AI coding tools under PIPEDA and Québec Law 25: a CTO guide

Updated November 14, 2026.

Not legal advice. This guide is general information for engineering leaders. It does not replace advice from a lawyer or privacy professional who knows your facts. Laws and guidance change; check the linked sources on the day you rely on them.

Canadian teams do not need to wait for a new federal AI statute to review their coding tools. Existing privacy laws already matter when personal information reaches a session. For a team using Cursor, Claude Code, Copilot, Codex or Antigravity, the practical question is: which privacy duties apply to this data flow, and what evidence can we show?

This guide is for CTOs and CISOs at Canadian software companies of 10 to 100 people.

Where Canadian AI law stands (November 2026)

• AIDA is not law. The Artificial Intelligence and Data Act was part of Bill C-27. The parliamentary session that bill was before ended on January 6, 2025, at the stage of consideration in committee. It did not receive royal assent (LEGISinfo, Bill C-27).
• Bill C-36 is not law. "An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act..." had first reading on June 15, 2026 and is at second reading (LEGISinfo, Bill C-36).
• PIPEDA applies today, and so does Québec's private-sector Act as amended by Law 25.
• Security guidance exists. The Canadian Centre for Cyber Security warns that users may put sensitive corporate data or personal information into generative AI prompts without knowing it (Cyber Centre, ITSAP.00.041).

Does PIPEDA apply to your AI coding tools?

PIPEDA applies to personal information that private-sector organizations collect, use or disclose in the course of commercial activities. It does not regulate a tool by name. It regulates what happens to personal information (OPC, PIPEDA in brief).

Three points from the OPC's summary matter for scoping:

• Province. Alberta, British Columbia and Québec have private-sector laws deemed substantially similar. Organizations subject to them are generally exempt from PIPEDA for activity inside that province. PIPEDA still applies when personal information crosses provincial or national borders in commercial activity.
• Employee data. PIPEDA covers employees' personal information only for federally regulated businesses. For most software companies, the developer's own name or OS username is therefore not a PIPEDA question. Customer data in a log or fixture usually is.
• Business contact information used only to contact someone about their job is outside PIPEDA.

For a typical Ontario SaaS company, the PIPEDA question is about customer and end-user data that reaches an AI session.

Where personal information enters an AI coding session

Personal information rarely enters because someone wanted to share it. It enters as a side effect of debugging:

• Production logs and stack traces pasted into chat, with emails, IP addresses or account IDs.
• Database query results and test fixtures copied from production.
• Support tickets attached to explain a bug.
• .env files and connection strings that open a database of customer records.
• Folder paths. Cursor staff confirmed that each new chat receives the absolute path of the opened folder, which includes the OS username (Cursor forum, t/178134/5). A folder named after a client can disclose that relationship.

An agent can also read files nobody opened by hand. In Cursor, Read Access defaults to System, so the agent can read outside the workspace without asking unless an admin or user selects Workspace (Cursor run modes docs).

A worked data flow (synthetic)

The example below is invented. Use it as a template for your own record.

Steps 3 and 4 are two separate transfers to two separate third parties. Treat them as two rows in your vendor review.

PIPEDA: four questions a CTO should answer

PIPEDA's ten fair information principles appear in Schedule 1 (PIPEDA, Schedule 1). The first three questions below concern those principles; the fourth concerns the Act's separate breach obligations.

1. Accountability: who is responsible when data goes to a vendor?

You are. Principle 4.1.3 says an organization is responsible for personal information transferred to a third party for processing, and must use contractual or other means to give a comparable level of protection.

The OPC's cross-border guidance explains how this applies to vendors outside Canada. PIPEDA does not prohibit transfers for processing outside Canada. The organization stays accountable, must take all reasonable steps to protect the information while the third party holds it, and should be satisfied that the vendor has adequate safeguards. The OPC also says a transfer for processing is a "use", so the data can only be used for the purposes it was originally collected for (OPC, Guidelines for processing personal data across borders).

