Privacy Compliance in Atlantic Canada: NS, NB, NL and PEI

Quick links

PIPEDA Compliance Guide CASL Compliance Guide Quebec Law 25 Guide Free compliance check

Atlantic Canada presents a slightly varied privacy law landscape across its four provinces. None of the four has private-sector privacy legislation deemed substantially similar to PIPEDA, so Nova Scotia, New Brunswick, Newfoundland and Labrador, and Prince Edward Island all rely on federal PIPEDA for private-sector commercial activities. The differences lie mainly in provincial health information laws. Here's the complete guide for Atlantic Canadian businesses.

Last updated: April 2026

Privacy Law Summary for Atlantic Provinces

Province	Private-Sector Law	Regulator
Nova Scotia	PIPEDA (federal)	OPC Canada
New Brunswick	PIPEDA (federal)	OPC Canada
Newfoundland and Labrador	PIPEDA (federal)	OPC Canada
Prince Edward Island	PIPEDA (federal)	OPC Canada

All four provinces also have:

Public sector freedom of information/privacy legislation (government bodies)
Health information legislation in some provinces (see below)

Nova Scotia: Federal PIPEDA Applies

Nova Scotia does not have substantially similar private-sector privacy legislation. Federal PIPEDA applies to private-sector commercial activities in Nova Scotia (see the OPC's provincial and territorial privacy laws and oversight page).

NS Health Information

Nova Scotia has the Personal Health Information Act (PHIA NS), governing personal health information held by health information custodians. It has been deemed substantially similar to PIPEDA with respect to health information custodians.

Regulator: The Information and Privacy Commissioner of Nova Scotia oversees PHIA NS.

NS Resources

Nova Scotia Information and Privacy Commissioner — PHIA and FOIPOP oversight

New Brunswick: Federal PIPEDA Applies

New Brunswick does not have substantially similar private-sector privacy legislation. Federal PIPEDA applies directly to all private-sector commercial activities in New Brunswick.

What This Means for NB Businesses

The OPC enforces PIPEDA for NB private-sector activities
Standard PIPEDA obligations apply: Privacy Officer, privacy policy, consent, security, breach response, access requests
Employee privacy: PIPEDA has limited application to provincially regulated employer-employee relationships in NB. There's a gap in formal employee privacy protection for provincially regulated NB employers (similar to Manitoba and Saskatchewan)

NB Health Information

New Brunswick has the Personal Health Information Privacy and Access Act (PHIPAA) governing personal health information held by health custodians:

Healthcare providers (physicians, nurses, dentists, pharmacists, physiotherapists)
Regional Health Authorities
New Brunswick Department of Health

Regulator for PHIPAA: The Office of the Ombud for New Brunswick.

Newfoundland and Labrador: Federal PIPEDA Applies

Newfoundland and Labrador does not have substantially similar private-sector privacy legislation. Federal PIPEDA applies to all private-sector commercial activities.

NL Health Information

Newfoundland and Labrador has the Personal Health Information Act (PHIA NL), governing personal health information held by custodians (healthcare providers, facilities, regional health authorities).

Regulator: The NL Information and Privacy Commissioner (OIPC NL) enforces PHIA NL.

Healthcare businesses in NL must comply with both PHIA NL (for health information) and PIPEDA (for other personal information not within PHIA NL's scope).

Prince Edward Island: Federal PIPEDA Applies

PEI does not have substantially similar private-sector privacy legislation. Federal PIPEDA applies to all private-sector commercial activities.

PEI Health Information

PEI has the Health Information Act (HIA PEI), governing personal health information held by health information custodians.

Healthcare businesses in PEI must comply with HIA PEI (for health information) and PIPEDA (for other personal information).

Practical Compliance for Atlantic Canadian Businesses

Non-Healthcare Businesses (NS, NB, NL, PEI)

For businesses outside the healthcare sector:

Nova Scotia, New Brunswick, NL, PEI businesses: Standard PIPEDA compliance is your framework. The OPC handles complaints. No provincial regulator exists for private-sector commercial activities.

Healthcare Businesses in Atlantic Canada

You operate under two regimes:

Provincial health information legislation (primary for patient data)
PIPEDA (for non-health personal information)

Province	Health Information Law	Regulator
Nova Scotia	Personal Health Information Act (PHIA NS)	NS OIPC
New Brunswick	PHIPAA	Ombud NB
Newfoundland	PHIA NL	NL OIPC
PEI	HIA PEI	PEI OIPC

Cross-Provincial Atlantic Operations

Atlantic Canadian businesses often serve customers across multiple Atlantic provinces and nationally. PIPEDA governs both provincial and cross-provincial commercial activities for private-sector businesses in all four Atlantic provinces.

Atlantic-Specific Compliance Considerations

Tourism and Hospitality

Atlantic Canada has significant tourism sectors (Cabot Trail, Bay of Fundy, Gros Morne, PEI beaches). Tourism businesses collect personal information from visitors — often including non-Canadians. Standard PIPEDA obligations apply, with awareness that foreign visitors may have expectations from their home jurisdictions.

Fishing and Aquaculture

Atlantic Canada's fishing and aquaculture industries often involve independent operators and small businesses. Privacy obligations depend on the business structure. Self-employed fishers operating as sole proprietors who don't engage in commercial activities collecting third-party personal information may have limited PIPEDA exposure.

Maritime Research Institutions

Universities and research institutions in Atlantic Canada (Dalhousie, Acadia, UNB, Memorial, UPEI) operate under their provincial freedom of information/protection of privacy legislation for institutional activities, but may be subject to PIPEDA for their commercial activities (technology transfer, research services).

Compliance Checklist for Atlantic Canadian Businesses

All non-healthcare private-sector businesses (NS, NB, NL, PEI):

Designate a Privacy Officer
Publish a PIPEDA-compliant privacy policy
Establish consent processes
Implement security safeguards
Create breach response procedure and register
Build access request response process (30-day OPC deadline)

Healthcare businesses (add for all provinces):

Implement provincial health information act compliance programme
Configure provincial health regulator breach notification procedure

Frequently Asked Questions

Q: We're a Halifax-based business with customers across Atlantic Canada. Which law applies? A: PIPEDA. Nova Scotia has no substantially similar private-sector privacy law, so PIPEDA governs your commercial activities in Nova Scotia and across NB, NL, and PEI. One comprehensive PIPEDA programme covers all of them.

Q: New Brunswick has no provincial private-sector privacy law — does that mean we have fewer obligations? A: No — PIPEDA applies in full to NB private-sector commercial activities. You have all standard PIPEDA obligations. The difference from AB and BC is that NB employees have weaker formal privacy protections in non-federally-regulated workplaces (a gap in NB law, not an exemption).

Atlantic Canadian Compliance, Coast to Coast

Canada Compliance AI helps Canadian SMEs work through CASL, PIPEDA and Quebec Law 25: a free two-minute compliance check, readiness scores, a prioritized task plan, a 24-month breach register and an exportable audit log. See what's live and what's planned.

Start your free trial today — Atlantic Canada compliance made simple.

Privacy Compliance for Atlantic Canada Businesses: NS, NB, NL, PEI