Does sending data to OpenAI break PIPEDA?
Not in itself. PIPEDA allows transfers to service providers, including outside Canada, provided you stay accountable: be transparent that data goes to an AI provider and may be processed abroad, protect it by contract, and send only what is needed. Quebec's Law 25 adds a privacy impact assessment before communicating personal information outside Quebec. This is general information, not legal advice.
What to do
- Name AI processing and cross-border transfer in your privacy policy.
- Use business or API terms that exclude your data from training, and check retention.
- Minimise: strip identifiers the model does not need.
- For Quebec residents, complete the transfer assessment first.
- Keep sensitive categories, such as health information, out unless you have assessed it under the provincial health law.
Health information
Provincial health laws such as Ontario's PHIPA have their own rules for agents and service providers. Assess before sending any health information to a model.
Sending less
The safest data is data you never send. Before passing a record to a model, strip what the task does not need: an assistant drafting a reply to a support ticket rarely needs the customer's phone number, address or payment history. Replace names with placeholders where the output can be filled back in afterwards. Keep health, financial and children's information out of AI features unless you have assessed it specifically.
Write down which fields go to which provider, for which feature, and why. That record is what you need to answer a customer's questionnaire, update your privacy policy accurately, complete a Law 25 transfer assessment, and respond to a regulator. It also makes a later change of provider far easier.
Getting it checked
TrazTech offers AI and LLM security assessments, listed from $4,000 CAD. Get at least one other quote on the same scope; the questions to ask a testing firm help compare them.
Related questions
Get a scope for your app
Tell us what you built, what it stores and who is about to use it.
Get matchedCommon questions
Do I need consent to use an AI provider?
You need meaningful consent for your purposes, and transparency about service providers. A new purpose, such as training, needs separate consideration.
Is a Canadian-hosted model required?
Not by PIPEDA. Some customers or public sector contracts require Canadian residency.