Evidence to keep: the vendor agreement or data processing terms for each AI tool, the tool's privacy settings (for example, Cursor Privacy Mode), and the name of the person who approved the tool.

2. Safeguards: are controls appropriate to the sensitivity?

Principle 4.7 requires security safeguards appropriate to the sensitivity of the information, including organizational and technological measures. A production database dump in a prompt is more sensitive than a stack trace with a request ID.

Evidence to keep: which repositories hold customer data, how agent read access is limited (for example, Cursor Read Access set to Workspace), and how secrets and personal data are redacted in logs and session records.

3. Openness: does your privacy policy describe the flow?

Principle 4.8 requires organizations to make information about their policies and practices available. The OPC's cross-border guidance emphasizes transparency about foreign processing and possible access under foreign law. Review whether your privacy information accurately describes the AI vendors and processing purposes involved.

4. Breaches: what if personal data leaks through an agent?

Under PIPEDA, organizations must report to the OPC breaches of security safeguards that pose a real risk of significant harm, notify affected people, and keep records of all breaches for two years, even breaches that are not reported (OPC, What you need to know about mandatory reporting of breaches).

If an agent sends a customer database credential or customer records somewhere they should not go, assess it under your breach process. The session record is often the best evidence of what was sent and when.

What the OPC expects from organizations that use generative AI

The OPC's principles for generative AI separate "developers and providers" from "organizations using generative AI". For organizations using these systems, the OPC says, where possible and reasonable, to use anonymized or de-identified information in prompts instead of personal information; to enter sensitive or confidential personal information into a prompt only where authorized; and not to retain prompts or use them for secondary purposes unless required. It also recommends assessments such as privacy impact assessments (OPC, Principles for responsible, trustworthy and privacy-protective generative AI technologies, December 7, 2023).

These principles are guidance, not new statutory duties. They show how the regulator reads the existing law.

Québec Law 25: what changes if you hold Québec personal information

Law 25 amended Québec's Act respecting the protection of personal information in the private sector (CQLR c P-39.1). Section numbers below refer to that Act (LegisQuébec, P-39.1, current to October 15, 2026). The CAI summarizes the main changes and their dates on its site (CAI, principaux changements de la Loi 25).

Whether the Act applies to you depends on your activities and the information involved. Having one Québec user does not settle the question. Confirm applicability with a privacy advisor before treating the following checklist as a statement of your company's obligations.

Two points matter most for engineering teams:

• For an enterprise subject to the Act, sending personal information to a model provider outside Québec requires a section 17 assessment. Complete it before the communication.
• Assess the capture service separately. Where the Act applies and a session copy containing personal information is entrusted to a body outside Québec, section 17 is relevant to that flow too. ReclaimLLM's hosted regions are the US and EU.

Whether a given AI tool rollout counts as "acquiring an information system" under s. 3.3 is a legal question. Many teams will find it simpler to do a proportionate assessment than to argue it is not required. The Act says the assessment must be proportionate to the sensitivity, purpose, quantity, distribution and medium of the information.

Evidence to keep

A short, current file is more useful than a long policy nobody reads.

• Tool register: approved tools (Cursor, Claude Code, Copilot, Codex, Antigravity), versions, owner, approval date.
• Settings record per tool: Cursor Privacy Mode and Read Access; Claude Code permission rules; Copilot content exclusion. Note who can change them.
• Vendor file: data processing terms, sub-processor list, retention terms, region.
• Assessment: your PIPEDA vendor review and, where Law 25 applies, the s. 17 assessment and written agreement.
• Redaction rule list: what is removed from session records before upload, tested with synthetic data.
• Session records: enough to show what an agent read and sent, with secrets and personal data redacted.
• Incident and breach register: one system can support both regimes if it meets each regime's required fields and retention periods. PIPEDA requires at least two years; do not assume that also satisfies Québec's requirements.

