CRM and privacy in Canada: PIPEDA, Quebec Law 25 and customer consent

A CRM is a database of personal information about customers and prospects, so privacy law applies to how you collect, use, share, store and delete that information. Federally, PIPEDA requires meaningful consent, collection limited to what you need, appropriate safeguards and accountability for information you send to a CRM vendor. In Quebec, the private-sector privacy act as amended by Law 25 adds a published person in charge of personal information, privacy impact assessments, tracking and profiling functions off by default, express consent for sensitive information, destruction or anonymisation when the purpose is achieved, incident reporting and, since September 2024, a right to data portability. A new federal bill, C-36, was introduced in June 2026 but is not law; PIPEDA still applies.

This guide is general information as of October 2026, not legal advice. It is part of CRM mistakes and official sources. Hosting location is covered separately in CRM data residency; email consent under CASL in the CASL guide.

Which privacy law applies to your CRM

CASL is a separate law about commercial electronic messages. Having CASL consent to email someone does not by itself satisfy privacy-law requirements for collecting and using their information, and vice versa.

PIPEDA in CRM terms

• Identify purposes when you collect: for example "to respond to your inquiry and send quotes", "to send our newsletter".
• Meaningful consent: people should understand what you collect, why, who you share it with (including service providers such as your CRM vendor) and the risks. Express consent is generally expected for sensitive information or uses people would not reasonably expect.
• Limit collection: do not add CRM fields "just in case". Each field should serve a stated purpose.
• Accuracy and retention: keep data accurate for its purpose and delete or anonymise it when no longer needed.
• Safeguards: role-based access, strong passwords and multi-factor authentication, limits on exports, audit logs.
• Service providers: you remain accountable for information transferred to the CRM vendor for processing; use contractual protections.
• Breaches: breaches of security safeguards that create a real risk of significant harm must be reported to the OPC and notified to affected individuals, and you must keep records of all breaches.
• Access requests: people can ask what you hold about them. Your CRM should let you find and export a person's record quickly.

Law 25 in CRM terms

CRM features this affects. Lead scoring, web tracking, enrichment and "AI insights" can amount to profiling. For Quebec contacts, check that such features can be turned off by default and activated only with appropriate information. Make sure you can export a person's data in a structured format (for example CSV or JSON) for portability requests.

Penalties. The CAI can impose administrative monetary penalties under the amended act of up to $10 million or 2% of worldwide turnover, whichever is greater, and penal fines can reach $25 million or 4%. Small businesses are unlikely to face the maximum, but the scale shows the law's seriousness.

Bill C-36: not law yet

Bill C-27, which would have enacted a Consumer Privacy Protection Act, died when Parliament was prorogued in January 2025. In June 2026 the government introduced Bill C-36, the proposed Protecting Privacy and Consumer Data Act. As of October 2026 it is still before the House of Commons. Until it is passed and in force, PIPEDA applies. Watch LEGISinfo and the OPC for updates; a CRM with good consent records, retention rules and export tools will adapt more easily to whatever is enacted.

A privacy setup for your new CRM

1. Write the purposes for each type of contact (customer, prospect, newsletter subscriber).
2. Remove fields you do not need; restrict sensitive notes to a few roles.
3. Turn on multi-factor authentication for all users.
4. Limit who can export; log exports.
5. Set retention rules: for example review prospects with no activity after 24 months.
6. Record consent basis and date (CASL) and purposes (privacy law) on each contact.
7. For Quebec: complete a PIA for the CRM project and the communication outside Quebec if applicable; turn profiling and tracking off by default; publish the person in charge.
8. Sign the vendor's data-processing terms and note its breach-notification commitment.
9. Update your privacy policy to mention the CRM vendor category and any processing outside Canada.

FAQ

Do I need consent to store a business contact's details?

PIPEDA does not apply to business contact information collected, used or disclosed solely to communicate with the person about their employment, business or profession. Marketing to them is a different purpose; CASL rules still apply to commercial emails.

Is a small business exempt from Law 25?

No general exemption exists for small enterprises, although some obligations are lighter in practice. If you collect personal information in Quebec, the act applies.

Can my CRM vendor use my customer data to train AI?

Check the terms. Using your customers' information for the vendor's own purposes may require consent and contradicts the service-provider model. Ask for a written opt-out if needed.

What if I receive a portability request?

Export the person's computerised information they provided in a structured, commonly used format, within 30 days of receiving the request (the CAI notes that no answer within 30 days counts as a refusal).

Sources

• Office of the Privacy Commissioner of Canada — meaningful consent guidelines, service providers, breach reporting
• Commission d'accès à l'information du Québec — Law 25 guidance, PIA and incident tools
• LégisQuébec — Act respecting the protection of personal information in the private sector
• LEGISinfo — status of Bill C-36
• Justice Laws Website — PIPEDA text