PIPEDA, Law 25 and your donor list: a plain-language privacy guide for Canadian non-profits
Which Canadian privacy laws apply to charities and small organizations, what Quebec’s Law 25 changed, and the five things to put in place this year.
Most small organizations hold more personal information than they realize: donor names and addresses, volunteer emergency contacts, client intake forms, newsletter lists, photos from the annual gala. Canadian privacy law expects you to look after all of it. Here is what applies, in plain language.
This article is general information, not legal advice. If you handle sensitive information (health, children, finances), talk to a lawyer who knows privacy law in your province.
Which law applies to you?
Canada has a patchwork of federal and provincial privacy laws for the private and non-profit sectors.
| If you are… | The main law to know |
|---|---|
| Anywhere in Canada, doing commercial activity | PIPEDA (federal) |
| In Quebec | Law 25, which amended Quebec’s private-sector privacy act |
| In British Columbia | BC’s Personal Information Protection Act (PIPA) |
| In Alberta | Alberta’s Personal Information Protection Act (PIPA) |
| Handling health information | Usually a provincial health privacy law as well |
PIPEDA and charities. PIPEDA covers personal information collected in the course of commercial activities. The Office of the Privacy Commissioner of Canada has said that core activities such as fundraising, collecting membership fees and running programs are generally not commercial. Selling, renting or trading your donor list, on the other hand, generally is. Many non-profits still follow PIPEDA’s principles as best practice, and donors increasingly expect it.
BC and Alberta. BC’s PIPA applies to non-profits generally. Alberta’s PIPA applies to non-profits mainly when they carry out commercial activities.
Quebec. Law 25 brought in the toughest rules in the country, rolled out in phases between 2022 and 2024. Many non-profits with operations in Quebec are covered, so if you serve Quebecers it is worth confirming with counsel.
What Law 25 changed (and why it’s a good model everywhere)
Even if you are not in Quebec, Law 25 is a useful checklist because federal reform is heading the same way. Bill C-36, tabled in June 2026, would replace the privacy part of PIPEDA with a new law and a new regulator. Under Law 25, organizations must:
- Name a person in charge of protecting personal information. By default this is the person with the highest authority, often your executive director. Their title and contact information must be published on your website.
- Keep a register of confidentiality incidents. If an incident presents a risk of serious injury, you must notify Quebec’s privacy regulator (the Commission d’accès à l’information) and the people affected.
- Do privacy impact assessments for certain projects, including new systems that handle personal information and transfers of personal information outside Quebec.
- Publish a clear privacy policy written in plain language.
- Get proper consent, separately for each purpose, and turn the most privacy-protective settings on by default for technology products and services you offer.
Five things every small organization should do this year
- Know what you hold and where it lives. List your systems (email, CRM, donation platform, spreadsheets, shared drives, the filing cabinet) and what personal information is in each. This one-page inventory is the foundation for everything else.
- Name your privacy lead. Put a name and a role email (for example privacy@yourcharity.ca) on your website. A role address survives staff turnover.
- Write a short incident plan. Who decides if something is serious? Who calls the insurer, the regulator, the affected people? A one-page plan written now beats a panicked board meeting later.
- Tighten access. Turn on multi-factor authentication everywhere, remove former staff and volunteers, and stop sharing one login among five people.
- Choose Canadian data storage where you can. Microsoft 365, Google Workspace and many backup tools let you keep data in Canadian data centres. Storing data outside Canada is not banned, but you must be transparent about it, and Quebec requires an assessment first.
Where we can help
We help organizations build the data inventory, set up role-based email and access, configure Canadian data residency, and write privacy policies and incident plans in plain language that your board will actually read. Book a free call and we will tell you honestly where you stand.