The “2025-2026 Survey of Canadian businesses on privacy-related issues” conducted by the Office of the Privacy Commissioner of Canada has found that Canadian businesses are aiming to meet their compliance obligations under national privacy law.
Ninety-one percent of businesses reported that they are taking steps to fulfill their privacy law obligations; 84 percent said they had implemented privacy policies, 72 percent had appointed privacy officers, and 62 percent conducted regular privacy training with employees. Two-thirds of businesses consider themselves ready to respond to data breaches affecting personal information.
This edition of the biennial survey showed that 16 percent of business now use artificial intelligence for business operations, up from 6 percent in 2023. Among these, 45 percent typically used AI for research and document drafting, 24 percent for marketing, 18 percent for text or data analysis, and 15 percent for customer service or chatbots. Nonetheless, just 2 percent of companies use customers’ personal information to train AI systems.
Sixty-three percent of companies store data obtained from customers electronically on site, while 50 percent store them off-site through a third party like a cloud service.
It also found that 29 percent of businesses obtained personal information from under-18 minors. Eighty-five percent of businesses said they validated age and 84 percent secured parental consent for minors under 13. Sixty-eight percent said they made privacy policies and practices available in age-appropriate, simple language.
AI and children’s privacy are both strategic priorities for Philippe Dufresne, Canada’s privacy commissioner.
“In the age of AI, personal data is being collected, used, and shared at an unprecedented scale. Organizations that prioritize privacy enjoy greater consumer trust which is good for businesses and good for Canadians,” Dufresne said in a statement.
He described the survey results as “encouraging.”
“Businesses that handle customers’ personal information are increasingly aware of and acting to meet their privacy responsibilities and I hope that this trend will continue,” Dufresne said.
The “2025-2026 Survey of Canadian businesses on privacy-related issues” was conducted specifically with businesses that directly sell or offer services or products to individual consumers and that collect customers’ personal data. Eight hundred Canadian businesses were surveyed via telephone between January 19 and February 25.
The OPC commissioned Phoenix Strategic Perspectives to conduct the survey.