New Brunswick: federal law, and an ombud rather than a commissioner
Your business falls under federal law. The one New Brunswick statute that can reach you is the health one — and it has you notify the Ombud, not a commissioner.
Which privacy law applies to a New Brunswick business that has its calls answered?
Federal law: the Personal Information Protection and Electronic Documents Act, PIPEDA. New Brunswick has no general private-sector privacy statute.
Its access statute, RTIPPA, covers roughly five hundred public bodies. The provincial government says as much itself: « It does not apply to other organizations such as private businesses, non-profits, and federal government departments and agencies. »
One sectoral exception exists: if you are a custodian of personal health information, the provincial health statute displaces Part 1 of the federal act for what happens inside New Brunswick. This is not legal advice.
Two readers, two answers
If you run a garage in Moncton, a salon in Dieppe or a renovation business in Bathurst, your answer fits on one line: the federal regime, in full, and the body that hears a complaint is the Office of the Privacy Commissioner of Canada.
If you run a clinic, a pharmacy or a regulated health professional's practice, your answer changes: a provincial statute reaches you directly, and the New Brunswick Ombud oversees it.
For the first reader, New Brunswick law says nothing particular: it is the same federal regime as in Ontario, Manitoba, Saskatchewan and the three territories. We say so rather than manufacture a difference, and what changes for you is then read inside the federal regime itself. What is genuinely specific to New Brunswick starts at the health statute, and that is the subject of the next two sections.
An ombud, not a commissioner: New Brunswick stands alone
Of the four Atlantic provinces, New Brunswick is the only one to hand privacy oversight to an ombud rather than a dedicated commissioner. Ombud NB is an independent officer of the Legislative Assembly, and it handles both the access statute and the health statute.
That changes what you type into a search engine, and it changes where a complaint goes. For a health file, the complaint goes to the Ombud. For ordinary commercial activity it goes to the federal commissioner — the Ombud has no jurisdiction over it.
A second feature, useful when hunting for a statute text: New Brunswick is the only officially bilingual province in the country. Its statutes carry an official French title, which those of Nova Scotia, Prince Edward Island and Newfoundland and Labrador do not.
The health statute, and a breach notice with two addressees
The Personal Health Information Privacy and Access Act — PHIPAA, S.N.B. 2009, c. P-7.05, text current to 1 January 2024 — governs custodians. A 2011 federal order excludes them from Part 1 of the federal act for what happens inside New Brunswick.
Section 49(1)(c), under the marginal note on information practices, requires a custodian to « notify the individual to whom the information relates and the Ombud in the manner prescribed by the regulations at the first reasonable opportunity » where personal health information is stolen, lost, disposed of except as permitted, or disclosed to or accessed by an unauthorized person.
Notify the individual and the regulator together, at the first reasonable opportunity: that mechanism differs from Nova Scotia's, where it is the decision not to notify the individual that triggers notice to the regulator. Two neighbouring provinces, two mechanics.
What the exclusion does not cover, and it is the central point
The regulatory impact statement published with the New Brunswick order lists what the order does not exclude: transfers of information across provincial or national borders, activities of persons who are not custodians, federally regulated businesses, and personal information about employees.
That sentence governs this whole section of the site. Even for a New Brunswick custodian, federal law stays in play the moment information leaves the province.
What leaves in our case, where it goes and for how long: the statement at the foot of this page says so, in the one wording we use for it. On a provincial page that is exactly the fact to read beside the name of a statute — and a second version, written here, would end up saying something else.
Recording a call, and reporting a breach
The Criminal Code does not stop a business that is party to a call from recording it: the exception in section 184(2)(a), read with section 183.1, is satisfied by the consent of one party. Privacy law, for its part, requires the caller to be told at the start of the call about the recording and its purpose, to be offered another route if they decline, to be able to request access to the recording, and for retention to be limited.
At Zenvox the disclosure is spoken before the microphone opens and cannot be switched off. What the receptionist asks after that comes from your instructions.
On the federal side, since 1 November 2018: report to the federal commissioner and notify affected individuals of any breach of security safeguards creating a real risk of significant harm, and keep a record of every breach for 24 months from the day you conclude it occurred. Bill C-27 died on the Order Paper on 6 January 2025; Bill C-36, tabled on 15 June 2026, stood at second reading on 15 September 2026, without royal assent.
What we read, and when
- Personal Health Information Privacy and Access Act, c. P-7.05 — section 49(1)(c)
- Right to Information and Protection of Privacy Act, c. R-10.6
- Ombud NB — filing a complaint
- Canada Gazette — New Brunswick health custodians exemption order, and the exact reach of the exclusion
- Breach of Security Safeguards Regulations, SOR/2018-64
Checked on
What the product puts on your side
Mechanisms, not a label: a disclosure at the start of the call, an access record, an export and a deletion.