PIPEDA & Law 25

Regulated Canadian retailers evaluating a video security vendor need to know exactly how that vendor handles cross-border data exposure — not just where servers are hosted, but where the company is legally domiciled.

Vigil is Canadian-incorporated. A US-incorporated vendor remains subject to the US CLOUD Act regardless of where it physically hosts data — incorporation, not server location, is what determines that exposure.

PIPEDA governs how private-sector organizations collect, use, and disclose personal information in the course of commercial activity across Canada.

Law 25 sets additional requirements for organizations handling the personal information of Quebec residents, including stricter consent and breach-notification rules than PIPEDA alone requires. Vigil is built to meet Law 25’s bar, not just PIPEDA’s.