Privacy Law Compliance Obligations for Canadian Charities and Not-for-Profits

TL;DR: PIPEDA applies to a Canadian charity or not-for-profit only when it handles personal information in the course of "commercial activity," which the Act defines to include "the selling, bartering or leasing of donor, membership or other fundraising lists" (PIPEDA, s. 2(1)). British Columbia's PIPA and Québec's private-sector privacy Act (as amended by Law 25) apply to non-profits whether or not the activity is commercial. Ontario has no general provincial privacy law, so Ontario charities answer to PIPEDA for commercial activity and to PHIPA if they are health information custodians.

If your Ontario charity keeps a donor database and fundraises across provinces, more than one privacy law may apply to you. This guide explains which law applies, what triggers it, and what happens if you get it wrong.

Key terms:

• Personal information: any information about an identifiable individual, such as a donor's name, address, giving history, or email.
• Commercial activity: under PIPEDA, any transaction or regular course of conduct of a commercial character, including selling, bartering, or leasing donor, membership, or fundraising lists.
• Substantially similar legislation: a provincial privacy law that the federal government recognizes as replacing PIPEDA for activity inside that province. BC, Alberta, and Québec have one.
• Real risk of significant harm: the test for when a privacy breach must be reported under PIPEDA and Alberta PIPA.

Does PIPEDA apply to registered charities and not-for-profits?

Usually not. The Office of the Privacy Commissioner of Canada (OPC) states that non-profit organizations "are usually not subject to" PIPEDA, because PIPEDA applies only to personal information collected, used, or disclosed in the course of commercial activity (s. 4(1)).

Charitable or tax-exempt status does not create an exemption. The OPC confirms that collecting membership fees, organizing activities, mailing newsletters, and fundraising are generally not commercial. Selling, bartering, or leasing a donor or membership list is commercial, and PIPEDA applies to that activity. Some clubs, such as golf and athletic clubs, also carry on commercial activity.

Can our charity sell or swap its donor list?

Only if you comply with PIPEDA. Section 2(1) of PIPEDA names "the selling, bartering or leasing of donor, membership or other fundraising lists" as commercial activity. A list swap with another charity is bartering.

Before any list exchange, obtain meaningful consent from the individuals on the list. Document that consent and the purpose you disclosed to donors. In a 2023 finding, the OPC ruled that a charity's opt-out checkbox was not valid consent for its donor list trading program, so use express, opt-in consent.

Which privacy law applies in each province?

PIPEDA applies across Canada except where a province has substantially similar legislation. PIPEDA still governs personal information that crosses provincial or national borders in the course of commercial activity.

‍

‍

Our charity is in Ontario. Which privacy law applies to us?

PIPEDA, for commercial activity only. Ontario has no general private-sector privacy statute. If your charity provides health care and is a health information custodian, PHIPA also applies to personal health information.

If you collect personal information from donors in BC, Alberta, or Québec in the course of operations there, check that province's law as well.

For a board-level checklist, see the 10 privacy questions every Ontario charity board should be able to answer.

What does BC PIPA require?

BC PIPA applies to every private-sector organization in BC, including charities and non-profits, for all activities, not just commercial ones. Non-commercial fundraising is covered.

Section 3(2) excludes limited categories, such as information collected for personal or domestic purposes, journalistic, artistic, or literary purposes, and information held by public bodies under FIPPA. The Act applies to organizations operating in BC regardless of where they are incorporated.

What does Alberta PIPA require?

Alberta PIPA treats non-profits differently based on how they are formed. A "non-profit organization" under s. 56 means one incorporated under the Societies Act or Agricultural Societies Act, or registered under Part 9 of the Companies Act. Those organizations are covered only for personal information handled in commercial activity.

Any other non-profit operating in Alberta, including a federal CNCA corporation, is fully subject to PIPA. In 2025, a legislative committee recommended bringing all non-profits under PIPA. The government has not enacted that change.

We have donors in Québec. Does Law 25 apply to us?

Likely yes, if your organization carries on an "enterprise" in Québec. Article 1525 of the Civil Code defines an enterprise as an organized economic activity, whether or not it is commercial. Non-profits can qualify.

Law 25 amended Québec's private-sector Act and was fully in force by September 2024. It requires a designated person in charge of personal information (by default, the organization's highest authority), privacy impact assessments for certain projects, and reporting of confidentiality incidents. Penalties are the highest in Canada.

What happened to Bill C-27, and what is Bill C-36?

Bill C-27, the Digital Charter Implementation Act, 2022, died on the Order Paper when Parliament was prorogued on January 6, 2025. It never became law.

On June 15, 2026, the federal government introduced Bill C-36, which would enact the Protecting Privacy and Consumer Data Act and replace PIPEDA's privacy provisions. As of October 2026, it is at second reading. It proposes administrative monetary penalties up to the greater of $10 million or 3% of gross global revenue. PIPEDA remains the law until C-36 passes and comes into force.

Should our charity comply with PIPEDA voluntarily?

Yes. Voluntary compliance with PIPEDA's ten fair information principles protects your charity in three ways. For a practical checklist covering privacy officers, staff training, and vendor contracts, see our privacy guide for Canadian charities.

• Coverage can shift. One list rental or paid service can bring an activity under PIPEDA.
• Provincial laws are broader. BC and Québec already cover non-commercial activity, and Alberta may follow.
• Donor trust depends on it. A breach damages your reputation whether or not a statute applies.

What about anti-spam law (CASL)?

CASL is separate from privacy law and applies to commercial electronic messages. Registered charities are exempt for messages whose primary purpose is raising funds (Electronic Commerce Protection Regulations, s. 3(g)). Not-for-profits that are not registered charities have no equivalent exemption. For where the fundraising exemption starts and stops, see CASL for charities: when the fundraising exemption applies.

Frequently Asked Questions

Does PIPEDA apply to my registered charity?

Only to commercial activity. Fundraising, membership dues, and newsletters are generally not commercial; selling, bartering, or leasing donor lists is (PIPEDA, s. 2(1)). Read more in Should Canadian charities comply with PIPEDA?

Can our charity sell or swap its donor list?

Yes, but PIPEDA applies to that transaction. You need meaningful consent from the individuals on the list.

Our charity is in Ontario. Which privacy law applies to us?

PIPEDA for commercial activity, and PHIPA if you are a health information custodian. Ontario has no general private-sector privacy law.

We have donors in Québec. Does Law 25 apply to us?

It applies if you carry on an organized economic activity in Québec, commercial or not. Penalties reach $25 million or 4% of worldwide turnover.

What happens if our charity has a data breach?

Under PIPEDA and Alberta PIPA, you must report breaches that create a real risk of significant harm to the regulator and notify affected individuals. Québec requires reporting of confidentiality incidents that pose a risk of serious injury.

What happened to Bill C-27, and what is Bill C-36?

Bill C-27 died in January 2025. Bill C-36, introduced June 15, 2026, would replace PIPEDA but is not yet law.

‍