Nunavut: the only jurisdiction in the country with no health information statute
Your business falls under federal law, and so does a Nunavut clinic — no territorial health statute stacks on top. It is the simplest case in the country.
Which privacy law applies to a Nunavut business that has its calls answered?
Federal law: the Personal Information Protection and Electronic Documents Act, PIPEDA. Nunavut has no general private-sector privacy statute, and its access statute, ATIPP, reaches public bodies only.
And there is nothing else. Nunavut is the only Canadian jurisdiction without a health information statute: the twelve others have one. For a private clinic in Nunavut, no territorial regime stacks on top of the federal one.
That makes Nunavut the simplest of the thirteen cases. We say it simply rather than pad the page. This is not legal advice.
A short page, and that is the right length
Elsewhere a page like this has to untangle two or three overlapping texts. Here there is one, and it is federal.
Health information held by the Government of Nunavut falls under the territorial access statute, which covers the public sector, and under scattered provisions of the Public Health Act. There is no Nunavut counterpart to the health statutes of Saskatchewan, Manitoba, Yukon or the Northwest Territories.
The territory is reported to be working on such a statute. We found no adopted text, so we will not present a hypothetical law as a deadline. When a text exists, this page will change and will carry its date.
Why federal law applies, and how to say it properly
Your business falls under federal law because the territory has not enacted a statute declared substantially similar to Part 1 of that act. It is not because a Nunavut small business would be a federally regulated undertaking: such an undertaking, in the meaning of the act, is a bank, a telecommunications carrier, an interprovincial transport company.
The distinction is not cosmetic. It explains why the conclusion is identical across the three territories, Manitoba, Saskatchewan, Ontario, Prince Edward Island and the Atlantic provinces: none of those jurisdictions has a general private-sector statute in force.
We owe one caveat: that statement rests on an absence observed across every source we were able to read, including the Canada Gazette consolidated index, and not on a reading of the authoritative federal list — that page was unreachable to us.
The commissioner's office, and what it covers
The territory has its own information and privacy commissioner's office, with an online complaint form. We read its home page on 15 September 2026, and it is that page which confirms the absence of a territorial health statute.
Its jurisdiction runs to the access statute, so to public bodies. A customer complaint about your business's use of their information goes to the Office of the Privacy Commissioner of Canada.
We name no current office-holder: the Northwest Territories and Nunavut shared a single commissioner until her retirement, around the turn of 2020 and 2021, and the two territories have had separate commissioners since. The names we came across date from that period and were not rechecked.
Recording a call: what the law actually asks
Section 184 of the Criminal Code makes it an offence to intercept a private communication, but its exception in section 184(2)(a), read with section 183.1, is satisfied by the consent of one party. A business that is a party to a call can therefore record it without committing that offence.
That a recording is no offence says nothing about whether it is lawful under privacy law. This second regime asks you to tell the caller the call is recorded, state the purpose clearly, refrain from using it afterwards for a different purpose, offer an alternative to someone who declines, give access to the recording on request, and limit retention.
At Zenvox the disclosure is spoken before the microphone opens, on every call, and it cannot be switched off. What the receptionist asks after that comes from your instructions: you set what is necessary, and you stay responsible for it.
The federal breach rule, and what leaves the territory
Since 1 November 2018 you must report to the federal commissioner and notify affected individuals of any breach of security safeguards creating a real risk of significant harm, and keep a record of every breach for 24 months from the day you conclude it occurred.
Elsewhere the split separates what happens inside a province from what leaves it. In Nunavut there is nothing to separate: federal law covers both, inside the territory and beyond its borders. What leaves here, and for how long, is read at the foot of this page; that is our only wording on the point.
Federally, nothing new is in force: Bill C-27 died on the Order Paper on 6 January 2025, and Bill C-36, tabled on 15 June 2026, stood at second reading on 15 September 2026, without royal assent.
What the product puts on your side
One regime to hold, and the same mechanisms to show.