Manitoba Privacy Law for Business: Which Law Applies to You?

2026-10-26 · 11 min read

The short answer: PIPEDA is your baseline in Manitoba

Manitoba does not have a private-sector privacy statute in force. The Personal Information Protection and Identity Theft Prevention Act (S.M. 2013, c. 17) received Royal Assent in 2013, but its coming-into-force section says it "comes into force on a day to be fixed by proclamation" (Manitoba Laws, S.M. 2013, c. 17). That day never came. The province's legislative history lists the Act as "not proclaimed, but repealed on 31 Mar. 2024," filed under the heading "repealed without ever having come into force" (Manitoba Laws, legislative history).

So the working rule for an ordinary Manitoba business that sells goods or services is simple. The federal Personal Information Protection and Electronic Documents Act (PIPEDA) "applies to private-sector organizations across Canada" that handle personal information in the course of commercial activity, according to the Office of the Privacy Commissioner of Canada. Only Alberta, British Columbia and Quebec have their own private-sector laws deemed substantially similar to PIPEDA, and Manitoba is not on that list (OPC, provincial and territorial privacy laws).

That is the headline, but it is not the whole picture. Manitoba has two provincial laws that matter a great deal to some small organizations: The Personal Health Information Act (PHIA) and The Freedom of Information and Protection of Privacy Act (FIPPA). Which one reaches you depends on what you do and who you serve, not on the size of your business. The rest of this guide sorts that out.

Which law applies to me? A decision table

Work down the table and stop at the first row that describes you, then keep reading, because some rows overlap. This is general information, not legal advice. If your situation is not clear-cut, a short call with a privacy lawyer costs far less than guessing wrong.

Two details deserve a plain explanation. First, PHIA defines a "trustee" as "a health professional, health care facility, public body, or health services agency" that collects or maintains personal health information (Manitoba Laws, PHIA). A privately run clinic or practice can therefore be a trustee even though it is a business. Whether a particular practice, pharmacy or wellness service counts is a legal question we do not answer for you here.

Second, the PowerSchool example in the Ombudsman's February 2025 notice shows how the split works in real life. School divisions that used the platform had to report to the Ombudsman under FIPPA and PHIA once they found a real risk of significant harm. The Ombudsman added that PowerSchool "is a private company and is not a public body or trustee," and said the federal Privacy Commissioner has jurisdiction over it. One incident, two regulators, depending on who you are.

What PIPEDA expects once you know it applies

PIPEDA is built on ten fair information principles, and the OPC treats those principles as the main compliance framework (OPC). In everyday terms, a small Manitoba business should be able to answer five questions without hesitation.

• What personal information do we collect, and why do we actually need each item?
• Where does it live: which laptops, cloud apps, email accounts, paper files and vendors?
• Who inside the business can see it, and is that access limited to what their job requires?
• How long do we keep it, and what happens when we no longer need it?
• Who do we call, and in what order, if it is lost or stolen?

The Canadian Centre for Cyber Security publishes a free set of 13 baseline controls aimed at small and medium organizations, built on an 80/20 idea: most of the benefit for a modest share of the effort (Cyber Centre, baseline cyber security controls). The list includes an incident response plan, automatic patching, strong user authentication, employee awareness training, backup and encryption, and securing cloud and outsourced IT services. If you have to show a regulator or an insurer that you took reasonable steps, a documented alignment with that list is a sensible place to start. Our small business cybersecurity guides and the PIPEDA compliance services page go deeper on how those controls are usually implemented.

When a breach must be reported

The breach rules differ by law, and this is where the "which law applies" answer changes what you do on a bad day.

Under PIPEDA. Organizations must report to the Privacy Commissioner breaches of security safeguards involving personal information that pose a real risk of significant harm, and must notify affected individuals. The OPC frames the risk test around two factors: how sensitive the information is and how likely it is to be misused. The number of people affected does not decide it. A breach affecting one person can be reportable. The OPC also expects you to keep a record of every breach, including those that do not meet the threshold, and that record is kept for at least 24 months. Because sources differ on exactly when the 24-month clock starts, read the OPC's current breach record-keeping guidance before you build your register. Our data breach notification guide covers the national process step by step.

Under PHIA. A trustee must notify the individual about a privacy breach if it could reasonably be expected to create a real risk of significant harm, as soon as practicable, and must also notify the Ombudsman (PHIA, s. 19.0.1) (Manitoba Laws, PHIA). A "privacy breach" includes theft or loss of personal health information and any access, use, disclosure, destruction or alteration that does not comply with the Act.

