# Selling company data to AI companies from Canada

URL: https://sellmydatatoai.net/guides/sell-company-data-to-ai-from-canada
Reviewed: 2026-11-08

Canadian companies can license data to AI buyers, but PIPEDA requires knowledge and consent to disclose personal information, and its business transaction exception does not cover deals whose main purpose is selling or leasing personal information. Quebec adds strict anonymization rules and an assessment before data leaves the province. Most sellers anonymize or exclude personal information before licensing.

## Key takeaways

- PIPEDA Principle 4.3 requires knowledge and consent for the collection, use or disclosure of personal information, except where inappropriate.
- Section 7.2(4) of PIPEDA excludes business transactions whose primary purpose or result is the sale or lease of personal information from the business transaction exception.
- Quebec allows anonymization only for serious and legitimate purposes, and its regulation in force since May 30, 2024 sets the method.
- IRS Table 1 shows 0% US withholding on copyright and know-how royalties paid to Canadian residents, and 10% on some other royalty types.

This guide covers Canadian law for a Canadian company licensing records to an AI buyer, usually based in the US. It describes what the statutes and the Office of the Privacy Commissioner of Canada say. The general questions of ownership and contracts are in our guide to [whether you can legally sell company data](https://sellmydatatoai.net/guides/can-you-legally-sell-company-data-for-ai).

> **Not legal or tax advice** This guide summarizes Canadian and US law and official guidance. It is not advice on your situation. Take independent legal and tax advice before licensing any data.

## Which privacy laws and regulators apply in Canada?

The Personal Information Protection and Electronic Documents Act applies to private sector organizations in commercial activity, regulated by the Office of the Privacy Commissioner of Canada. Quebec has its own Act respecting the protection of personal information in the private sector, amended by the reforms known as Law 25 and overseen by the Commission d'accès à l'information. Alberta and British Columbia also have their own private sector laws.

Federal reform is pending. DLA Piper reports that Bill C-36, the Protecting Privacy and Consumer Data Act, was tabled on June 15, 2026 to replace Part 1 of PIPEDA and received first reading that day. It would keep de-identified information as personal information and prohibit re-identification with limited exceptions. Check its progress before you rely on current law.

## Do you need consent to license customer and employee records?

You generally need consent to license customer records that contain personal information. PIPEDA Principle 4.3 says the knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where inappropriate.

PIPEDA's business transaction exception does not help a data license. The Act defines a business transaction to include the lease or licensing of an organization's assets, but section 7.2(4) says the exception does not apply to a transaction whose primary purpose or result is the purchase, sale or other acquisition or disposition, or lease, of personal information.

Information is about an identifiable individual where there is a serious possibility that someone could be identified from it, alone or combined with other information, according to the OPC's interpretation bulletin. Data that passes that test is personal information and needs consent to disclose. Data that does not is outside PIPEDA.

Employee records follow different rules. PIPEDA covers employee personal information mainly for federally regulated employers, while Quebec, Alberta and British Columbia cover employees under their own laws. Check which law applies to each group of staff before you include workplace email or HR data.

## What have Canadian regulators said about AI training?

Canadian regulators have said that organizations must have legal authority, such as valid consent, for handling personal information at every stage of an AI system, including training. The OPC and its provincial and territorial counterparts set this out in their joint Principles for responsible, trustworthy and privacy-protective generative AI technologies, published on December 7, 2023.

- Collection and use of personal information for training should be limited to what is necessary, with filters to remove it where possible
- Organizations should use anonymized, synthetic or de-identified data rather than personal information where personal information is not needed
- Developers should document their training datasets, including sources, the legal authority for collecting them, licensing restrictions and filtering applied
- Public availability does not mean data can be indiscriminately collected or used

The documentation point affects sellers directly. A buyer following these principles will want to record your data's source, legal authority and license terms, so prepare that file before you share samples.

## What does Quebec require for anonymization?

Quebec requires anonymization to be irreversible and limits it to serious and legitimate purposes. Section 23 of the private sector act says that once the purposes of collection are achieved, an organization must destroy the information or anonymize it to use it for serious and legitimate purposes, according to Blake, Cassels and Graydon.

