Canadian compliance for film production: PIPEDA, Quebec Law 25, and what production companies need to know

Film production in Canada operates under a layered compliance framework that most production companies underestimate until it creates problems. Federal privacy law, provincial privacy law, union collective agreements, employment standards that vary by province, tax credit documentation requirements, workplace safety regulations, and municipal permit conditions all apply simultaneously, and they do not always align.

This post covers the compliance landscape that Canadian production companies face today, with a focus on the privacy and data protection requirements that have changed significantly in the past few years.

---

The privacy framework: PIPEDA and its provincial counterparts

PIPEDA: the federal baseline

The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's federal private-sector privacy law. It governs how organizations collect, use, and disclose personal information in the course of commercial activities.

For production companies, PIPEDA applies to:

Crew personal data. Contact details, SIN numbers, banking information for payroll, emergency contacts, health information collected for on-set safety purposes. Collection must be limited to what is necessary for identified purposes. Data collected for payroll cannot be repurposed for marketing without separate consent.

Contributor and talent data. Performance agreements, image and likeness rights, biographical information, and residuals tracking all involve personal information. Consent should be specific and documented through clear clauses in performer contracts.

Location filming and B-roll. Capturing images of identifiable individuals through video is collection of personal information under PIPEDA. There is no blanket "public space" exemption for commercial filming. Productions filming in public spaces should post visible signage, use reasonable efforts to avoid capturing identifiable individuals who have not consented, and obtain signed releases from anyone prominently featured.

Biometric and sensitive data. Facial recognition for VFX, on-set medical records, and financial data (performer fee structures) require heightened safeguards and typically express consent.

Mandatory breach notification

Since November 2018, organizations subject to PIPEDA must report any breach of security safeguards involving personal information that poses a "real risk of significant harm" to the Privacy Commissioner of Canada, notify affected individuals as soon as feasible, and keep records of all breaches for 24 months, whether or not they meet the reporting threshold. Penalties for knowingly failing to report can reach $100,000 per affected individual.

An important limitation of PIPEDA

PIPEDA covers employee information only for federally regulated employers. Most production companies are provincially regulated, which means crew employment data falls under provincial privacy legislation where it exists. This is where the framework becomes more complex.

---

Quebec's Law 25: the strictest privacy law in Canada

Quebec's Law 25, which modernizes the province's private-sector privacy law, has been fully in effect since September 2024. It is widely considered the strictest privacy regime in Canada, closer to the EU's GDPR than to PIPEDA.

Any production company that operates in Quebec, shoots in Quebec, processes personal information of Quebec residents, or works with Quebec-based crew and contributors is subject to Law 25.

What Law 25 requires

A designated privacy officer. By default, this is the person with the highest authority in the organization. The role can be delegated in writing, but the name and contact information must be published on the company's website.

Privacy Impact Assessments (PIAs). Required before any new project involving personal information. For a production company, triggers include: new productions involving contributor data, implementing new production management software, using cloud-based dailies or post-production platforms, transferring production data to international co-production partners, or deploying AI-based tools for casting or editing.

Purpose-specific consent. Consent must be requested separately for each specific purpose. It cannot be bundled. For sensitive information, consent must be express. Performer release forms and crew contracts should itemize each specific use of personal information with separate consent mechanisms.

Cross-border transfer assessments. A PIA must be conducted before transferring personal information outside Quebec. The organization must verify that the receiving jurisdiction provides adequate protection. This applies every time a Quebec-based production sends data to a US-based post-production facility, VFX house, or cloud service provider.

Data breach notification. Breaches posing a "risk of serious injury" must be reported to the Commission d'acces a l'information (CAI) and affected individuals. A register of all confidentiality incidents must be maintained.

The penalties are real

Administrative monetary penalties under Law 25 can reach C$10 million or 2% of worldwide turnover, whichever is greater. For serious violations, penal fines can reach C$25 million or 4% of worldwide turnover. These are not theoretical maximums. Quebec's privacy regulator has signalled active enforcement.

---

Provincial privacy laws: Alberta and British Columbia

Three provinces have private-sector privacy laws recognized as "substantially similar" to PIPEDA: Quebec, Alberta, and British Columbia.

Alberta PIPA

Alberta's Personal Information Protection Act covers employee data (unlike PIPEDA), which matters for production companies with Alberta-based crew. Breach notification is mandatory to the Alberta Office of the Information and Privacy Commissioner. Penalties can reach $100,000 for organizations.

BC PIPA

British Columbia's Personal Information Protection Act also covers employee data. One notable difference: BC PIPA does not currently have mandatory breach notification. The BC OIPC has recommended adding it, but as of now, breach reporting is voluntary.

Multi-province productions

A production company shooting in Vancouver with a head office in Toronto and post-production in Montreal could be subject to BC PIPA for on-set data collected in BC, PIPEDA for interprovincial and cross-border data flows (Ontario has no substantially similar provincial law), and Quebec Law 25 for any personal information processed in Quebec. The practical approach is to build policies that satisfy the strictest applicable standard, which is currently Quebec's Law 25.