Under FIPPA and PHIA, in practice. The Manitoba Ombudsman says public bodies and trustees must report a breach to its office once they determine there is a real risk of significant harm, and must notify the affected individuals too. Completing the Ombudsman's Privacy Breach Reporting Form fulfils the reporting requirement (Manitoba Ombudsman).

Your vendors do not take the responsibility with them

A common small-business mistake is assuming that a cloud provider, accountant, payroll service or IT contractor "has it covered." Manitoba's most recent public privacy investigation shows why that fails. In Investigation Report MO-09540, dated May 28, 2026, the Manitoba Ombudsman looked at a breach reported by Manitoba Families after its service provider had a cybersecurity incident that led to unauthorized access to the information of 1,361 Manitoba residents. The central finding was that Families "did not have service provider management policies, security control guidelines, or an active audit program" to oversee the provider's privacy practices, including cybersecurity. The Ombudsman issued five recommendations and Families accepted them (Manitoba Ombudsman, MO-09540).

That report concerns a public body and a trustee, not a private business, so FIPPA and PHIA were the yardsticks. The lesson still transfers. PIPEDA's accountability principle is about the organization that collected the information, and a private business that outsources data handling should expect to be asked what it did to oversee the supplier. Write down which vendors touch personal information, what they promise in writing, and when you last checked.

The 10 minute privacy self-check for a Manitoba business

Set a timer, open a blank document and answer these in order. Anything you cannot answer in a minute is your to-do list.

1. Which row of the decision table above are you? Write "PIPEDA", "PHIA", "FIPPA" or a combination at the top of the page.
2. Name your privacy lead. One person, with a backup. Under PIPEDA someone must be accountable for compliance, and in a small business that is often the owner.
3. List the five places personal information lives. For example: the accounting system, email, a shared drive, a booking or CRM tool, and paper files.
4. List every vendor that touches that information. Include the ones you forgot: payroll, e-signature, website forms, backup service.
5. Check who can log in to each system. Remove former staff and shared accounts. Turn on multi-factor sign-in where it is offered (see our MFA setup guide).
6. Confirm you have an offline or immutable backup and that someone has tested a restore in the last quarter (backup and recovery guidance).
7. Write the one-page call tree. Who decides if it is a breach, who contacts the regulator, who contacts customers, who contacts your IT provider and insurer. Our incident response planning page shows what belongs on it.
8. Start the breach register. A simple table: date discovered, what happened, what information, how many people, harm assessment, decision, who was notified.
9. Check your cyber insurance policy for notification and forensic obligations (cyber insurance for small business).
10. Book the follow-up. Put a recurring 30 minute review in the calendar, once a quarter.

If you finish this and the list of gaps is long, that is normal. Most small organizations discover the same few gaps: nobody owns privacy, vendors are undocumented, and the breach plan lives in someone's head.

Common mistakes we see when businesses assume the wrong law

• Assuming there is a Manitoba privacy law that covers private firms. There is not one in force. The 2013 Act was repealed in 2024 without ever starting, so building your program around it, or around another province's statute, points you at the wrong rules.
• Copying another province's checklist. Alberta, British Columbia and Quebec each have their own private-sector law with its own duties. A Manitoba business that follows one of those statutes by accident may over-build in some places and miss PIPEDA's own record-keeping in others.
• Treating health information like ordinary customer data. If you are a trustee, PHIA has its own duties, including notifying both the individual and the Ombudsman when the harm test is met.
• Waiting for the incident to pick a regulator. The first hour of a breach is the wrong time to learn that you needed to file with a different office.
• Believing size protects you. Statistics Canada's 2023 survey of businesses with 10 or more employees found 16% were impacted by cyber security incidents, and 13% of impacted businesses reported ransomware (Statistics Canada, The Daily, 2024-10-21). Manitoba had 33,513 small employer businesses (1 to 99 employees) in December 2024, or 97.9% of its employer businesses, per ISED's Key Small Business Statistics 2025. In other words, most Manitoba employers are small, and small is who the guidance is written for.

What to read next

Real incidents make the legal duties concrete, so continue with what Manitoba cyberattacks teach small businesses. If you are budgeting for protection, our Manitoba managed IT cost breakdown lays out how to compare quotes. To see how a managed provider would approach the controls above, start with managed IT services in Manitoba and managed IT in Winnipeg, or the cybersecurity pages for Winnipeg and Brandon. The national overviews are Managed IT Services Canada and Small Business Cybersecurity.

TechCare Canada is an independent guide publisher. Services are delivered remotely, with hands-on work fulfilled by our partner IT Cares in Quebec, and on-site availability in Manitoba is confirmed case by case in writing. We are not a law firm, and nothing here is legal advice.

FAQ