AI in HR: Data Privacy, Ethics, and What Every Canadian Employer Must Know in 2026

AI is making more employment decisions than ever before. Canada’s legal framework is shifting faster than most HR teams realize. This guide covers the risks, the regulations — including Bill C-36 tabled June 15, 2026 — and 10 best practices for using AI in HR responsibly.

🔴 Breaking: Bill C-36 — Canada’s new Protecting Privacy and Consumer Data Act (PPCDA) — was tabled on June 15, 2026. If enacted, it will be the most significant overhaul of Canada’s federal privacy law in over 25 years, with fines up to $25 million or 5% of global revenue for serious violations. It is not yet law, but preparation should start now.

Read the government backgrounder → | McCarthy Tétrault analysis → | Lawson Lundell guide →

AI is no longer peripheral to how Canadian organizations hire, manage, and develop their people. Resume screening, candidate ranking, video interview analysis, attrition prediction, performance scoring, compensation modelling — all of these are now supported or driven by AI systems in a growing share of Canadian workplaces. The efficiency gains are real. So are the risks.

Deloitte’s Global Human Capital Trends research found that 95% of executives are concerned about the accuracy of data used in AI-enabled talent processes. That concern is well-founded. AI systems are only as good as the data they’re trained on, and the employment decisions they influence — who gets interviewed, promoted, flagged for departure, or assessed for performance — carry legal, ethical, and reputational weight that a misconfigured algorithm cannot bear.

In Canada, the legal landscape governing this area has been in motion for years — and it accelerated significantly in 2026. Ontario’s mandatory AI disclosure law took effect January 1, 2026. Quebec’s Law 25 has been fully in force since September 2024. And on June 15, 2026, the federal government tabled Bill C-36, the most ambitious privacy reform Canada has attempted in a generation. HR leaders who are still treating AI governance as a future consideration are already behind.

This guide provides a practical, Canada-specific overview of the risks, the regulatory landscape, and 10 best practices for using AI in HR responsibly. It is written for HR leaders, not lawyers — but it includes the legal references your legal counsel will want to see.

Important note: This article provides general information about Canadian laws and regulations as they relate to AI in HR. It is not legal advice. Employment privacy law is provincial and fact-specific. Before implementing or modifying any AI hiring or people management process, employers are strongly encouraged to consult a qualified employment and privacy lawyer.

Section 1 — Why AI Governance in HR Matters More in 2026

The argument that AI governance is a ‘future consideration’ no longer holds. Three developments have converged in 2026 to make this an immediate operational priority for Canadian HR leaders.

AI adoption in HR has crossed a threshold

According to recent research, 92% of companies plan to increase AI investment in HR in the near future, and 83% of Canadian organizations already use AI tools for at least some part of the recruitment process. The transition from experimental to operational has happened. Organizations that deployed AI recruiting tools quickly during the talent crunch of 2021–2023 often did so without adequate governance frameworks — and those frameworks are now overdue.

The regulatory gap is closing — faster than expected

Canada has historically operated with a light regulatory touch on AI. That is changing. Ontario now has a live AI disclosure obligation. Quebec has the most GDPR-like privacy regime in Canada. And Bill C-36, tabled this week, signals that the federal government is prepared to move aggressively on privacy and algorithmic accountability — with penalties that boards and CFOs will notice.

The stakes of getting it wrong have risen

A biased screening algorithm is no longer just an ethical concern. In Canada, it is potential liability under the Canadian Human Rights Act, provincial human rights codes, and — increasingly — under privacy legislation that governs how personal information is used to make decisions about individuals. The combination of rising legal exposure, growing employee awareness, and increasing media attention to algorithmic bias means that the cost of inaction now substantially exceeds the cost of governance.

Section 2 — How AI Is Actually Being Used in Canadian HR

Before addressing the risks, it’s useful to be concrete about the applications. AI in HR isn’t one thing — it’s a wide range of tools with different purposes, different data inputs, and different potential failure modes. The privacy and ethics risks vary significantly by application.

Section 3 — Five Risks Every HR Leader Needs to Understand

These are not hypothetical risks. Each of the following has produced documented harm, legal action, or regulatory attention in Canada or comparable jurisdictions. Understanding them is the first step toward designing AI deployments that avoid them.

