PIPEDA vs Loi 25 vs GDPR: The Cross-Border SMB Compliance Map

If your Canadian SMB sells to Quebec customers and EU customers, three privacy regimes can apply to the same database at the same time. They do not agree on the breach clock, on who must be designated, or on how long you have to answer an access request. Here is the side-by-side map, grounded in the statute and regulation text, so you build one program that satisfies all three.

You finished the PIPEDA pillar intro and the PIPEDA consent and purpose deep-dive. This cross-pillar article is the map for SMBs that cross borders. A Quebec-based SaaS with EU customers can trigger PIPEDA (federal commercial activity), Loi 25 (Quebec private sector), and the GDPR (EU/EEA processing with extraterritorial reach) on the same personal information. This article compares the three across the ten axes an IT team actually engineers for, and ends with a joint-program artifact set that satisfies the strictest common denominator.

Scope and applicability

PIPEDA governs the collection, use, and disclosure of personal information in the course of commercial activities across Canada (federal undertakings and interprovincial/international flows), regardless of organization size. A “substantially similar” provincial carve-out exists for organizations operating wholly within Alberta, British Columbia, and Quebec, but crossing provincial borders pulls you back under PIPEDA.

Loi 25 amends Quebec’s Act respecting the protection of personal information in the private sector. It applies to every private-sector organization that holds personal information in Quebec — there is no commercial-activity gate and no small-business exemption. It entered force in three phases: 22 September 2022, 22 September 2023, and 22 September 2024.

GDPR applies to the processing of personal data of data subjects in the EU/EEA, regardless of where the controller is established (Article 3 territorial scope — both establishment and targeting branches). It reaches a Canadian SMB that offers goods or services to, or monitors behavior of, individuals in the EU.

The overlap is real, not hypothetical: a Quebec SMB with an EU customer base can be simultaneously under all three.

Regulator and officer

For IT, the strictest common denominator is: designate a named officer, publish their contact, and document the written delegation. That satisfies Loi 25 and GDPR; PIPEDA’s 4.1 is met as a by-product.

Breach notification — the clock that does not exist vs the one that does

This is the axis where the three regimes diverge most sharply, and where the “72-hour” myth needs correcting.

PIPEDA: report a breach of security safeguards to the OPC and notify affected individuals as soon as feasible when it is reasonable to believe the breach creates a “real risk of significant harm” (RNSH). There is no fixed-hour clock. Every breach of security safeguards must be recorded — not only the reportable ones — and the OPC can demand the breach log.

Loi 25: Articles 3.5 to 3.8 require a confidentiality-incident register for every incident, and notification to the CAI and to affected persons when the incident presents a risk of serious prejudice (préjudice grave). Like PIPEDA, there is no fixed numbered deadline — the obligation is to act promptly. (The popular “72 hours” framing is a GDPR import, not the Quebec legal text.)

GDPR: Article 33 requires notifying the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of a breach. Article 34 requires notifying affected data subjects without undue delay when the breach is likely to result in a high risk to their rights. If the 72-hour notification cannot be met, the reasons for the delay must accompany the notification.

The operational rule for a multi-regime SMB: build to the 72-hour GDPR clock as your internal target — it satisfies PIPEDA’s “as soon as feasible” and Loi 25’s promptness obligation, and it is the only one a regulator will measure you against with a stopwatch.

Access response window

• **PIPEDA:** respond to an access request with due diligence, typically no later than **30 days**.
• **Loi 25:** the data subject may confirm the existence of and access their personal information; the response window tracks the Quebec private-sector Act.
• **GDPR:** Article 12(3) — respond **without undue delay and in any event within one month** of receipt; extendable by **two further months** where necessary, with the data subject informed of the extension and reasons.

Engineer your access-request pipeline to the 30-day PIPEDA floor as the default SLA; if a request touches EU data, the one-month-plus-two-month GDPR ceiling already covers you.

Impact assessments

• **PIPEDA:** no statutory privacy-impact-assessment requirement (though the OPC expects privacy by design).
• **Loi 25:** **mandatory EFVP** (*évaluation des facteurs relatifs à la vie privée* / PIA) for certain processing — e.g., when personal information is communicated outside Quebec or used for new purposes; the EFVP must consider the sensitivity, the purpose, the proportionality, and the de-identification measures, and the privacy officer is consulted.
• **GDPR:** **mandatory DPIA** (Article 35) for processing likely to result in a high risk to rights and freedoms (large-scale, systematic monitoring, sensitive data).

One PIA/EIA template that includes cross-border transfer, sensitivity, proportionality, and de-identification satisfies Loi 25’s EFVP and the GDPR DPIA simultaneously; PIPEDA gains a documented privacy-by-design artifact.

