Articles · October 24, 2026

Personal information in your records: a PIPEDA and Law 25 checklist before licensing data

Most company archives hold more than "business records". Emails name people. CRMs hold addresses and job titles. HR and support files go further. If you are considering licensing any of that archive for AI training, start with personal information, not with a buyer.

This is a checklist drawn from published Canadian privacy sources. It is general information, not legal or privacy advice. Whether PIPEDA, Quebec's private-sector privacy Act (often called Law 25), another province's law, or more than one of them applies to your company is a question for counsel. This article does not say that any buyer will accept your data, or what they would pay.

Publicly accessible is still personal information

Canada's privacy commissioners have said that scraping "publicly accessible" personal information is still subject to data protection laws in most jurisdictions [1]. In its investigation of OpenAI, the Office of the Privacy Commissioner of Canada found that more than 99% of the information OpenAI used to pre-train its models was crawled from publicly accessible sources, and found that collection overbroad [2].

Your SharePoint, mailbox and CRM are not public. They are usually easier to tie to identifiable people. Treat them as in-scope until counsel or a documented de-identification review says otherwise.

A checklist from the Commissioner's generative AI principles

In December 2023 the federal, British Columbia, Quebec and Alberta commissioners published principles for generative AI [1]. They write "should" throughout, and they note that many of those points will be required under applicable law [1]. Use them as a working list, not as a substitute for advice.

1. Legal authority and consent. Know and document the legal authority for any collection, use or disclosure of personal information that would happen if the records were licensed [1]. Where consent is the authority, it should be valid and meaningful, and as specific as possible [1]. If the information came from a third party, the principles say you should make sure it was collected lawfully and that the third party has authority to disclose it [1]. Whether consent you already have (for example, "to provide the service") covers a later training licence is for counsel.

2. Appropriate purposes. Collection, use and disclosure should be for appropriate purposes — in many Canadian jurisdictions, purposes a reasonable person would consider appropriate in the circumstances [1] [3]. PIPEDA says an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider appropriate [3]. Whether licensing records to train someone else's model meets that test is for counsel.

3. Necessity, and remove what you can. Use anonymized, synthetic or de-identified data rather than personal information where personal information is not required for the purpose [1]. Walk the archive: whose names, emails, phone numbers, ID numbers, health or financial details, and children's data are in it? Children's data needs even greater safeguards [1]. Our Data Check flags consumer personal data, health records, privileged legal files, payment card data and children's data as likely to be excluded or to need special handling. That is our screening rule, not a legal finding.

4. Be open. The principles call on parties to tell people what, how, when and why personal information is collected, used or disclosed, including during development and training, in language the audience can understand [1]. If you cannot describe the licence in those terms, stop and get advice.

5. Ask the buyer the same questions. The principles say developers and providers should maintain documentation about training datasets, legal authority, licences and filtering [1]. Ask any buyer how personal information will be filtered, where it will be stored, who else will see it, and what happens if you decline.

Extra steps if Quebec's Law 25 applies

Quebec's Act respecting the protection of personal information in the private sector (updated by 2021, c. 25, commonly called Law 25) adds duties that counsel should map if the Act applies to you. Whether it applies — for example because of an establishment, employees or customers in Quebec — is not something this article decides.

If it does apply, the Act says, among other things:

• The person with the highest authority is, by default, in charge of protecting personal information, may delegate that function in writing, and must publish the title and contact information of the person in charge [4] [5].
• The enterprise must have governance policies and practices for keeping and destroying personal information, and must publish detailed information about them [4].
• A privacy impact assessment is required for any project to acquire, develop or overhaul an information system or electronic service delivery system that involves the collection, use, communication, keeping or destruction of personal information, and the person in charge must be consulted from the outset [4]. Whether a later data licence is such a project is for counsel; this article does not treat every licence as one.
• Personal information may not, as a rule, be used inside the enterprise except for the purposes for which it was collected, unless the person consents or a listed exception applies; consent to use or communicate sensitive information must be express [4].
• Personal information may not be communicated to a third person unless the person concerned consents or the Act provides for it [4].
• Consent must be clear, free, informed and given for specific purposes, requested for each purpose, in clear and simple language [4].
• Before communicating personal information outside Quebec, the enterprise must conduct a privacy impact assessment that considers sensitivity, purposes, protection measures and the legal framework in the receiving state. The information may be communicated if the assessment establishes that it would receive adequate protection, and the communication must be the subject of a written agreement [4].

A licence that sends copies of records to a buyer outside Quebec is, on its face, a communication. Whether s. 17 is triggered, and what an adequate assessment looks like, is for privacy counsel. Do not treat a completed Data Check as that assessment.

A short list before you talk to anyone

• Which systems hold personal information, and whose?
• What authority do you have to use or disclose it for a purpose other than the one you collected it for?
• Can names and other identifiers be removed, and who will certify that?
• If Quebec's Act applies, have you named the person in charge, published the governance information, and scoped the impact assessments?
• Who inside the company must approve: the person in charge of privacy, counsel, IT, and someone with authority to bind the company?

If you cannot answer those from documents you have read, do not licence the records.

Where to start

Inventory the systems, the years they cover and the personal information they hold. Then get privacy and legal advice before you talk to any buyer.

Our free Data Check takes about two minutes. You enter your company's website and a few details, and it shows an estimated range of how many business records you hold, a data-readiness score, and how you match what buyers look for. You don't upload any files. It can't tell you what your data is worth and isn't an offer: any offer comes from the buyer after they review your data, and some companies are not accepted.

Frontenac Labs is an independent referrer. We do not act for any buyer. If your company licenses data to a buyer we introduce, that buyer may pay us a referral fee. You pay us nothing. The buyer alone decides whether to accept your company and on what terms; we cannot promise any price, payout or acceptance. Full disclosure

Before licensing any data, your company must confirm that it has the legal and contractual right to do so, including under privacy law, confidentiality agreements and client contracts. Frontenac Labs does not give legal advice on this; please get your own. This article is general information, not legal or privacy advice.

Sources

1. Office of the Privacy Commissioner of Canada (with the privacy commissioners of British Columbia, Alberta and Quebec), Principles for responsible, trustworthy and privacy-protective generative AI technologies, 7 December 2023. https://www.priv.gc.ca/en/privacy-topics/technology/artificial-intelligence/gd_principles_ai/
2. Office of the Privacy Commissioner of Canada, PIPEDA Findings #2026-002: Overview of the Joint Investigation of OpenAI OpCo, LLC. https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2026/pipeda-2026-002-overview/
3. Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, s. 5(3). https://laws-lois.justice.gc.ca/eng/acts/P-8.6/section-5.html
4. Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, ss. 3.1, 3.2, 3.3, 12, 13, 14 and 17 (official English text, updated to 15 October 2026). https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1
5. Commission d'accès à l'information du Québec, "Responsabilité des entreprises et désignation du responsable de la protection des renseignements personnels." https://www.cai.gouv.qc.ca/protection-renseignements-personnels/information-entreprises-privees/responsable-protection-renseignements-personnels-entreprise