R1. Algorithmic Bias and Discrimination

AI models learn from historical data. In HR, historical data reflects historical hiring decisions — which in most organizations embedded conscious and unconscious biases around gender, ethnicity, age, educational background, and disability. A model trained on ten years of successful hires will learn to replicate the characteristics of whoever got hired, not whoever should have been hired.

The most famous example remains Amazon’s internal AI recruiting tool, abandoned in 2018 after it systematically downgraded resumes that contained the word ‘women’s’ (as in ‘women’s chess club’). The model had been trained on resumes submitted to Amazon over a decade, which skewed heavily male in technical roles. The bias was structural — not a bug, but a consequence of training on biased inputs.

📋 Canadian example: A research study involving 8,000 resumes found that resumes with Anglophone names received significantly more callbacks in Toronto, Montreal, and Vancouver than resumes with equivalent qualifications but names associated with South Asian, Chinese, or Greek backgrounds. AI screening tools trained on callback data from such organizations would encode this bias at scale.

⚖ Legal exposure: Algorithmic discrimination that produces adverse effects on protected groups is actionable under provincial human rights codes and the Canadian Human Rights Act, regardless of intent. The absence of intent does not eliminate liability — the outcome is what matters.

R2. Data Overcollection and Surveillance Creep

AI systems require data — and the pressure to improve model accuracy creates a temptation to collect more of it. In HR contexts, this manifests as monitoring software that tracks keystrokes, application use, and active time; video interview platforms that analyze micro-expressions and vocal tone; and engagement tools that mine calendar, email, and Slack patterns to predict attrition. Each layer of data collection creates a new category of personal information that requires legal justification and appropriate protection.

The challenge is that many HR leaders don’t have a clear picture of what data their AI vendors are collecting, where it’s stored, or what it’s being used for beyond the stated purpose. Vendor contracts often contain broad data use clauses that would not survive scrutiny under Quebec’s Law 25 or the incoming PPCDA framework.

📋 Canadian example: Ontario’s Working for Workers Acts require employers to disclose electronic monitoring policies to employees. Quebec’s Law 25 requires privacy impact assessments before deploying technology that collects personal information. Both obligations apply to AI tools that monitor employee activity — even tools marketed as productivity or engagement platforms.

⚖ Legal exposure: Data minimization is a core principle of Canadian privacy law: organizations may only collect what is genuinely necessary for a stated purpose. Collecting broad categories of employee data ‘just in case’ is explicitly out of compliance with PIPEDA and will be further restricted under PPCDA.

R3. Opaque Decisions and the Right to Explanation

One of the most practically significant challenges with AI in HR is the opacity problem. When an algorithm ranks candidates, scores performance, or predicts attrition, the people affected often have no idea. They don’t know that a decision was made algorithmically. They can’t challenge the factors that influenced it. They can’t correct inaccurate data that fed into it. This isn’t just an ethical concern — it’s increasingly a legal one.

📋 Canadian example: Under Quebec’s Law 25 Section 12.1, when a decision about an individual is made exclusively by automated processing, the organization must inform the person, provide the personal information used, explain the principal factors behind the decision, and offer the person an opportunity to submit observations for human review. The CAI’s 2025–2026 guidance has specifically flagged resume screening tools that automatically reject candidates as potentially triggering these obligations.

⚖ Legal exposure: Bill C-36 (PPCDA) would require organizations to be ‘transparent about their use of automated decision making for significant decisions about individuals’ — which in an HR context covers hiring, promotion, and termination decisions influenced by AI. This obligation would apply nationally if enacted.

R4. Data Sovereignty and Cross-Border Exposure

Most AI tools used in Canadian HR are operated by US-headquartered companies running infrastructure under US jurisdiction. Employee data processed through these platforms — resumes, performance records, engagement data, video interview recordings — may be subject to US law, including the CLOUD Act, which allows US law enforcement to compel disclosure of data held by US companies regardless of where the data physically resides.

This isn’t a theoretical risk for large organizations: it’s a documented compliance challenge. Organizations that send employee personal information to US-hosted platforms without proper contractual protections, privacy notices, and impact assessments may already be in violation of PIPEDA, and will face clearer obligations under PPCDA, which would explicitly require risk assessments before transferring personal information outside Canada.

📋 Canadian example: A mid-size Canadian company using a US-based ATS (applicant tracking system) that stores candidate data on AWS servers in Virginia may have obligations under both Canadian privacy law (PIPEDA/Law 25) and potentially the EU AI Act for any EU-based candidates. Mapping data flows through your HR tech stack is no longer optional risk management — it’s incoming legal compliance.

