Privacy comes first in a Canadian room
The federal Personal Information Protection and Electronic Documents Act (PIPEDA) governs private-sector organizations in most provinces and personal information that crosses provincial or national borders. Quebec, Alberta and British Columbia have their own private-sector laws, which apply instead of PIPEDA for activity within those provinces.
Which privacy law reaches the room
For deal teams, the most useful provision is the business transaction exception in section 7.2 of PIPEDA. It lets parties use and disclose personal information without consent where it is needed to decide whether to proceed with a prospective transaction, provided they have an agreement limiting its use to that purpose, requiring protection, and requiring return or destruction if the deal does not go ahead. The Office of the Privacy Commissioner of Canada explains the conditions. In practice this means the NDA should carry the right wording before HR files go into the room.
Quebec’s Law 25 adds a step: before personal information is communicated outside Quebec, the organization must assess whether it will receive adequate protection, taking into account the sensitivity of the information and the legal framework where it goes. Guidance comes from the Commission d’accès à l’information. If a Quebec target has bidders in the US or Europe, do this assessment early, as it can affect which folders open in the first round.
How deals run
Canadian sell-side processes are usually run by a bank or boutique adviser, with a first round on summary information and a second round on the full room. Cross-border buyers are common, especially from the United States, and many Canadian targets operate in both English and French, which affects naming conventions and Q&A routing.
Public M&A follows the take-over bid rules in National Instrument 62-104, with bids generally open for 105 days unless shortened, and plans of arrangement approved by a court are a frequent alternative structure. Each province has its own securities commission, such as the Ontario Securities Commission and Quebec’s Autorité des marchés financiers, coordinated through the Canadian Securities Administrators.
Foreign buyers should also allow for the Investment Canada Act. Beyond the net benefit thresholds, the federal government can review any foreign investment on national security grounds, and it has signalled closer scrutiny of sensitive sectors such as critical minerals. If a review is possible, keep sensitive technical folders on a narrower permission group until the position is clear.
| Review | Authority | What it means for the room |
|---|---|---|
| Pre-merger notification | Competition Bureau | Keep the room and Q&A log available until clearance |
| Net benefit or national security review | Investment Canada Act (federal minister) | Foreign buyers may face conditions or delay |
| Take-over bids and disclosure | Provincial securities commissions | Insider lists and controlled access for public targets |
| Privacy complaints | OPC and provincial commissioners | NDA terms and limited access to personal data |
The Competition Bureau publishes the current notification thresholds, which are updated periodically.
Currency, tax and price
Every price on this site is in USD and indicative; confirm with the provider. Ellty publishes $149/mo with a 14-day free trial, and Firmex, iDeals and Datasite quote on request. A Canadian buyer pays in USD or in a converted figure, so a six-month room can cost noticeably more or less in Canadian dollars than budgeted. GST, or HST in participating provinces, may apply to digital services from foreign suppliers, and Quebec adds QST. Whether you see tax on the invoice or account for it yourself depends on the supplier’s registration and your status, so ask your accountant. VDR pricing explains how per-page, per-user and flat billing affect the total.
Indicative room budget in Canada
Pick a billing model, then set the length of the process and the number of users.Common Canadian deal types
- Mid-market private company sales, often to US strategic buyers (mergers and acquisitions).
- Mining and energy transactions, with technical reports and permits (energy and infrastructure).
- Pension fund and private equity investments (private equity).
- CCAA restructurings, where a court-supervised sale process needs fast bidder access (restructuring and bankruptcy).
Firmex users weighing alternatives can read iDeals vs Firmex and Firmex vs Ansarada.
Deal timeline in Canada
Canadian privacy law shapes the sequence of a sale more than in the US: the right agreement has to be signed before personal information opens, and individuals have to be told after closing.
Deal timeline in Canada
- Preparation Map personal data Sort records by province; Quebec data gets its own assessment.
- Round one NDA with s. 7.2 terms Use limited to the deal, protection required, return or destruction if it fails.
- Round two Full room and Q&A English and French documents routed to the right reviewers.
- Review Competition and ICA Pre-merger notification or an Investment Canada review can add time.
- After closing Notify individuals Within a reasonable time, tell people their information was disclosed.
The post-closing notice is easy to forget because it falls after the deal team has moved on. Put it on the closing checklist next to the archive export.
Data protection obligations at a glance
Data protection obligations at a glance: Canada
Cross-border transfer options
PIPEDA has no list of approved countries. It holds the organization accountable for information it hands to others, wherever they are, and expects that accountability to be backed by contract.
Cross-border transfer options for a Canadian room
Common mistakes in Canadian rooms
- Relying on section 7.2 without the agreement. The exception depends on the written commitments; a generic NDA may not contain them.
- Forgetting the post-closing notice. It is a statutory step, not a courtesy.
- Treating Quebec like any other province. The assessment takes time and can change which folders open to foreign bidders.
- English-only structure for a bilingual target. Folder names and Q&A routing should work for French-speaking managers and counsel too.
- Budgeting in USD without a margin. Six months of exchange rate movement plus GST or HST can shift the total noticeably.
Choosing a provider for a Canadian deal
Firmex, headquartered in Canada, is a familiar name to many Canadian advisers. iDeals and Datasite are common on larger cross-border processes, and Ellty brings the full deal toolkit with e-signature and AI tools at a published monthly price. Whichever you shortlist, ask three Canada-specific questions: where files are stored and from where support staff can reach them (for your PIPEDA and Quebec documentation), whether the interface and notifications work well for French-speaking users, and how the provider handles return or destruction of data if a bidder drops out. The answers feed directly into the section 7.2 agreement.
FAQ
Can I share employee data with bidders under PIPEDA?
Section 7.2 allows it for a prospective business transaction if the information is necessary for the decision and the parties have an agreement restricting use, requiring protection and requiring return or destruction. Many teams still anonymise until late in the process.
Does Quebec Law 25 stop data leaving the province?
It does not ban it, but it requires an assessment before communication outside Quebec and a written agreement reflecting the results. Build that step into the timetable.
Should a Canadian deal use a Canadian-hosted room?
There is no general federal requirement. Some public-sector bodies and contracts impose residency, so check yours and ask each provider where it stores files rather than assuming.