This guide is general information based on the official sources listed below. It is not legal advice.
If your website collects names, emails or order details, privacy law applies to you. If you serve customers in Quebec, Law 25 adds specific obligations. And if you add an AI chat assistant, Canada's privacy commissioners have jointly published principles for how it should behave.
This guide summarizes what the official sources say. It is a starting point, not legal advice.
Quebec Law 25: the main obligations for businesses
According to Quebec's privacy regulator, the Commission d'accès à l'information, businesses must:
- Have a person in charge of protecting personal information. By default this is the person with the highest authority in the business, who may delegate the role in writing
- Publish that person's title and contact information on the business website
- Publish a privacy policy in clear, simple terms when collecting personal information through technology, and tell people about changes to it
- Report confidentiality incidents that present a risk of serious harm to the Commission and the people affected, and keep a register of incidents
- Tell people when a decision about them is based only on automated processing, and let them submit observations to a staff member who can review it
- Disclose any technology that can identify, locate or profile someone, which cannot be turned on by default
Federal privacy law: PIPEDA's ten principles
PIPEDA generally covers the commercial activities of private businesses across Canada. Alberta, British Columbia and Quebec have their own private-sector privacy laws that are deemed substantially similar, so PIPEDA generally does not apply to businesses operating entirely within those provinces unless information crosses borders. PIPEDA's ten fair information principles are a useful checklist for any website or chatbot:
- Accountability
- Identifying purposes
- Consent
- Limiting collection
- Limiting use, disclosure, and retention
- Accuracy
- Safeguards
- Openness
- Individual access
- Challenging compliance
Running an AI assistant responsibly
In December 2023, Canada's federal, provincial and territorial privacy regulators published principles for generative AI. For a customer-facing assistant, three stand out:
- Openness: people should know they are talking to an AI tool
- Limiting collection: collect only what the conversation needs, and do not reuse chat prompts for other purposes unless required
- Accountability: the business stays responsible for decisions, not the automated system, and people should be able to ask for human review
A practical checklist for your website
- A clear privacy policy linked from every form
- The name or title and contact details of the person responsible for privacy
- Forms that ask only for what you need
- An AI assistant that says it is automated and offers a way to reach a person
- A simple process for access and correction requests
Where Andreon fits
Every website and automated assistant we build follows this checklist: disclosure that customers are talking to an AI, minimal data collection, and a handoff to a person. Book a free assessment to talk through your situation.
Sources
- Commission d'accès à l'information du Québec: Principaux changements apportés par la Loi 25 (French)
- Office of the Privacy Commissioner of Canada: Summary of privacy laws in Canada
- Office of the Privacy Commissioner of Canada: PIPEDA fair information principles
- Office of the Privacy Commissioner of Canada: Principles for responsible, trustworthy and privacy-protective generative AI technologies (December 2023)
Sources checked on October 17, 2026.
Related service: Automated customer service