⚖ Legal exposure: PPCDA would require organizations to assess and mitigate privacy risks before sending personal information outside Canada — a direct response to the CLOUD Act concern. Prepare your vendor due diligence process now.

R5. Regulatory Liability in a Rapidly Moving Landscape

The most underestimated risk isn’t any specific harm — it’s being caught unprepared when the regulatory landscape finalizes. Canada has been in a period of legislative uncertainty since Bill C-27/AIDA died in Parliament in January 2025. That uncertainty has led some organizations to defer AI governance work, reasoning that there’s no specific rule to comply with yet. Bill C-36 changes that calculation.

PPCDA, if enacted on its current timeline (12–24 months from first reading), will require organizations to have documented privacy management programs, data minimization practices, impact assessment processes, and transparency mechanisms already in place. Building these in the weeks before the law takes effect will be impossible. Organizations that start now will comply with manageable effort; those that wait will face rushed remediation at significant cost.

⚖ Legal exposure: The fines regime under PPCDA is not symbolic: up to $25 million or 5% of global annual revenue for the most serious violations, administered by a new, independent Digital Safety and Data Protection Commission with binding order authority. For a company with $100M in global revenue, that’s a $5M exposure. For a company with $1B, it’s $50M.

Section 4 — Canada’s AI and Privacy Regulatory Landscape in 2026

Canada’s regulatory framework for AI in HR is not one law — it’s a patchwork of federal privacy law, provincial legislation, employment standards, and human rights codes, each with different obligations and different enforcement mechanisms. The table below provides a practical overview for HR leaders.

Source: Government of Canada: Bill C-36 Backgrounder | Lawson Lundell: Bill C-36 Analysis | Labour & Employment Law Canada: AI in Hiring | Employsome: AI Laws for HR 2026 Global Guide

Quebec: Canada’s Most Advanced AI Governance Regime

Quebec’s Law 25 represents the most specific and most immediately enforceable AI governance obligation facing Canadian employers. While the federal framework has been in transition, Law 25 has been fully in force since September 2024 — and the Commission d’accès à l’information (CAI) has been actively sharpening its guidance on AI in the workplace.

The critical provision is Section 12.1: when an organization uses personal information to render a decision based exclusively on automated processing, it must inform the person at the time of — or before — communicating the decision. Critically, the CAI’s 2025 guidance has flagged resume screening tools that automatically reject candidates, AI systems that score interviews without human review, and systems that autonomously advance or filter candidates as likely triggering Section 12.1 obligations.

The practical implication: if your ATS rejects a candidate based on algorithmic scoring without any human review, you may have a Law 25 obligation to notify that candidate — and to provide, upon request, the personal information used, the principal factors behind the decision, and an opportunity to submit observations to a human who can review the outcome.

The Law 25 compliance shortcut: Section 12.1 obligations apply to decisions made exclusively by automated processing. If a human meaningfully participates in the decision — not rubber-stamping an AI recommendation, but genuinely reviewing and exercising judgment — the notification requirement does not apply. Building meaningful human review into your AI-assisted hiring process is both the ethical and the legally defensible approach.

Section 5 — 10 Best Practices for Ethical AI in Canadian HR

These practices are not aspirational — they are the concrete actions that reduce legal exposure, protect employee rights, and produce better hiring and people management outcomes. Several are now legally required in specific jurisdictions; all of them represent responsible practice regardless of whether any given law compels them.

1. Conduct a Privacy Impact Assessment Before Deploying Any AI HR Tool

A Privacy Impact Assessment (PIA) is a structured analysis of how a proposed AI system will collect, use, and disclose personal information — and what risks that creates. Under Quebec’s Law 25, PIAs are mandatory before deploying any technology that processes personal information. Under the incoming PPCDA, they will likely be required more broadly. Even where not legally mandated, they are best practice.

A good PIA for an AI HR tool should answer: What personal information does this system collect? Why? From whom? What decisions does it influence? What could go wrong? Who is accountable? How can individuals exercise their rights? Keep the PIA document on file — a regulator may ask for it.

2. Apply Data Minimization — Collect Only What the AI Genuinely Needs

Data minimization is a foundational privacy principle: collect only the personal information that is genuinely necessary for the stated purpose. In AI HR contexts, this means resisting the temptation to feed models more data in the hope of improving accuracy — and auditing what your existing vendors are collecting on your behalf.

