Newfoundland and Labrador: federal law, and a breach notice that splits in two
Your business falls under federal law. For a clinic, the provincial health statute separates notice to the individual from notice to the commissioner — and the second turns on a definition that lives in regulations.
Which privacy law applies to a Newfoundland and Labrador business that has its calls answered?
Federal law: the Personal Information Protection and Electronic Documents Act, PIPEDA. Newfoundland and Labrador has no general private-sector privacy statute, and its access statute, ATIPPA, 2015, « applies exclusively to public bodies » — the statute says so in its own definition.
If you are a custodian of personal health information, the provincial health statute — the Personal Health Information Act, SNL 2008, c. P-7.01 — displaces Part 1 of the federal act for what happens inside the province, under an order made on 20 September 2012.
That order carries an SI/ number, not the SOR/ number used for New Brunswick and Nova Scotia. The effect is identical; the citation, elsewhere, is often wrong. This is not legal advice.
What is common, and the little that is not
For an ordinary business — a garage in Corner Brook, a snow-clearing outfit in Mount Pearl, a salon in St. John's — your position matches six other Canadian jurisdictions: no provincial private-sector statute, so federal law, in full.
We say that rather than manufacture a Newfoundland distinction that does not exist. The useful difference shows up one step further in, on the health side, and it lies in how the provincial statute splits breach notice.
The rest of this page covers call recording, the federal breach rule, and information leaving the province.
Breach notice in two steps, and a definition that lives elsewhere
The provincial health statute uses the word « custodian », not « trustee »: the vocabulary is Ontario's, Alberta's and that of the other two Atlantic provinces, not Manitoba's and Saskatchewan's. Its definition, at section 4(1), reaches a person who has custody or control of personal health information in carrying out their duties — the provincial health authority, health professionals, care providers, facility operators, pharmacies and other designated entities.
Section 15(3) requires notice to affected individuals at the first reasonable opportunity, subject to the exceptions in section 15(7).
Section 15(4) splits off the second addressee: where a custodian reasonably believes there has been a « material breach as defined in the regulations », it must inform the commissioner. That definition lives in the regulations, and we have not consulted them: so we will not say here what it covers.
The SI/ order, and why the citation matters
The exemption order covering Newfoundland and Labrador custodians was made on 20 September 2012 and published on 10 October 2012. It carries the number SI/2012-72 — a statutory instrument, not a regulation in the SOR/ series.
You will often read « SOR/2012-72 » in summaries. That is a wrong citation. On a page that claims to be sourced, a wrong number costs more than a missing one, which is why we take the trouble to say it.
The effect of the order is the same as the others: the exclusion covers what happens inside the province, and federal law remains for interprovincial and international exchanges, for federally regulated businesses, and for anything that is not a custodian.
One office, two statutes, and no fee
The provincial Office of the Information and Privacy Commissioner administers ATIPPA, 2015 and the health statute, with separate forms for each. Filing a complaint costs nothing.
For ordinary commercial activity that is not the office you write to: a customer complaint about a business's use of their information goes to the Office of the Privacy Commissioner of Canada.
We name no office-holder, and we could not read the office's site directly: so we cite the address and nothing more.
Recording a call, the federal rule, and what leaves the province
The Criminal Code does not stop a business that is party to a call from recording it: the exception in section 184(2)(a), read with section 183.1, is satisfied by the consent of one party. Privacy law asks on top of that for the caller to be told at the start of the call about the recording and its purpose, for the recording not to be reused for another purpose, for a different route to be offered to someone who declines, for access on request, and for limited retention. At Zenvox the disclosure is spoken before the microphone opens and cannot be switched off.
Since 1 November 2018: report to the federal commissioner and notify affected individuals of any breach of security safeguards creating a real risk of significant harm, and keep a record of every breach for 24 months from the day you conclude it occurred.
The split holds here as everywhere: provincial law governs what happens inside a province, federal law governs information moving out of the province or out of the country. In our case, what leaves and for how long is read at the foot of this page, in one place and in one wording.
Federally, Bill C-27 died on the Order Paper on 6 January 2025, and Bill C-36, tabled on 15 June 2026, stood at second reading on 15 September 2026, without royal assent.
What we read, and when
- Personal Health Information Act, SNL 2008, c. P-7.01 — sections 4(1), 15(3) and 15(4)
- Canada Gazette — Personal Health Information Custodians in Newfoundland and Labrador Exemption Order, SI/2012-72
- Breach of Security Safeguards Regulations, SOR/2018-64
- LEGISinfo — status of Bill C-36 on 15 September 2026
Checked on
What the product puts on your side
The mechanisms the law asks you to hold, described page by page, with no label.