Nova Scotia: the regulator the statute calls the « Review Officer »
Your business falls under federal law. For a clinic, the provincial health statute inverts the logic of breach notice — and the regulator's name in the statute is not the name it uses in public.
Which privacy law applies to a Nova Scotia business that has its calls answered?
Federal law: the Personal Information Protection and Electronic Documents Act, PIPEDA. Nova Scotia has no general private-sector privacy statute, and its access statute, FOIPOP, covers government and bodies whose members are appointed by the Crown.
If you are a custodian of personal health information, the provincial health statute — the Personal Health Information Act, S.N.S. 2010, c. 41 — displaces Part 1 of the federal act for what happens inside Nova Scotia, under a 2016 federal order.
Two things here deserve your attention, and you will not find them by searching the statute for the word « commissioner ». This is not legal advice.
The word you are looking for is not in the statute
You open the Nova Scotia health statute, search for « commissioner », and find nothing useful. That is not your mistake: inside the statute the regulator is called the « Review Officer », by reference to another provincial act.
In public, the same office presents itself as the Information and Privacy Commissioner for Nova Scotia. No official French name exists: the federal order itself, in its French version, keeps the English title of the Nova Scotia statute. So we do not translate it, and on our French page we name the office by its function.
If your business has nothing to do with health care, none of this reaches you: it is the federal regime, in full, and the body that hears a complaint is the Office of the Privacy Commissioner of Canada.
Breach notice, and its inverted mechanism
Section 69 of the Nova Scotia health statute requires a custodian to notify the individual at the first reasonable opportunity where it believes on reasonable grounds that information has been stolen, lost, or subject to unauthorised access, use, disclosure, copying or modification — and that there is a potential for harm or embarrassment to the individual.
Section 70 lets the custodian conclude that notice is not required. But if it does, section 70(2) then requires it to « notify the Review Officer as soon as possible ».
That is the reverse of the Alberta mechanism, where the organisation notifies the commissioner and the commissioner decides about notice to individuals. In Nova Scotia it is the decision NOT to notify the individual that triggers notice to the regulator. Notice to the Review Officer is therefore not automatic, and writing otherwise would be wrong.
Who is a custodian, and who is not
The statute defines a custodian at section 3(f): a regulated health professional or group practice, the minister, a health authority, the review board, a pharmacy, a continuing-care facility, Canadian Blood Services, and any other body designated by regulation. We read the official consolidation, current to 1 April 2026.
A plumber, a garage, a salon, a dance school or a real estate agency is not in that list: those businesses fall under federal law, as they do everywhere in the country outside Quebec, Alberta and British Columbia.
Veterinarians are not in that list either. We stop there: we have no direct source on the status of information held by a veterinary clinic, and we will draw no conclusion about it on this page.
Recording a call: what the Criminal Code settles, and what it leaves open
Section 184 of the Criminal Code makes it an offence to intercept a private communication. Its exception in section 184(2)(a), read with section 183.1, is satisfied by the consent of one party: a business that is a party to the call can therefore record it without committing that offence.
Privacy law is a separate regime. It asks you to tell the caller at the start of the call about the recording and its purpose, to refrain from reusing the recording for another purpose, to offer a different route to someone who declines — coming in person, writing, using the web — to give access to the recording on request, and to limit retention.
At Zenvox the disclosure is spoken before the microphone opens and cannot be switched off. What the receptionist asks after that comes from your instructions, and that is where the line of what is necessary gets drawn.
The federal rule, and what leaves the province
Since 1 November 2018 an organisation under federal law must report to the federal commissioner and notify affected individuals of any breach of security safeguards creating a real risk of significant harm, and keep a record of every breach for 24 months from the day it concludes the breach occurred.
The 2016 federal order says expressly that the exclusion of Nova Scotia custodians applies to collection, use and disclosure occurring in Nova Scotia. Outside the province, federal law remains. That is the split that holds everywhere: provincial law governs what happens inside a province, federal law governs the trip out.
What leaves in our case, and how long a copy survives elsewhere, is written at the foot of this page, in the one wording we use for it. We do not rewrite it here.
Federally, nothing new is in force: Bill C-27 died on the Order Paper on 6 January 2025, and Bill C-36, tabled on 15 June 2026, stood at second reading on 15 September 2026, without royal assent.
What we read, and when
- Personal Health Information Act, S.N.S. 2010, c. 41 — official consolidation, sections 3(f), 69 and 70
- Canada Gazette — Personal Health Information Custodians in Nova Scotia Exemption Order, SOR/2016-62
- Breach of Security Safeguards Regulations, SOR/2018-64
- LEGISinfo — status of Bill C-36 on 15 September 2026
Checked on
What the product puts on your side
The things that get demonstrated rather than declared: a spoken disclosure, an access record, an export and a deletion.