Canada
Privacy compliance you can show on request.
There is no Canadian equivalent of the EU AI Act. Here the obligations come from privacy law, and the main deadlines are now behind us. The problems underneath them are usually older than the statute.
What applies where
Privacy law in Canada varies by jurisdiction.
Alberta
Protection of Privacy Act
Public bodies have been required to hold a privacy management program since June 2026.
Connext builds the program and the record that goes with it, in a form you can hand over complete.
Alberta
Health Information Act, as amended by Bill 11
In force since June 2026, bringing AI scribes and similar tools within privacy impact assessment obligations.
Connext prepares those assessments and the information manager agreements that sit behind them.
Ontario
FIPPA and the Enhancing Digital Security and Trust Act
Privacy impact assessments have been mandatory for institutions since July 2025.
Connext writes them to the standard the institution will be held to, and leaves a working method behind for the next one.
British Columbia
Freedom of Information and Protection of Privacy Act
Public bodies have held privacy management program and breach notification duties since 1 February 2023.
Connext reviews the program against the systems actually in use and brings the two back into line.
Quebec
Law 25, the Private Sector Act
Canada’s most comprehensive privacy regime, with privacy impact assessments written into the framework rather than left to good practice.
Connext delivers assessments and program documentation to the Quebec standard.
Saskatchewan and Manitoba
HIPA and PHIA
Health information trustees in both provinces hold their own safeguard and breach notification duties.
Connext prepares documentation to each province’s own requirements.
Atlantic Canada
Personal health information legislation
Nova Scotia, New Brunswick, Prince Edward Island and Newfoundland and Labrador each hold their own personal health information statute alongside public-sector access and privacy legislation.
Connext prepares documentation to the province in question.
The territories
Access to Information and Protection of Privacy
Yukon, the Northwest Territories and Nunavut each operate under an ATIPP Act, with health information governed separately.
Connext supports public bodies and health organisations working under those regimes.
Federal
PIPEDA
Personal information collected in the course of commercial activity, and organisations under federal regulation, fall to the federal statute.
Connext builds the privacy program and the records that sit behind it.
Four ways in
Scope and fee on request for all four. Engagements are priced in Canadian dollars.
POPA / HIA Readiness Scan
A fixed-scope assessment of where your privacy management program actually stands, and what it would take to close the gap. For public bodies under POPA and health custodians under the HIA.
Information Manager Security Policy Pack
For health technology vendors serving Alberta custodians. The information manager pathway, documented once, for your whole customer base rather than one clinic at a time.
Alberta clinic privacy
PIAs, information manager agreements, policy sets and AI scribe documentation for one and two-physician clinics. Prepared, complete, ready to submit.
Board AI Governance Brief
A briefing for boards and executives on what the organisation is running, who owns it, and what the board would be able to answer if a regulator or a journalist asked.
The statute is the deadline, not the problem
Privacy programs run into the same difficulties as capital programs and service redesigns. Ownership is spread thin, decisions get made without being recorded, and accountability sits between functions rather than inside one. The statute sets a date by which that becomes visible.
Connext is a full consulting practice. Governance and board advisory, operational and financial performance, technology governance and fractional executive work sit alongside the compliance products above, and most engagements that begin with a statute end up touching at least one of them.
Start with a conversation about scope.
Forty-five minutes, no charge, and you leave knowing which of the four fits and roughly what it would take.
Book a scoping callOr write to hello@connextbusinesssolutions.com