Law 25 or PIPEDA: which privacy law applies to your organization
It is not a choice. The place of the activity, and whether the information crosses a border, decide the statute.
Law 25 amended Quebec's Act respecting the protection of personal information in the private sector. PIPEDA is the federal statute. They do not both govern the same activity inside Quebec. Each one applies on its own ground.
Activity in Quebec
When an enterprise collects, uses or discloses personal information in Quebec, the provincial act applies. Quebec's private-sector statute is recognized as substantially similar to the federal act for commercial activities inside the province.
Flows across provinces or outside Canada
When personal information is collected, used or disclosed in the course of a commercial activity from one province to another, or abroad, PIPEDA applies to that flow. A Quebec company selling to the rest of Canada has to read both statutes, each on its own ground.
Employees in Quebec
Employee information in Quebec falls under the provincial act. PIPEDA covers employees only for federal works, such as a bank, a telecom or an interprovincial carrier.
What not to conclude
A head office in Montreal does not remove the need to assess a transfer outside Quebec. Customers in Ontario do not replace Law 25 duties for activities carried out in Quebec, including the policy, the privacy officer and confidentiality incidents.
One program for both statutes, without duplicating the work
CapGRC maps Law 25 and PIPEDA requirements to the same controls and the same evidence.