Privacy regulation isn’t standing still. Businesses that sell across borders must keep up.

This article is for general information purposes only, not legal advice.

Canada

– Quebec has Law 25, with its major provisions now in force, including stricter consent, privacy officer duties, incident reporting, privacy impact assessments, and rules about automated decisions.

– Federal level: PIPEDA remains the main law for many private-sector organizations. The federal government’s June 2026 National AI Strategy says it will modernize privacy and online safety laws, so changes are expected. Details and timing were still developing as of October 2026.

– Other provinces such as Alberta and British Columbia have their own private-sector privacy laws.

United States

There is no single federal privacy law covering all businesses. Instead, a growing number of states have passed their own comprehensive privacy laws, with differing definitions and requirements, plus sector-specific federal rules (health, finance, children’s data).

European Union

The GDPR remains the global reference point. The EU’s “Digital Omnibus” proposals aim to simplify parts of the digital rulebook, including aspects of data and AI regulation. Further changes are likely to follow, so monitor developments if you serve EU customers.

Common global trends

– Stronger consent and transparency requirements

– Greater individual rights** (access, deletion, portability)

– Mandatory breach notification, often with short deadlines

– Rules on automated decision-making and AI

– Restrictions on cross-border data transfers

– Bigger penalties

– Children’s privacy protections

What a business should do

1. Know your data: what personal information you collect, why, and where it goes

2. Build to the strictest rule that applies to you. For Quebec customers, that is usually Law 25.

3. Minimize collection and retention

4. Keep a privacy policy and incident register current

5. Vet vendors and cloud services, including where data is stored

6. Train staff

7. Review annually, or whenever you launch new products, tools, or markets

Where IT fits

Encryption, access control, logging, retention automation, and vendor management are what turn privacy policy into practice.

DBR Soft can help you turn privacy requirements into working technical controls. Contact us for more information.