The short answer
Cross-border lending means moving sensitive personal information across the border every day: IDs, credit reports, bank statements, tax returns. Canada allows those transfers but holds the sending organization accountable for protecting the data. Quebec adds a formal assessment before data leaves the province. In the US, the rules depend on whether the borrower is a consumer and which state they live in.
Canada today: PIPEDA and the provincial acts
PIPEDA. The Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, governs private-sector organizations in provinces without substantially similar legislation, and all interprovincial and international transfers. It is principles-based: organizations must obtain meaningful consent, collect only what they need, protect it and remain accountable for it.
Transfers to the US. PIPEDA does not ban transfers outside Canada. The organization remains accountable for information it transfers to a third party for processing, so it must use contracts and other means to ensure a comparable level of protection. The Office of the Privacy Commissioner also expects organizations to tell individuals that their information may be processed in another country and may be accessible to that country's authorities.
Breach reporting. Since 2018, organizations must report breaches that create a "real risk of significant harm" to the Privacy Commissioner, notify affected individuals and keep records of all breaches (s. 10.1).
Alberta and BC. Alberta and British Columbia each have a Personal Information Protection Act that applies to private organizations within those provinces. Alberta's Act includes mandatory breach notification to the Commissioner.
Quebec: Law 25
Quebec's Act to modernize legislative provisions as regards the protection of personal information, S.Q. 2021, c. 25 (Law 25), substantially rewrote the private sector privacy act, with most provisions in force by September 2023. Key points for lenders:
- Privacy impact assessment before transfer. Before communicating personal information outside Quebec, an organization must assess whether it will receive adequate protection, considering the sensitivity of the information, the purposes, the safeguards and the legal framework of the destination.
- Written agreement. The transfer must be governed by a written agreement reflecting the assessment.
- Person in charge. Organizations must designate a person in charge of personal information protection (by default, the highest-ranking executive) and publish their contact details.
- Penalties. Administrative monetary penalties can reach $10 million or 2% of worldwide turnover, and penal fines up to $25 million or 4% of worldwide turnover.
A US lender funding Quebec mortgages, or a Canadian broker sending Quebec borrower files to a US lender, should complete the Law 25 assessment before the first file is sent.
What is coming: Bill C-36
On 15 June 2026, the federal government introduced Bill C-36, which would replace the privacy provisions of PIPEDA with a new Protecting Privacy and Consumer Data Act (Gowling WLG). The bill would create a new regulator, the Digital Safety and Data Protection Commission of Canada, with direct penalty powers. McCarthy Tétrault notes it would also create a broader private right of action that could increase class actions. The bill is still before Parliament and may change. PIPEDA remains in force in the meantime. See Blog 17.
United States: purpose and place
Gramm-Leach-Bliley Act. The GLBA (15 U.S.C. § 6801 et seq.) protects nonpublic personal information about consumers held by financial institutions, including many non-bank lenders. The FTC's Safeguards Rule (16 C.F.R. Part 314) requires a written information security program, a qualified individual to oversee it, encryption and multi-factor authentication. Since 2024, it also requires notifying the FTC of security events affecting 500 or more consumers within 30 days of discovery.
Business-purpose borrowers. Business-purpose lending to entities generally sits outside the GLBA's consumer definitions, but the individual principals and guarantors are still people whose data is protected by state law.
State privacy laws. California's Consumer Privacy Act, as amended by the CPRA (Civ. Code § 1798.100 et seq.), exempts information subject to the GLBA but otherwise covers California residents' personal information, including business contacts and employees since 2023. More than a dozen other states now have comprehensive privacy laws, and every state has a data breach notification statute.
Practical program for cross-border lenders
- Map what borrower and guarantor data you collect, where it is stored and who receives it
- Put data protection terms in every broker, servicer and vendor agreement
- Complete a Law 25 transfer assessment for any Quebec data leaving the province
- Update privacy notices to disclose cross-border processing
- Adopt a written security program meeting the FTC Safeguards Rule where it applies
- Build one breach response plan covering PIPEDA, provincial and US state deadlines
- Balance FINTRAC and FinCEN record-keeping duties (Article 7) against data minimisation
Frequently asked questions
Frequently asked questions
Can a Canadian broker send borrower files to a US lender?
Yes. PIPEDA allows it, but the broker remains accountable and should use contractual protections and inform borrowers. Quebec data requires a Law 25 assessment first.
What is Bill C-36?
A federal bill introduced on 15 June 2026 to replace PIPEDA's privacy provisions with the Protecting Privacy and Consumer Data Act and a new regulator. It is not yet law.
Does the GLBA apply to private business-purpose lenders?
The GLBA protects consumer information. Business-purpose loans to entities are generally outside it, but state laws still protect individual principals' data.
What are the penalties under Quebec's Law 25?
Up to $25 million or 4% of worldwide turnover for penal offenses, and up to $10 million or 2% for administrative penalties.
This content is general information for industry professionals and is not legal, tax or financial advice. Laws change and apply differently to each transaction; obtain advice from qualified counsel in each relevant jurisdiction. Legal counsel to the Cross-Border Private Lenders Association: Jasmine Daya & Co. Questions: info@cbpla.com