The Regulation respecting the anonymization of personal information took effect on May 30, 2024. Blakes summarizes its steps: define the purposes first, remove direct identifiers, run a preliminary re-identification risk analysis, use generally accepted techniques, show that the risk of re-identification is very low and keep a register.

## How do you transfer personal information to a US buyer?

PIPEDA has no adequacy regime, so transfers to a US buyer rest on accountability and consent. The OPC's 2009 guidelines say a transfer to a third party for processing is a use, not a disclosure, and Principle 4.1.3 keeps the organization responsible for information transferred for processing. A license for the buyer's own purposes is a disclosure, which brings consent back into play.

The same OPC guidelines say organizations should tell people clearly that their information may be processed in another country and may be accessible to its authorities. In Quebec, Borden Ladner Gervais notes that section 17 requires an assessment of privacy-related factors before communicating personal information outside Quebec, adequate protection and a written agreement.

Bill C-36 would make the federal rule more explicit. DLA Piper says it would require organizations to assess and mitigate privacy risks before disclosing or transferring personal information outside Canada, and that its coming into force depends on Bill C-34. Anonymized data avoids most of these questions, which is why sellers anonymize before export.

## Does Canadian copyright law affect a license?

Canadian copyright law affects a license mainly through ownership, because the Copyright Act has no exception written specifically for text and data mining. Innovation, Science and Economic Development Canada consulted on copyright in the age of generative AI and published a What We Heard report in 2025. Confirm you own or have cleared the content you plan to license, including work by contractors.

## Does a US buyer withhold tax on payments to a Canadian seller?

A US buyer must generally withhold 30% on US-source royalties paid to a foreign seller unless the Canada-US tax treaty reduces the rate. IRS Publication 515 says royalties for copyrights and similar property are sourced where the property is used.

IRS Tax Treaty Table 1 shows the Canada-US rates under Article XII as 0% for copyright royalties other than film and television, 0% for patents and know-how or other industrial royalties, and 10% for industrial equipment and film and television royalties. You claim treaty rates on Form W-8BEN-E. Which category a data license falls into depends on the contract.

For GST/HST, the CRA's Memorandum 4.5.3 says a supply of intangible personal property to a non-resident who is not registered for GST/HST is generally zero-rated under section 10.1 of Part V of Schedule VI, unless an exception applies, such as property that can only be used in Canada. Keep evidence of the buyer's status. Take tax advice, and see our guide to [tax on AI data license payments](https://sellmydatatoai.net/guides/tax-on-ai-data-license-payments).

## Which buyers accept sellers from Canada?

Two buyers in our directory name Canada. [micro1](https://sellmydatatoai.net/data-buyers/micro1) says demand is strongest in the US, UK and Canada. [Endless Data](https://sellmydatatoai.net/data-buyers/endless-data) prioritizes companies in the US, UK and Canada. AWS's seller eligibility list for paid products does not include Canada, so check its current terms before planning a listing there.

## What are Canada's rules at a glance?

| Area | Rule | Source |
| --- | --- | --- |
| Federal privacy law | PIPEDA, with Bill C-36 at first reading since June 15, 2026 | Justice Laws Website, DLA Piper |
| Regulators | OPC federally, CAI in Quebec, provincial commissioners in Alberta and British Columbia | OPC |
| Consent | Knowledge and consent for disclosure, except where inappropriate | PIPEDA Principle 4.3 |
| Business transaction exception | Not available where the main purpose is selling or leasing personal information | PIPEDA section 7.2(4) |
| Quebec anonymization | Irreversible, for serious and legitimate purposes, under the 2024 regulation | Quebec private sector act section 23 |
| Transfers | Accountability and notice under PIPEDA, assessment and written agreement in Quebec | OPC, Quebec section 17 |
| US withholding on royalties | 0% or 10% under Article XII depending on type, with Form W-8BEN-E | IRS |
| GST/HST | Intangible personal property to unregistered non-residents generally zero-rated | CRA Memorandum 4.5.3 |

For a view of likely buyers, a realistic range and the rights issues to clear first, request a free [data valuation](https://sellmydatatoai.net/data-valuation).

