Which Privacy Law Applies to My New Brunswick Business? PIPEDA, PHIPAA and RTIPPA Explained

2026-10-26 · 9 min read

The "which law applies to me" table

Start at the top row and stop at the first one that describes you. This is a plain-language orientation, not legal advice, and a lawyer should confirm edge cases such as shared offices, contracted service providers and organizations that are partly public.

Two things trip people up. First, a business can sit in more than one row, for example a clinic that is a custodian for patient records and is also an employer and an email marketer. Second, "health" in the name of your trade does not by itself make you a custodian. The Act defines the category.

PIPEDA: the default for New Brunswick businesses

The Office of the Privacy Commissioner of Canada explains that PIPEDA applies to private-sector organizations that handle personal information in the course of commercial activity, and it lists Alberta, British Columbia and Quebec as the provinces with their own private-sector laws. It lists Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador as having substantially similar legislation only for personal health information. For a retailer, contractor, accountant, restaurant or software company in Moncton, Fredericton or Saint John, the practical reading is that the federal law is the private-sector baseline.

PIPEDA also has a breach regime that every NB business should know cold. When a breach of security safeguards creates a real risk of significant harm (RROSH), the OPC explains that you must report it to the OPC, notify affected individuals directly as soon as feasible after you determine the risk exists, and notify any other organization that could reduce the harm. The OPC describes significant harm broadly, including humiliation, damage to reputation, financial loss and identity theft. Whether the risk is "real" turns on the sensitivity of the information and the probability of misuse. You must keep a record of every breach of security safeguards for two years, even the ones you decide are not reportable. The OPC also states that knowingly failing to report, notify or keep records is an offence that can lead to fines. It does not publish a dollar figure on that page, so we do not quote one here.

A practical consequence: the "we decided it was not serious" file is itself evidence. If you cannot show the date, a description of what happened, the kind of information involved and why you judged the risk low, you will struggle to defend that decision later. Our data breach notification guide and the PIPEDA checklist go deeper on the national baseline.

PHIPAA: when you hold health information as a custodian

New Brunswick's Personal Health Information Privacy and Access Act is the provincial law for personal health information. In 2011 the federal government made an order (SOR/2011-265, dated November 17, 2011, published in the Canada Gazette) finding the Act substantially similar to Part 1 of PIPEDA. The order exempts personal health information custodians to whom PHIPAA applies from Part 1 of PIPEDA for the collection, use and disclosure of personal health information that occurs in New Brunswick. The accompanying analysis adds that PIPEDA continues to apply to such information outside the province.

On breaches, the Ombud NB's own notification form (last revised November 2024) is the clearest public statement we found. It defines a privacy breach as personal health information that is stolen, lost, disposed of in an unauthorized manner, or disclosed to or accessed by an unauthorized person. It says that under section 49(1)(c) custodians must notify the affected individuals and the Office of the Ombud as soon as possible. It also sets out four steps: contain the breach, evaluate the risks, notify, and prevent a repeat. The form asks for the dates the breach occurred and was discovered, so keep a timeline from the first hour.

We could not retrieve the full statute text for this guide, so we cite the Ombud's form rather than quoting the Act. If you are a custodian, read the Act itself and the Ombud's guidance before relying on any summary, including ours. If you are an IT provider, billing service or software vendor that touches health records on behalf of a custodian, ask the custodian in writing how the Act applies to your arrangement and what the contract requires of you.

RTIPPA: the public-sector law

The Government of New Brunswick describes the Right to Information and Protection of Privacy Act as the law that gives people a right of access to records held by public bodies and sets rules for how those bodies collect, use and disclose personal information. Complaints go to the Ombud. The Ombud NB site says its Information and Privacy Section handles complaints, notifications, investigations and audits under RTIPPA, PHIPAA and the Archives Act, and that its oversight has grown to cover government departments, local governments, health authorities, school districts, other agencies, universities and custodians of personal health information.

