessment before personal information is communicated outside Quebec. Build these into vendor selection, not after go-live.
This guide is general information as of October 2026, not legal advice. It is part of the failure patterns and official sources pillar.
Which law applies to you
| Law | Applies to | Regulator |
|---|---|---|
| PIPEDA (Personal Information Protection and Electronic Documents Act) | Private-sector organisations in the course of commercial activities, in provinces without a substantially similar law, and federally regulated businesses | Office of the Privacy Commissioner of Canada |
| Quebec Act respecting the protection of personal information in the private sector (amended by Law 25) | Enterprises collecting, holding or using personal information in Quebec | Commission d'accès à l'information du Québec |
| Alberta and British Columbia Personal Information Protection Acts | Private-sector organisations in those provinces | Each province's privacy commissioner |
| Provincial health-information laws | Health custodians | Provincial regulators |
A federal bill to replace PIPEDA's private-sector rules (the proposed Consumer Privacy Protection Act in Bill C-27) did not become law before Parliament was prorogued in January 2025, so PIPEDA remains the federal law. A new bill, C-36 (the proposed Protecting Privacy and Consumer Data Act), was introduced in June 2026 and was still at second reading in the House of Commons in October 2026; it is not law. Check LEGISinfo and the OPC site for its progress.
PIPEDA: what it means for an ERP purchase
- Accountability. You are responsible for personal information in your possession or custody, including information transferred to a third party for processing. Use contractual means to ensure a comparable level of protection.
- Safeguards. Security appropriate to the sensitivity: access controls, encryption, logging, role-based permissions (for example limiting who sees payroll details).
- Openness. If information may be processed or stored outside Canada, tell individuals in your privacy notice that it may be accessible to foreign authorities under the laws of that jurisdiction.
- Breaches. Breaches of security safeguards that create a real risk of significant harm must be reported to the OPC and notified to affected individuals, and records of all breaches must be kept. Your contract should require the vendor to tell you quickly.
Quebec Law 25: the points that affect ERP projects
Law 25 brought in its changes in stages between 2022 and 2024. The provisions most relevant to an ERP purchase are now in force:
- Person in charge of the protection of personal information. By default this is the person with the highest authority in the enterprise, who can delegate the role in writing. Their title and contact information must be published, for example on your website (in force since September 2022).
- Confidentiality incidents. Incidents presenting a risk of serious injury must be reported to the CAI and affected people, and a register of incidents kept (since September 2022).
- PIA for information-system projects. A privacy impact assessment is required for any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information (since September 2023). An ERP replacement is a typical example.
- PIA before communicating outside Quebec. Before communicating personal information outside Quebec, including to a cloud vendor hosting it elsewhere in Canada or abroad, you must assess whether it would receive adequate protection, considering its sensitivity, purpose, safeguards (including contractual ones) and the legal framework where it goes. The communication must be covered by a written agreement (since September 2023).
- Data portability. Since September 2024, individuals can ask for computerised personal information they provided to be communicated in a structured, commonly used technological format. Check that your ERP can export it.
Penalties under the amended act can be substantial, including administrative monetary penalties imposed by the CAI of up to $10 million or 2% of worldwide turnover for the preceding fiscal year, whichever is greater, and penal fines of up to $25 million or 4% of worldwide turnover. Check the CAI for current guidance and templates.
Data residency choices
| Option | What it means | Considerations |
|---|---|---|
| Canadian region of a cloud vendor | Primary data stored in Canadian data centres | Check backups, support access and sub-processors, which may still be abroad |
| Vendor's default region abroad | Data stored outside Canada | Notice to individuals; Quebec PIA; CRA records expectations |
| Hosted in Canada by a partner | Your own instance in a Canadian facility | You may take on more administration |
| On-premise | Data on your servers | You carry security, backup and recovery |
Residency also matters for records: the CRA's published position is that electronic records kept outside Canada are not considered kept in Canada, even if accessible from here, unless you have its permission. See CRA record-keeping and cloud ERP.
Questions to ask every ERP vendor
- Where are production data, backups and disaster-recovery copies stored?
- Which sub-processors can access our data, from which countries, and how are we told of changes?
- How quickly will you notify us of a security incident?
- Can we restrict access to payroll and HR fields by role?
- Can we export personal information for portability or access requests?
- What happens to our data at contract end, and how is deletion confirmed?
- Do you provide a data-processing agreement suitable for PIPEDA and Quebec requirements?
Cost of compliance (illustrative)
A small business might spend a few days of internal time on a PIA using templates from the CAI; a larger one may hire a privacy professional for a few thousand dollars or more. Budget it as a one-time project line in the TCO.
FAQ
Do I need a Canadian data centre to comply with PIPEDA?
No. PIPEDA does not require data to stay in Canada, but you must protect it and be transparent about processing abroad.
Does Law 25 apply if my head office is outside Quebec?
It can apply to enterprises that collect or hold personal information of people in Quebec. Get advice if you are unsure.
Is hosting in Ontario "outside Quebec"?
Yes. Communicating personal information from Quebec to a data centre in another province is a communication outside Quebec for Law 25 purposes, so the assessment applies.
Who should do the PIA?
The enterprise, usually led by the person in charge of personal information protection, with input from IT and the vendor.
Sources
- Office of the Privacy Commissioner of Canada — PIPEDA, processing across borders, breach reporting
- Commission d'accès à l'information du Québec — Law 25 guidance, PIA and incident templates
- LégisQuébec — Act respecting the protection of personal information in the private sector
- Justice Laws Website — PIPEDA text