In practice: does your video interview AI need to analyze facial micro-expressions to assess communication skills? Does your ATS need to retain application data from unsuccessful candidates for five years? Does your engagement platform need to monitor employee email metadata? For each data element, ask: is this genuinely necessary, or is it ‘nice to have’ at the expense of employee privacy?

3. Disclose AI Use to Candidates and Employees — It’s Now the Law in Ontario

Effective January 1, 2026, Ontario employers with 25 or more employees must disclose in publicly posted job ads whether they use artificial intelligence to screen, assess, or select applicants. This is a direct, live legal obligation — not a best practice recommendation.

Beyond legal compliance, disclosure is the right thing to do. Candidates who know AI is being used to screen their application can provide information in formats the system can parse accurately. They can exercise their rights under applicable privacy law. And they can make informed decisions about whether to proceed with their application. Transparency builds trust — and the organizations that get this right will have a meaningful employer brand advantage over those that don’t.

4. Audit Your AI Tools for Bias Before and After Deployment

Deploying an AI hiring tool without testing it for disparate impact is not a neutral act — it’s a choice to accept unknown bias risk. A pre-deployment bias audit should test whether the tool produces statistically different outcomes for candidates from different demographic groups when qualifications are equivalent. A post-deployment audit should monitor whether those disparities are emerging in real hiring data over time.

Ask your AI vendors for their bias testing methodology and results. If they can’t provide clear answers, that is itself informative. The EU AI Act classifies AI tools used in hiring, promotion, and dismissal as high-risk systems requiring mandatory bias testing — and Canadian employers hiring EU-based staff will need to comply from August 2026 regardless of what domestic law requires.

5. Keep Humans in the Loop for Consequential Employment Decisions

This is simultaneously the most ethically important and the most practically effective best practice. AI should assist human judgment in HR — not replace it. For any decision that materially affects an individual’s employment — hiring, promotion, performance rating, compensation, discipline, termination — a human should meaningfully review the AI’s output, exercise independent judgment, and be accountable for the final decision.

‘Meaningful review’ does not mean rubber-stamping an algorithmic recommendation. It means understanding what the AI considered, questioning outputs that seem anomalous, applying contextual knowledge the model doesn’t have, and being able to explain the decision to the person affected. A manager who approves every AI recommendation without review has not provided meaningful oversight — and has not satisfied either the legal requirement or the ethical obligation.

6. Map Where Your Employee Data Goes — Especially Across Borders

Many Canadian HR teams use US-headquartered tools for recruiting, performance management, learning, payroll, and benefits. Each tool represents a potential cross-border data flow. Under PIPEDA, there are notification requirements for transfers outside Canada. Under Quebec’s Law 25, cross-border transfers require specific disclosures and risk assessments. Under PPCDA, organizations will be required to assess and mitigate privacy risks before sending personal information outside Canada.

Build a data flow map of your HR tech stack: which systems process personal information, who operates them, where servers are located, and what contractual protections govern data use. This map is not just a compliance artifact — it’s the foundation of any meaningful privacy risk assessment for AI tools.

7. Build an AI Governance Policy Before You Need One

An AI governance policy for HR defines how the organization makes decisions about adopting AI tools, what safeguards are required, how tools are monitored, how employees and candidates can exercise their rights, and who is accountable when something goes wrong. Under the incoming PPCDA, every organization will be required to implement and maintain a formal privacy management program. AI governance is a core component of that program.

Start with a simple framework: a list of approved AI tools, the purpose of each, the personal information they process, the safeguards in place, and the review cadence. Assign a named owner. Review annually and when new tools are adopted. The organizations that will find PPCDA compliance manageable are the ones who start building this infrastructure now, not after the law comes into force.

8. Document Your AI Decision Rationale — For When You’re Asked

Under Quebec’s Law 25, candidates can request the personal information used in an automated decision, the principal factors that influenced it, and an opportunity for human review. Under the incoming PPCDA, transparency requirements for automated decision-making in significant employment contexts will apply nationally. Being able to respond to these requests requires documentation that most organizations don’t currently maintain.

