Saskatchewan: the provincial commissioner says itself that it does not cover you

A Saskatchewan business falls under federal law. The provincial commissioner says so in writing, and keeps one exception: health « trustees ».

Which privacy law applies to a Saskatchewan business that has its calls answered?

Federal law, the Personal Information Protection and Electronic Documents Act — PIPEDA. Saskatchewan has no general private-sector privacy statute, and unlike Manitoba it has not even passed one that then sat unproclaimed.

The provincial commissioner's office puts it in writing on its own page for businesses: it has no authority over the private sector, apart from organisations that are health information « trustees ».

On substance, then, your position looks like that of a business in Manitoba, Prince Edward Island or any of the three territories. We say so rather than manufacture a difference. This is not legal advice.

Where you stand when the phone rings

You run a garage in Saskatoon, a dental clinic in Regina, a roofing outfit covering three municipalities. You want to know what a service that answers and records your calls puts on you, and under whose authority.

The two Saskatchewan access statutes a search engine offers you first — FOIP, and its local-authority counterpart — cover provincial institutions, municipalities, police services and libraries. They do not bind you.

What does bind you is federal, and it applies in full, with no exemption order. The rest of this page says what it asks at the moment of a call, and what changes if your files are health files.

The provincial commissioner rules the private sector out

On its « Saskatchewan Business and Privacy » page, the commissioner's office writes that it « has no authority over the federal government, unions, not for profit organizations or the private sector other than organizations that are health information "trustees" ».

That is unusual, and useful: instead of having to infer a regulator's lack of jurisdiction from a statute, you read it in the regulator's own words, on a public page aimed at business owners. We read it on 15 September 2026.

The office presents itself in English only: no French name exists on its site, which we checked directly. We do not invent one, and on our French page we name it by its function.

Recording a call: the Criminal Code settles only half of it

Section 184 of the Criminal Code makes it an offence to intercept a private communication, and the exception in section 184(2)(a), read with section 183.1, is satisfied by the consent of one party. A business that is a party to the call can therefore record it without committing that offence.

Privacy law is a separate and cumulative regime. It asks you to tell the caller the call is recorded, state the purpose clearly, refrain from using it afterwards for another purpose, offer a different route to someone who declines, give access to the recording on request, and limit retention.

At Zenvox the disclosure is spoken before the microphone opens and cannot be switched off. What the receptionist asks after that comes from your instructions, and that is where the line of what is necessary gets drawn.

« Trustee », and why the word matters

Saskatchewan's health information statute — The Health Information Protection Act, S.S. 1999, c. H-0.021, in force since 1 September 2003 — uses the word « trustee ». Manitoba does the same. Ontario, Alberta, the Atlantic provinces and the Northwest Territories say « custodian ».

This is not vocabulary trivia for lawyers: search the Saskatchewan text for « custodian » and you will find nothing. The word to search for is « trustee ».

That statute has not been declared substantially similar to federal law. A physician in private practice in Saskatchewan is therefore subject to both at once — the same position as in Manitoba, Prince Edward Island and the three territories.

What we decline to write, and why

Several law firm posts state that notifying the Saskatchewan commissioner of a breach is mandatory under the health statute. We read the official consolidated text in full, along with its 2023 regulations, and we did not find the numbered provision that would create that duty.

What we did find is a duty to safeguard: section 16 requires a trustee to have policies and administrative, technical and physical measures in place. The guidance the commissioner publishes reads as expected practice.

An absence observed is not a certainty. So we will write neither that Saskatchewan imposes breach notification nor that it imposes none. What is certain, and reaches you either way: federal law does impose notification, and the next section describes it.

The federal rule, and what leaves the province

Since 1 November 2018 you must report to the federal commissioner and notify affected individuals of any breach of security safeguards that creates a real risk of significant harm, and keep a record of every breach for 24 months from the day you conclude it occurred.

The split is the same everywhere: provincial law governs what happens inside a province, federal law governs information moving out of the province or out of the country. In Saskatchewan, with no general provincial statute, federal law already covers the whole of it. What leaves in our case, and for how long, is written at the foot of this page; we do not rewrite it here, so that only one version of it exists.

Federal law is under reform, not otherwise in force: Bill C-27 died on the Order Paper on 6 January 2025, and Bill C-36, tabled on 15 June 2026, stood at second reading on 15 September 2026, without royal assent.

What we read, and when

Checked on 2026-09-15

What the product puts on your side

A notice at the start of the call, an access record, an export and a deletion that work. The pages that describe them:

Privacy policySecurity and data handlingTeam, access and dataOur subprocessors