## Frequently asked questions

### Can a Canadian company sell customer data to an AI company?

A Canadian company can license customer data only with the knowledge and consent PIPEDA requires, or after anonymizing it so no serious possibility of identification remains. PIPEDA's business transaction exception does not apply where the main purpose is selling or leasing personal information. Quebec adds its own anonymization and transfer rules. Take advice.

### What did Canada's privacy regulators say about generative AI?

Canada's federal, provincial and territorial privacy regulators published joint principles on December 7, 2023. They say organizations need legal authority, such as valid consent, for personal information used in training, should use anonymized, synthetic or de-identified data where possible, and should document training data sources and licensing restrictions.

### Is Bill C-36 law in Canada?

Bill C-36, the Protecting Privacy and Consumer Data Act, was tabled on June 15, 2026 and received first reading that day, according to DLA Piper. It would replace Part 1 of PIPEDA but was not law at that stage. Until it passes and comes into force, PIPEDA and the provincial private sector laws continue to apply.

### Will a US buyer withhold tax from a Canadian seller?

A US buyer must generally withhold 30% on US-source royalties paid abroad, but IRS Table 1 shows lower Canada-US treaty rates: 0% for copyright and know-how royalties and 10% for industrial equipment and film and television royalties. You claim them on Form W-8BEN-E. The category depends on your contract. Take tax advice.

## Sources

- [Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5)](https://laws-lois.justice.gc.ca/eng/acts/P-8.6/FullText.html), Justice Laws Website, Government of Canada, accessed November 2026
- [Interpretation bulletin: personal information](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda-compliance-help/pipeda-interpretation-bulletins/interpretations_02/), Office of the Privacy Commissioner of Canada, accessed November 2026
- [Principles for responsible, trustworthy and privacy-protective generative AI technologies](https://www.priv.gc.ca/en/privacy-topics/technology/artificial-intelligence/gd_principles_ai/), Office of the Privacy Commissioner of Canada, accessed November 2026
- [Guidelines for processing personal data across borders](https://www.priv.gc.ca/en/privacy-topics/airports-and-borders/gl_dab_090127/), Office of the Privacy Commissioner of Canada, accessed November 2026
- [Canada tables Bill C-36, the Protecting Privacy and Consumer Data Act](https://www.dlapiper.com/insights/publications/2026/06/canada-tables-bill-c36-the-protecting-privacy-and-consumer-data-act), DLA Piper, accessed November 2026
- [Act respecting the protection of personal information in the private sector (P-39.1)](https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1), LégisQuébec, accessed November 2026
- [Privacy update: Quebec publishes final anonymization regulation](https://blakes.com/insights/privacy-update-quebec-publishes-final-anonymization-regulation), Blake, Cassels and Graydon, accessed November 2026
- [Cross-border transfers of personal information outside Quebec](https://www.blg.com/en/insights/2022/12/cross-border-transfers-of-personal-information-outside-quebec), Borden Ladner Gervais, accessed November 2026
- [Consultation on copyright in the age of generative artificial intelligence: what we heard report](https://publications.gc.ca/site/eng/9.947840/publication.html), Government of Canada Publications, accessed November 2026
- [Publication 515 (2026), Withholding of Tax on Nonresident Aliens and Foreign Entities](https://www.irs.gov/pub/irs-pdf/p515.pdf), Internal Revenue Service, accessed November 2026
- [Tax treaty table 1: tax rates on income other than personal service income](https://www.irs.gov/pub/irs-lbi/tax-treaty-table-1.pdf), Internal Revenue Service, accessed November 2026
- [GST/HST Memorandum 4.5.3, Exports: services and intangible personal property](https://www.canada.ca/en/revenue-agency/services/forms-publications/publications/4-5-3/exports-services-intangible-personal-property.html), Canada Revenue Agency, accessed November 2026
- [Data partnerships](https://www.micro1.ai/data-partnerships), micro1, accessed November 2026
- [Endless Data homepage and FAQ](https://endless-data.com/), Endless Data, accessed November 2026
- [Seller eligibility requirements](https://docs.aws.amazon.com/marketplace/latest/userguide/seller-eligibility.html), Amazon Web Services, accessed November 2026

---

Book a free consultation: https://sellmydatatoai.net/book-a-consultation