Kerson Wallaw
400-3 Place Ville Marie, Montréal QC H3B 2E3
Ph: (514) 312-1555
Book a free consult
Pick a time · Request a callback

GDPR, when Europe reaches Canada.

The European Union’s General Data Protection Regulation can apply to a Canadian business that serves or monitors people in Europe. Here is when it applies and what it demands.

Talk to an expertRelated insights

GDPR in brief.

Type
EU regulation, directly applicable
Full name
Regulation (EU) 2016/679, General Data Protection Regulation
Regulators
National supervisory authorities, coordinated by the European Data Protection Board
Applies to
EU organizations, and non-EU organizations that offer goods or services to, or monitor, people in the EU
Applies since
2018-05-25
Canada
Partial adequacy for PIPEDA-regulated commercial organizations

What, why and who.

What it is

The GDPR sets the principles for processing personal data, the lawful bases for it, the rights of individuals, and the duties of controllers and processors: records of processing, impact assessments, data protection officers, breach notification and rules on international transfers.

Why it exists

To protect the fundamental right to data protection in the EU Charter, and to harmonize rules so personal data can move freely within the single market.

Who it applies to

Organizations established in the EU or EEA, and non-EU organizations, including Canadian ones, that offer goods or services to people in the EU or monitor their behaviour, for example through website tracking. Those must usually appoint a representative in the EU.

Authority and enforcement

Each EU country’s supervisory authority enforces the GDPR, with a lead authority for cross-border cases. The European Data Protection Board issues guidelines and binding decisions. Authorities can investigate, order changes, ban processing and impose fines.

How it got here.

  1. 1995-10-24

    Directive 95/46/EC, the predecessor, is adopted.

  2. 2012-01-25

    The European Commission proposes a regulation.

  3. 2016-04-27

    The GDPR is adopted.

  4. 2018-05-25

    The GDPR applies across the EU.

  5. 2020-07-16

    The Schrems II ruling invalidates the EU-US Privacy Shield.

  6. 2023-07-10

    The EU-US Data Privacy Framework adequacy decision is adopted.

  7. 2025-11-19

    The Commission proposes the Digital Omnibus, including targeted GDPR amendments.

  8. 2025-12-12

    A regulation on GDPR cross-border enforcement procedures is published; it applies from 2027-04-02.

What it changes.

Systems and tools

  • Cookie consent with prior opt-in
  • Records of processing activities
  • Transfer tools such as standard contractual clauses

Processes

  • Lawful-basis mapping for each processing purpose
  • Impact assessments for high-risk processing
  • Breach notice to the authority within 72 hours
  • Responses to individuals within one month

Governance

  • A data protection officer where required
  • An EU representative if you are outside the EU
  • Processor agreements (Article 28)
  • Privacy by design and by default

If you do not comply

  • Fines up to €20 million or 4% of worldwide annual turnover, whichever is higher
  • Fines up to €10 million or 2% for other breaches
  • Orders to stop processing or suspend transfers
  • Compensation claims from individuals

Changes ahead.

Announced and upcoming changes

  • ProposalDigital Omnibus (COM(2025) 837): would refine the definition of personal data, raise the breach-notice threshold to high risk with a 96-hour deadline, and move cookie rules into the GDPR. Under negotiation, not law.
  • 2027-04-02New procedural rules for cross-border enforcement apply.

Status checked 2026-10-03. Dates can move; confirm with the official sources below.

This website stores cookies on your computer. Cookie Policy