General

Organization

Entity subject to CPPA obligations.

How the laws define this

At their core, these frameworks treat an organization as an entity—such as a corporation, partnership, or association—that carries out regulated operations. They diverge significantly regarding the specific activities and sectors that bring an entity under their scope. Under the Digital Charter Implementation Act (Bill C-27) and the Consumer Privacy Protection Act (CPPA), the concept is strictly tied to commercial context, defining an organization as a private-sector actor that collects, uses, discloses, or manages personal information during commercial activities. In contrast, the Hiroshima Process International Guiding Principles for Organizations Developing Advanced AI Systems and International Code of Conduct for Organizations Developing Advanced AI Systems expands this definition well beyond commercial data processing. The Hiroshima Process applies the term to entities across academia, civil society, the private sector, and the public sector, as long as they are involved in the design, development, and deployment of AI.

Synthesised from the 3 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
Canada	Consumer Privacy Protection Act (CPPA) (proposed, part of Bill C-27)	Under Review	Limits to entities collecting, using or disclosing personal information specifically in the course of commercial activities under the proposed CPPA.
G7	Hiroshima Process International Guiding Principles for Organizations Developing Advanced AI Systems and International Code of Conduct for Organizations Developing Advanced AI Systems	Adopted	Broadens to any entities from academia, civil society, private and public sectors involved in AI design, development and deployment, not limited to commercial activities.
Canada	Digital Charter Implementation Act (Bill C-27) — An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act	Withdrawn	Specifies examples like legal persons, corporations, partnerships or associations managing personal information in commercial activities under the withdrawn Bill C-27.

What it triggers

Under the proposed CPPA, would require compliance with statutory obligations, accountability duties and enforcement powers including privacy management programs, consent rules and breach reporting.
The G7 Hiroshima Process sets out international guiding principles and a voluntary code of conduct for organizations developing advanced AI systems.source
Under the withdrawn Digital Charter Implementation Act (Bill C-27), would have required privacy management programs, consent rules and breach reporting.source

Definitions (3)

A legal person, corporation, partnership, association, or other entity that collects, uses, discloses, or manages personal information in the course of commercial activities and is therefore subject to CPPA requirements such as privacy management programs, consent rules, and breach reporting.

Digital Charter Implementation Act (Bill C-27) — An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data ActDefinition 1 of 3

An entity that collects, uses or discloses personal information in the course of commercial activities; the statutory obligations, accountability duties and enforcement powers in the CPPA largely apply to organizations as defined. This captures private‑sector actors subject to the Act's compliance requirements.

Consumer Privacy Protection Act (CPPA) (proposed, part of Bill C-27)Definition 2 of 3

Entities from academia, civil society, the private sector, and the public sector involved in the design, development, and deployment of AI.

Hiroshima Process International Guiding Principles for Organizations Developing Advanced AI Systems and International Code of Conduct for Organizations Developing Advanced AI SystemsDefinition 3 of 3

Not to be confused with

Personal information processor

Personal information processor determines purposes and means of processing, while organization under CPPA is any entity handling personal information in commercial activities.

personal information controller/processor

Personal information controller/processor distinguishes roles in determining purposes/means or processing on behalf, unlike the broader organization capturing any entity in commercial activities.

Questions and answers

What organizations does the proposed CPPA apply to?

The CPPA targets entities that collect, use or disclose personal information in commercial activities. It imposes statutory obligations, accountability duties and enforcement powers on these private-sector actors.

Does the G7 AI code apply to non-commercial entities?

Yes, it covers entities from academia, civil society, private and public sectors involved in advanced AI design, development and deployment. It provides voluntary guiding principles and a code of conduct.

What were the organization obligations under withdrawn Bill C-27?

Bill C-27 would have subjected legal persons, corporations and similar entities handling personal information commercially to CPPA requirements like privacy programs and breach reporting.