The federal Act applies to personal information handled in the course of commercial activity. Feeding that information to a tool is a use, and a use is squarely inside the Act.
Key takeaways
Yes, in almost every configuration a Canadian professional firm will find itself in. Section 4(1) of the Personal Information Protection and Electronic Documents Act applies the Act to every organisation in respect of personal information that it collects, uses or discloses in the course of commercial activities, and separately to employee information where the organisation operates a federal work, undertaking or business. Section 4(2) excludes government institutions covered by the Privacy Act, individuals acting for purely personal or domestic purposes, and organisations handling information solely for journalistic, artistic or literary purposes. A fee-charging firm is none of those.
The question people are usually asking underneath is different: does putting a client file through an AI tool trigger anything new? It does not trigger a new statute. It triggers the same obligations you already had, in a setting where they are easier to breach without noticing.
The Office of the Privacy Commissioner’s summary of privacy laws in Canada sets out the map. PIPEDA generally applies to private-sector organisations that are not federally regulated and conduct business in Manitoba, New Brunswick, Newfoundland and Labrador, the Northwest Territories, Nova Scotia, Nunavut, Ontario, Prince Edward Island, Saskatchewan and Yukon. Alberta, British Columbia and Quebec have general private-sector laws that have been deemed substantially similar, and PIPEDA does not apply to organisations operating entirely within those three provinces — unless the personal information crosses provincial or national borders, in which case it does. Federally regulated organisations are always subject to PIPEDA and must apply it to their employees’ information as well.
Read that last carve-out carefully in an AI context. A Vancouver firm using a tool whose processing happens outside British Columbia is moving personal information across a border, which is the condition that brings PIPEDA back into play alongside the provincial law. Treadstone Law’s note on whether PIPEDA applies to your business covers the general test.
Section 4.01 says the Act does not apply to an organisation in respect of the business contact information of an individual that it collects, uses or discloses solely for the purpose of communicating or facilitating communication with that individual in relation to their employment, business or profession. That covers a name, title and office phone number used to arrange a call. It does not cover the contents of the matter they are involved in, and the word “solely” does real work — the moment the same record is used for something else, the carve-out stops applying.
For what counts as personal information in the first place, Treadstone Law’s answer on the PIPEDA definition is the shorter route than reading the case law.
The Commissioner is explicit that generative AI does not sit outside the existing framework and that organisations developing, providing or using it must comply with applicable privacy law. The joint principles for generative AI then set out what that looks like for a firm on the using side. Four of them bite hardest on a professional practice.
The Commissioner’s shorter page for organisations, AI, privacy, and your business, condenses the same list — establish legal authority, be transparent, make the tools explainable, develop safeguards, limit the sharing of personal, sensitive or confidential information, and build privacy in by design.
A misconfigured tool that exposes a client folder is a breach of security safeguards, and the reporting obligation does not soften because the exposure came through a vendor. Treadstone Law sets out the mechanics in mandatory data breach reporting under PIPEDA. Work out before deployment who at the firm would know, and how quickly, if a tool leaked.
A Halifax firm with clients in Nova Scotia and Alberta wants to run a document-extraction tool over incoming client files. Nova Scotia has no general private-sector privacy statute, so PIPEDA governs the firm’s commercial activities there; the Alberta work engages Alberta’s law, and because information moves between provinces PIPEDA is engaged as well. The firm does not need to pick one. It needs one standard high enough to satisfy both, which in practice means documenting the purpose, minimising what is sent, contracting for a comparable level of protection, and being able to say where the information went.
What the firm can count: the proportion of matters where a documented purpose exists before the tool is used, the number of fields sent to the vendor that were not necessary, and time to detection in a tabletop breach exercise. All three are measurable before and after.
This page is written for a firm that delivers work to a book of clients. If the question is really about the front desk — intake, scheduling, recall, reminders — that lives on the professional practice owners page. If it is about your own month-end, reconciliation and payables rather than client deliverables, that is accounting automation. The two overlap on tooling and almost never on risk.
We are a small firm. Is there a size threshold?
No. Section 4(1) is drafted by reference to commercial activity, not headcount or revenue.
Does client consent to the retainer cover the tool?
Not automatically. The principles ask that consent, where it is the legal authority, be specific and meaningful. A general engagement letter that says nothing about processing arrangements is doing less work than firms assume; the fix is a clear description of your practices, which Treadstone Law covers in whether your business needs a privacy policy.
What if the vendor says the data is anonymised?
Ask what that means and at what point it happens. The principles caution that re-identification is itself a concern and ask organisations not to prompt a system to re-identify previously de-identified data.
Does PIPEDA say where data must be stored?
No. That is a common misreading and it is dealt with separately — see keeping client data in Canada, where the rules that do impose a location are set out.
A 30-minute call is enough to tell you whether AI pays for itself here.