---

Labour and union compliance across provinces

Canadian film production operates under a patchwork of union collective agreements and provincial employment standards.

Union landscape

ACTRA (Alliance of Canadian Cinema, Television and Radio Artists) covers on-camera and off-camera performers under the Independent Production Agreement (IPA), most recently ratified for 2025 to 2027. The agreement includes a 13.5% wage increase over three years and new protections against AI-generated performances and digital doubles.

IATSE (International Alliance of Theatrical Stage Employees) covers crew and technicians through local unions: Local 873 in Toronto, Local 891 and the BCCFU in British Columbia, and Local 514 in Montreal. Each has its own collective agreement with specific provisions for minimum calls, overtime, turnaround, and fringe contributions.

DGC (Directors Guild of Canada) covers directors, production managers, assistant directors, and editors under separate agreements for Ontario, BC, and Quebec.

Producers must be signatory to the applicable collective agreement before engaging union members. Compliance includes minimum rates, overtime provisions, turnaround periods, contributions to health and welfare funds, and adherence to safety protocols.

Provincial employment standards vary

The differences across provinces affect every production that operates in more than one jurisdiction:

Ontario uses a 44-hour work week before overtime (1.5x). British Columbia triggers daily overtime after 8 hours (1.5x) and double time after 12 hours. Quebec uses a 40-hour work week with overtime at 1.5x but has no statutory daily overtime.

Rest periods differ too. Ontario requires 11 consecutive hours off per day. Quebec requires 32 consecutive hours of weekly rest. BC rules are set through collective agreements that typically provide more specific terms.

Child performer regulations

Ontario's Protecting Child Performers Act (2015) is the most comprehensive in Canada: minimum ages for performers, maximum hours by age group, mandatory tutoring, a trust account requirement (25% of earnings over $2,000 held until age 18), and required supervision with a designated child performers' coordinator. BC and Quebec have their own regulations with different specific requirements.

---

Tax credit documentation

Canadian film tax credits are generous but documentation-intensive. A production claiming the federal Canadian Film or Video Production Tax Credit (CPTC) must earn a minimum of 6 out of 10 Canadian content points, ensure 75% of production costs are paid to Canadians, and submit applications to CAVCO within 24 months of the first taxation year-end following the start of principal photography.

Provincial credits add another layer:

Ontario (OFTTC): 35% of eligible Ontario labour expenditures, with a 40% enhanced rate for first-time producers and a 10% regional bonus for productions outside the GTA. Requires residency declarations, financing documentation, and Ontario corporate tax filing.

British Columbia (FIBC): 40% of eligible BC labour expenditures (increased from 35% in January 2025), plus regional, distant location, training, and DAVE (digital animation and VFX) bonuses. Eligibility certificates should be submitted as early as possible in pre-production.

Quebec (QPSTC): 25% of qualified expenditures for services provided in Quebec (increased from 20%), plus a 16% bonus for VFX and animation work.

Each credit has its own eligibility requirements, application timelines, and documentation standards. Missing a deadline or failing to maintain proper records can mean losing a credit worth hundreds of thousands of dollars.

---

Why compliance tracking matters

The challenge for Canadian production companies is not that any single compliance requirement is unmanageable. It is that they all apply at once, they vary by jurisdiction, and the consequences of gaps are significant: fines under privacy law, loss of tax credits, union grievances, WSIB or CNESST claims, and permit revocations.

When compliance documents are spread across email inboxes, shared drives, and individual hard drives, tracking what is current, what is expiring, and what is missing becomes a manual audit that nobody has time for during active production. The result is that gaps only surface when something goes wrong.

What centralized compliance tracking looks like

A system built for production compliance tracks documents by type, jurisdiction, production, and status. Insurance certificates show their expiry dates. Permits show their validity windows. Crew contracts show which consent provisions are in place. When something is approaching expiry or missing, the system surfaces it before it becomes a problem on set or in an audit.

This is the approach Siasola Production Management is building: compliance tracking that understands the specific requirements of Canadian film production, not generic document storage with compliance bolted on.

---

Getting started

If your production company operates in Canada and you are starting to feel the weight of multi-jurisdictional compliance, the first step is mapping out what you currently track, how you track it, and where the gaps are.

For productions shooting in Quebec, Bill 96 language requirements add another compliance layer affecting call sheets, contracts, and crew communications.

Contact us through our contact form at siasola.com/contact to discuss your compliance needs. We scope every engagement around how your productions actually operate.

---

This post is for informational purposes only. It is not legal advice. Production companies should consult qualified legal counsel for compliance guidance specific to their productions and jurisdictions. Laws and regulations change frequently. Verify current requirements with the relevant regulatory bodies.