Most small private businesses are not public bodies. You can still feel RTIPPA indirectly: a municipality, school district or agency that hires you may put privacy and security clauses in the contract that mirror its own duties. Read those clauses as contract terms, and ask for clarification instead of guessing.

Where the "which law" question gets messy

• Mixed data. A business can hold customer contact data (PIPEDA) and, if it is a custodian, patient data (PHIPAA). Map the data first, then the law.
• Customers in other provinces. The OPC notes that PIPEDA applies to personal information that crosses provincial or national borders in commercial activity, so an NB company selling to customers in Ontario or abroad cannot assume a provincial exemption.
• Quebec customers. Law 25 is Quebec legislation. It is not a New Brunswick rule and it does not become one because you have an NB address. If you serve Quebec residents, ask counsel whether it matters for you.
• Cloud and outsourced IT. Using Microsoft 365, a payroll provider or an outsourced IT firm does not move your accountability to them. Control 3.10 in the Canadian Centre for Cyber Security's baseline list is about vetting third parties, encrypting data and securing their administrative accounts for exactly this reason.

The 10-minute checklist: know your law before something goes wrong

Print this, answer it once, and file it where your breach record lives. Each line is a decision you do not want to make for the first time during an incident.

1. Write down your category. Custodian, public body, private business, or a mix. Name the data set each category covers.
2. Name the person who decides. Who judges whether a breach creates a real risk of significant harm, and who is the backup if they are away?
3. Create a breach record template with the date or estimated date, a short description, the type of information involved, whether the OPC and individuals were notified, and the reasoning if you decided not to notify.
4. Set a two-year retention rule for that record. The OPC says other laws may require longer.
5. Bookmark the right reporting route. PIPEDA reports go to the OPC. PHIPAA breaches go to the individuals and the Ombud NB.
6. List your vendors that hold personal information (email, accounting, payroll, backups, outsourced IT) and who to call at each one.
7. Check your contracts for any public-body or custodian clauses you have agreed to.
8. Turn on the basics that reduce breach likelihood: strong authentication, patching, backups, staff training. The Canadian Centre for Cyber Security's baseline controls for small and medium organizations are a solid list.
9. Decide who speaks to customers and draft a plain-language notice template now.
10. Schedule a yearly review. Put it in the calendar the same day you finish this list.

What the law does not do for you

Statutes tell you what you owe people when something goes wrong. They do not tell you how to prevent it. Statistics Canada's 2023 survey of businesses with 10 or more employees found that about 1 in 6 (16%) were impacted by a cyber security incident, that recovery spending roughly doubled from about $600 million in 2021 to $1.2 billion in 2023, and that scams and fraud (50%) and identity theft (31%) were the most common methods. Many of those incidents did not start with a sophisticated exploit. They started with a login, an invoice or a message that looked normal. A law-first approach to security therefore has to be paired with an access-and-backup-first approach to operations.

If you want the NB-specific incident picture, read what real New Brunswick incidents teach small businesses. If you are weighing a managed provider to carry some of this work, our New Brunswick managed IT cost guide shows how to read a quote. For provincial context see managed IT services in New Brunswick and the city pages for Moncton, Fredericton and Saint John. The national hubs are Managed IT Services in Canada and Small Business Cybersecurity.

Sources used

• Office of the Privacy Commissioner of Canada, PIPEDA in brief
• Office of the Privacy Commissioner of Canada, What you need to know about mandatory reporting of breaches of security safeguards
• Canada Gazette, SOR/2011-265, Personal Health Information Custodians in New Brunswick Exemption Order
• Ombud NB, About the Ombud and the PHIPAA privacy breach notification form
• Government of New Brunswick, Information access and privacy
• Statistics Canada, Impact of cybercrime on Canadian businesses, 2023
• Canadian Centre for Cyber Security, Baseline cyber security controls for small and medium organizations

This article is general information for business owners, not legal advice. Laws change; confirm current wording with the sources above or a lawyer. Hands-on work for our clients is fulfilled remotely through our partner IT Cares in Quebec.

FAQ