Table of contents
Quick note: we're an AI automation agency, not a law firm. This is practical guidance, not legal advice. For a specific situation, talk to a Canadian privacy lawyer.
The Short Answer
Using ChatGPT for your business is legal. Writing drafts, brainstorming, summarizing your own notes — all fine.
The rules change the moment personal information enters the chat. That means names, emails, phone numbers, addresses, purchase history, health notes — anything about an identifiable person. In Canada, a federal law called PIPEDA (and provincial laws like BC's PIPA) governs how businesses handle that data.
Those laws don't care that the tool is shiny. They care about three things: did the person agree, is the data protected, and does someone at your business answer for it.
What Happened in May 2026 (and Why It Matters to You)
On May 6, 2026, the federal Privacy Commissioner — together with the BC, Alberta and Quebec regulators — released joint findings from their investigation into OpenAI and ChatGPT. They concluded OpenAI's development and deployment of ChatGPT contravened Canadian privacy law.
The federal commissioner accepted OpenAI's fixes and commitments ("well-founded and conditionally resolved"). Notably, BC and Alberta went further — they found the matter "well-founded but unresolved," saying the promised fixes weren't enough.
Why should a plumber in Surrey or a clinic in Victoria care? Because the ruling confirms two things. First, regulators are actively watching how AI tools handle Canadians' data. Second, your business stays responsible for customer data even when a US tech giant processes it. "The AI did it" is not a defence.
PIPEDA's Rules, Translated Into Plain English
PIPEDA has ten principles. For AI tools, four do the heavy lifting:
- Consent. People must meaningfully agree to how you use their information. Feeding it to a new third party — like an AI vendor on US servers — is a use they should know about. Your privacy policy needs to say so.
- Limiting use. Data collected to book a job can't quietly become AI training material. Consumer ChatGPT may use inputs for training depending on your settings — that's the trap.
- Safeguards. You must protect the data with contracts and controls. The tool for this is a data processing agreement (DPA) — standard on business tiers, absent on free consumer accounts.
- Accountability. Your business answers for the data wherever it travels. Cross-border processing is allowed, but you must ensure comparable protection — and no contract overrides the laws of the country where the servers sit (looking at you, US CLOUD Act).
For where the data physically lives — and when that matters — see our companion guide on Canadian data residency for AI tools.
Green, Yellow, Red: Where Your ChatGPT Habits Land
| Practice | Verdict | |
|---|---|---|
| 🟢 | Drafting blog posts, emails with no personal details, job descriptions, SOPs | Fine on any plan |
| 🟢 | Analyzing anonymized or aggregated data ("500 customers, average job $340") | Fine — de-identified data isn't personal information |
| 🟡 | Summarizing a customer email thread on a business/API tier with a DPA, training off, policy updated | Defensible — this is how compliant AI automation works |
| 🟡 | AI receptionist or chatbot collecting caller details, with disclosure and a vendor DPA | Defensible — see our AI receptionist guide |
| 🔴 | Pasting a customer list into free ChatGPT to "clean it up" | Don't — no DPA, possible training use, cross-border with no consent |
| 🔴 | Putting health, financial or legal client details into any consumer AI tool | Don't — sensitive data has higher consent and safeguard bars |
The BC Wrinkle: PIPA
If your business operates in British Columbia, you're likely under BC's Personal Information Protection Act (PIPA) rather than PIPEDA directly — the rules are substantially similar, so everything above still applies. Two BC-specific notes:
- BC's commissioner co-signed the OpenAI findings and took the harder line. Expect BC enforcement to be less forgiving, not more.
- BC businesses answer to a local regulator (the OIPC BC) that has shown it will act on AI. "Everyone does it" won't help you.
Quebec's Law 25 is stricter again — if you serve Quebec customers, get specific advice.
How to Use AI With Customer Data, Legally
Here's the setup we use for our own client automations, in five steps:
- Use business-grade AI. API or enterprise tiers of OpenAI, Anthropic or Google — or Azure OpenAI, which offers Canadian data centres. Never the free consumer apps for customer data.
- Sign the DPA. Every AI vendor touching personal information needs a data processing agreement naming where data is stored and who else touches it.
- Turn training off. Confirm in writing that your inputs aren't used to train models. Business tiers default to this; consumer tiers may not.
- Update your privacy policy and get consent. Disclose that you use AI tools, that processing may happen outside Canada, and what for. Meaningful consent means people could actually understand it.
- Minimize and de-identify. The AI summarizing your intake emails rarely needs full names and card numbers. Strip what the task doesn't need — the safest data is data you never sent.
The 60-Second Self-Check
Tick what's true for your business today:
🛡️ AI Privacy Self-Check
FAQ
No. General business use is legal. The privacy obligations start when customers' personal information goes into the tool.
Don't. No DPA, possible training on your inputs, and cross-border processing without consent — that combination typically fails PIPEDA. Use a business tier with a DPA instead.
Canada's federal and provincial privacy regulators released joint findings that ChatGPT contravened privacy law. The federal case is conditionally resolved; BC and Alberta consider it unresolved. It confirms regulators are watching AI closely.
Not if it's built right: callers are told, data is minimized, the vendor has a DPA, and storage location is known. That's standard in our builds.
Usually it's not mandatory — but contracts, regulated industries or risk tolerance can require it. Our data residency guide covers when it matters and which tools offer it.
Want automation that won't wake up your lawyer?
We build AI systems with DPAs, disclosure and data-residency options handled from day one.
Book a Free Consultation