Per-tool checklist

Fill in one column per tool. Take each answer from the vendor's current documentation or contract, and keep the link.

10 questions to answer before rollout

1. Who is accountable for AI coding tools in our company (and, for Québec, who is the person in charge of the protection of personal information)?
2. Which repositories, logs and fixtures hold customer personal information?
3. Can agents reach those files by default? What did we set (for example, Cursor Read Access)?
4. Which vendors and model providers receive prompts and file content, and where?
5. Do our contracts give a comparable level of protection (PIPEDA 4.1.3), and does each say retention and training terms?
6. If we hold Québec personal information: did we do the s. 17 assessment and sign the written agreement?
7. Does our privacy policy tell customers their information may be processed outside Canada?
8. What do we redact from prompts and from stored session records, and did we test it?
9. How long do we keep session records, and who can search them?
10. If an agent sends personal information or a credential to the wrong place, who decides whether it is a reportable breach, and where is it recorded?

Where ReclaimLLM fits

ReclaimLLM captures AI coding sessions from Cursor, Claude Code, Copilot, Codex and Antigravity, and makes them searchable. For this guide, the relevant features are:

• Local redaction before upload. Configured string replacements, such as usernames and absolute paths, run on the laptop before the session copy is uploaded (local redaction). It does not change what the AI tool already sent to its model provider.
• Detection after the fact. Detectors flag secrets, external network egress and some personal data in captured sessions. They run on an hourly or daily sweep and alert; they do not block in real time. The PII detector covers emails, phone numbers, US SSNs and credit card numbers. It does not detect names, addresses or Canadian SINs (PII detection).
• Session search and export to answer "what did the agent read and send?" when you assess an incident.
• Encrypted session storage for raw session details on Paid and Enterprise (encrypted storage).
• File lineage on Paid and Enterprise shows which files an AI session touched, which helps answer "did the agent read the customer export?" (file lineage).
• Account deletion on Free and Paid, with a 30-day grace period before the purge (account deletion).
• Region: hosted data is stored in the US or EU region today (data residency). Canadian in-country hosting is planned for Q1 2027; it is not available yet. If you hold Québec personal information, include ReclaimLLM in your s. 17 assessment like any other vendor. Section 17 is about communication outside Québec, so a Canadian region outside Québec would not remove that step.
• SOC 2: SOC 2 Type II targeted Q4 2026.

For the wider programme, see security and compliance for AI coding. Related reading: shadow AI coding tools: a CISO checklist and keeping API keys and .env files away from AI coding tools.

Review AI coding security and compliance.

FAQ

Can we wait for federal AI legislation before reviewing these tools? No. AIDA in Bill C-27 did not pass, and LEGISinfo lists Bill C-36 as awaiting second reading. Existing federal and provincial privacy laws still apply according to their scope when AI tools process personal information.

Can ReclaimLLM store data in Canada? Not today. Hosted data is stored in the US or EU region. Canadian in-country hosting is planned for Q1 2027.

Does PIPEDA ban sending code to a US model provider? No. The OPC says PIPEDA does not prohibit transfers for processing outside Canada. You remain accountable and must protect the information through contracts and other means (OPC cross-border guidelines). Source code alone is often not personal information; the question is what personal information travels with it.

Is a developer's username in a prompt a PIPEDA issue? Usually not, for a provincially regulated company, because PIPEDA covers employee information only for federally regulated businesses (PIPEDA in brief). Provincial law or your own policy may still apply, and a client name in the same path can be confidential business information.

Do we need a Law 25 assessment before using an AI coding tool? If your enterprise is subject to the Act and communicates personal information outside Québec through the tool, s. 17 requires an assessment first. Section 3.3 may separately apply to an information-system project involving personal information. Confirm the scope with your privacy advisor.

Not legal advice. Talk to your privacy counsel before you rely on any point in this guide.