Covers Personal information handled in commercial activities within federal scope and interprovincial or international transactions.

The main requirements are to obtain meaningful consent; limit collection, use, disclosure and retention; safeguard data; provide access and correction; maintain accountability.

Personal-data protection follows information through collection, use, storage, sharing and deletion. The organisation deciding the purpose of processing can have different responsibilities from a supplier processing information on its behalf. Identifying those roles makes it possible to connect notices, permissions, contracts and security controls to the actual handling of customer and transaction data.

The practical questions are what information is needed, why it is used, who receives it, how long it is retained and how individuals can exercise the rights available under the relevant framework. Payment execution, financial-crime prevention, legal record keeping and optional marketing are different purposes. A basis for one purpose should not be treated as unlimited permission for every other use.

Security and privacy overlap but are not identical. Preventing unauthorised access does not alone answer whether an authorised use is lawful, while a privacy notice does not replace effective access control or incident response. Cross-border processing and outsourced services add further relationships that need to be understood within the instrument's territorial and substantive scope.

The instrument also addresses reporting and evidence: report breaches creating a real risk of significant harm, notify affected individuals and keep breach records.