Privacy in a nonprofit: which laws apply in Canada

Current to October 11, 2026. This article is for information; it does not replace legal advice.

A nonprofit holds a lot of personal information: employee files, volunteer contact details, donor lists, sometimes health information about the people it serves. Knowing which law applies lets you answer an access request properly, handle an incident calmly and keep the trust of your community.

The first question to ask

There is no single law for all of Canada. Three things decide what applies:

• the province or territory where you operate;
• the nature of the activity (core activity of the organization or commercial activity);
• the type of information (employees, volunteers, clients, health).

Federal: PIPEDA

The Personal Information Protection and Electronic Documents Act (PIPEDA) covers information collected, used or disclosed in the course of commercial activities (s. 4). According to the Office of the Privacy Commissioner of Canada, it generally does not apply to not-for-profit and charity groups, unless they engage in commercial activities that are not central to their mandate (for example, selling a membership or donor list).

Key points:

• For employees, PIPEDA covers only federally regulated businesses.
• Organizations in Yukon, the Northwest Territories and Nunavut are considered federally regulated for PIPEDA purposes.
• Information that crosses provincial or national borders in a commercial context falls under PIPEDA, wherever the organization is based.
• Where it applies: answer an access request within 30 days, report to the Commissioner any breach that creates a real risk of significant harm (s. 10.1) and keep a record of every breach (s. 10.3).

The three provinces with their own law

Alberta, British Columbia and Quebec have a private-sector law deemed substantially similar to PIPEDA. Their rules for nonprofits differ.

British Columbia: PIPA covers nonprofits

The Personal Information Protection Act defines "organization" to include not for profit organizations. It therefore applies to all of their activities. Key points:

• designate one or more individuals responsible for compliance and make their title public;
• "employee" includes a volunteer: volunteer files follow the same rules;
• information needed to establish, manage or terminate the employment relationship may be collected without consent if reasonable, but the person must first be notified of the collection and its purposes (s. 13);
• answer an access request within 30 days.

Alberta: PIPA mainly covers the commercial activities of nonprofits

The Personal Information Protection Act (s. 56) applies to "non-profit organizations" only for their commercial activities, such as selling or leasing membership or donor lists. The definition covers organizations incorporated under the Societies Act or the Agricultural Societies Act, or registered under Part 9 of the Companies Act. An organization incorporated in another way could be covered for all of its activities: check your situation. Where the Act applies:

• notify the Commissioner, without unreasonable delay, of any incident that creates a real risk of significant harm (s. 34.1);
• answer an access request within 45 days.

Quebec: the private-sector act, modernized by Law 25

The Act respecting the protection of personal information in the private sector covers the carrying on of an enterprise within the meaning of article 1525 of the Civil Code: an organized economic activity, whether or not it is commercial in nature. Many nonprofits are therefore covered. The main obligations:

• the person with the highest authority is responsible for the protection of personal information; they may delegate this function in writing, and the title and contact information of the person in charge are published on the website (s. 3.1);
• adopt governance policies, including retention and destruction and complaint handling (s. 3.2);
• conduct a privacy impact assessment before any information system project (s. 3.3);
• for an incident that presents a risk of serious injury, notify the Commission d'accès à l'information and the people concerned (s. 3.5), and keep a register of incidents (s. 3.8);
• inform people, at the time of collection, of the purposes, the means and their rights (s. 8);
• answer an access request within 30 days (s. 32).

The other provinces: Saskatchewan, Manitoba, Ontario, New Brunswick, Nova Scotia, Prince Edward Island, Newfoundland and Labrador

These provinces have no general private-sector law. PIPEDA covers commercial activities there. For a nonprofit's core activities, usually no general law applies, but your members, funders and insurers still expect good practices.

Health information laws

Every province and territory, except Nunavut according to the Commissioner's list, has a law specific to health information. These laws mainly cover health care providers and health information custodians. If your organization provides health care or health services, check whether you are covered:

• British Columbia: E-Health (Personal Health Information Access and Protection of Privacy) Act;
• Alberta: Health Information Act;
• Saskatchewan: Health Information Protection Act;
• Manitoba: Personal Health Information Act;
• Ontario: Personal Health Information Protection Act, 2004;
• Quebec: Act respecting health and social services information;
• New Brunswick: Personal Health Information Privacy and Access Act;
• Nova Scotia: Personal Health Information Act;
• Prince Edward Island: Health Information Act;
• Newfoundland and Labrador: Personal Health Information Act;
• Yukon: Health Information Privacy and Management Act;
• Northwest Territories: Health Information Act.

Good practices that apply everywhere

1. Name a person in charge and publish their contact information.
2. Collect only what you need, and say why.
3. Limit access to files to those who need it.
4. Set a retention period, then destroy securely.
5. Prepare an incident procedure and keep a register.
6. Answer access requests on time (30 days in most cases, 45 in Alberta).
7. Train your team, volunteers included.

How Samwell helps

• A personal information register and tracking of access requests, with their deadlines.
• Role-based access: everyone sees what they need.
• Reminders for your team's mandatory training.

See the features or contact us.