Consent, portability, de-indexation

• **PIPEDA:** consent under Schedule 1 Principles 2 and 3 (see the consent deep-dive); express or implied by sensitivity; withdrawal at any time subject to legal/contractual restrictions. No statutory data-portability right; no de-indexation right.
• **Loi 25:** a documented **consent process** is an explicit obligation (phase 2023); **portability right** (phase 2024); **de-indexation right** — a person can ask that a hyperlink indexing their information be de-indexed if it causes serious prejudice under defined conditions.
• **GDPR:** consent is one of six lawful bases (Article 6) and must be specific, informed, and freely given for consent-based processing; **portability right** (Article 20); **right to erasure** (Article 17); **right to object** (Article 21).

Build consent to the GDPR standard (freely given, specific, granular, withdrawable) — it cleanly satisfies PIPEDA’s 4.3 and Loi 25’s consent process. Provide a portability export; it satisfies Loi 25 and GDPR and is a PIPEDA goodwill feature.

Cross-border transfers

• **PIPEDA:** accountability transfer principle — ensure a comparable level of protection when data leaves the organization’s control (vendor contracts).
• **Loi 25:** **mandatory EFVP** before transferring personal information outside Quebec, with a written agreement stating the EFVP conclusions.
• **GDPR:** **Chapter V** transfer mechanisms — adequacy decision, standard contractual clauses, or derogations (Article 46).

The shared control: a written transfer agreement + a completed impact assessment + a vendor comparable-protection clause. That trio satisfies all three.

Enforcement

• **PIPEDA:** OPC investigations, findings, compliance agreements; **CPPA reform (Bill C-27)** is expected to add administrative monetary penalties.
• **Loi 25:** CAI orders, administrative monetary penalties, and offence provisions.
• **GDPR:** administrative fines up to **€20 million or 4% of global annual turnover**, whichever is higher (Article 83).

The CPPA will move PIPEDA toward the GDPR/Loi 25 enforcement model. Prepare now (see the CPPA readiness article).

A joint-program artifact set for the strictest common denominator

1. Officer designation — named privacy officer, published contact, written delegation (satisfies Loi 25 art. 3.1 + GDPR art. 37 + PIPEDA 4.1). 2. Access-request pipeline — 30-day default SLA, one-month-plus-two-month ceiling for EU data (PIPEDA + GDPR). 3. Incident runbook — register every incident; assess against RNSH / préjudice grave / high-risk; target 72-hour authority notification; individual notice when the threshold is met (all three). 4. PIA/EIA template — cross-border, sensitivity, proportionality, de-identification, officer consultation (Loi 25 EFVP + GDPR DPIA). 5. Transfer agreement — written, with EFVP conclusions and comparable-protection clause (Loi 25 + PIPEDA + GDPR Chapter V). 6. Consent engine — GDPR-grade freely-given/specific/withdrawable consent, with portability export (all three). 7. Retention and destruction policy — phase-2023 Loi 25 obligation, PIPEDA 4.5, GDPR storage-limitation (Article 5(1)(e)).

CTA

Three regimes, one program. If you cross Quebec or EU borders, build to the strictest common denominator and the other two come free. Book a 45-minute Canadian privacy compliance review — we map your data flows against PIPEDA, Loi 25, and GDPR in one pass and hand you the joint artifact set above. Bilingual EN/FR, no obligation. Cross-pillar reads: PIPEDA consent and purpose, GDPR ↔ ISO 27001 joint implementation, Loi 25 ↔ GDPR parallelism.

Sources

• **PIPEDA statute (Justice Laws, chapter P-8.6)** — commercial-activity scope, "substantially similar" provincial carve-out, Schedule 1 Principle 4.1 accountability, the "real risk of significant harm" breach threshold, "as soon as feasible" notification, mandatory breach-record requirement, 30-day access response.
• **Loi 25 (cybereco 2022-05-31), Act respecting the protection of personal information in the private sector** — art. 3.1 mandatory privacy officer with published contact, arts. 3.5–3.8 confidentiality-incident register and notification on *préjudice grave* (no fixed numbered clock), phased entry 22 Sept 2022/2023/2024, mandatory EFVP for cross-Quebec transfers and new purposes, consent process, de-indexation, portability (2024).
• **GDPR (Regulation (EU) 2016/679, CELEX 32016R0679)** — Article 3 territorial scope, Article 6 lawful bases, Article 12(3) one-month (+2 months) access response, Article 17 erasure, Article 20 portability, Article 21 object, Article 33 72-hour authority notification "without undue delay," Article 34 data-subject notification, Article 35 DPIA, Article 37 DPO, Chapter V transfers, Article 83 fines up to €20M/4%.
• **Bill C-27 (CPPA)** — the reform expected to bring PIPEDA toward the enforcement-driven GDPR/Loi 25 model with administrative monetary penalties. (Exact CPPA provisions will be set by the enacted bill; verify against OPC and Parliament records.)