For each AI-influenced employment decision, maintain a record of: what tool was used, what data it processed, what output it produced, what human review occurred, and what the final decision was and why. This documentation protects the organization in the event of a complaint or regulatory inquiry — and disciplines the process in ways that reduce bias risk.

9. Train Your HR Team on AI Literacy — Not Just AI Tools

There is a meaningful difference between knowing how to use an AI tool and understanding how it works, what it can get wrong, and what your obligations are when it does. Most AI HR tools are deployed faster than the training needed to use them responsibly. HR professionals who understand the concept of training data bias, who know what a false positive and false negative mean in a screening context, and who can critically evaluate an AI recommendation are meaningfully better equipped to prevent harm than those who treat AI output as authoritative.

Include AI literacy as part of your HR team’s professional development. Specifically: what is the difference between supervised and unsupervised learning? How does an ATS ranking algorithm work? What does ‘disparate impact’ mean legally? What are the rights of candidates and employees when AI influences a decision that affects them? These are no longer optional knowledge areas for Canadian HR professionals.

10. Design for Accountability — Assign a Named Owner for AI Governance

Governance without accountability is aspiration, not practice. Every AI tool deployed in HR should have a named owner — a person who is responsible for its ongoing compliance, who receives and responds to employee and candidate requests related to it, who monitors its outputs for anomalies, and who escalates issues when they arise. In larger organizations, this may be a privacy officer or a Chief People Officer. In smaller ones, it may be the HR director or an external privacy counsel on retainer.

PPCDA will require organizations to designate a person responsible for their privacy management program. Treat that requirement as the floor, not the ceiling. The organizations with the strongest AI governance are the ones where accountability is named, visible, and actually exercised — not the ones with the most comprehensive policy documents that nobody owns.

Frequently Asked Questions

Does Ontario’s AI disclosure law apply to all employers?

No. Ontario’s AI disclosure requirement, which came into effect January 1, 2026 under the Working for Workers Four Act, 2024 (Bill 149), applies to employers with 25 or more employees who publicly post job ads. It does not apply to general recruitment campaigns, internal hiring, or employers with fewer than 25 employees at the time of posting. The requirement is to disclose whether AI is used to screen, assess, or select applicants — but the definition of ‘artificial intelligence’ for this purpose remains broadly interpreted and includes tools ranging from keyword filtering systems to machine learning models.

Is it legal to use AI to screen resumes in Canada?

Yes, subject to several conditions. Resume screening AI is currently legal under Canadian law, but its use creates legal obligations and liability exposure. Employers must comply with PIPEDA (and the incoming PPCDA) regarding consent and purpose limitation for personal information. Ontario employers with 25+ employees must disclose AI use in job postings. Quebec employers must comply with Law 25’s requirements, including potential notification obligations under Section 12.1 if the screening produces decisions exclusively by automated processing. All employers must ensure that AI screening does not produce discriminatory outcomes under applicable human rights legislation, regardless of intent.

What is Quebec Law 25 and how does it affect HR?

Quebec’s Law 25 (An Act to Modernize Legislative Provisions as Regards the Protection of Personal Information) is fully in force since September 2024. For HR, the most important provision is Section 12.1: when a decision about an individual is made exclusively through automated processing of personal information, the organization must inform the person before or when communicating the decision, provide the personal information used upon request, explain the principal factors behind the decision, and offer the person an opportunity to submit observations to a human who can review the outcome. The CAI has indicated that resume screening tools that automatically reject candidates, and AI systems that score interviews without human review, may trigger these obligations. Penalties reach up to $25 million or 4% of worldwide revenue.

What is Bill C-36 and when does it take effect?

Bill C-36 — the Protecting Privacy and Consumer Data Act (PPCDA) — was tabled in the House of Commons on June 15, 2026. It is the government’s third attempt to overhaul federal private sector privacy law and would replace PIPEDA with a significantly stronger framework. Key HR implications include: mandatory privacy management programs, data minimization obligations, a right to deletion, transparency requirements for automated decision-making, cross-border data transfer risk assessments, and fines up to $25 million or 5% of global revenue. Bill C-36 received first reading on June 15 and must still complete the full legislative process before becoming law — a realistic timeline of 12–24 months from first reading. PIPEDA remains in force in the interim.

What happened to Bill C-27 and Canada’s AI legislation (AIDA)?

Bill C-27, which included both the Consumer Privacy Protection Act (CPPA) and the Artificial Intelligence and Data Act (AIDA) as its core components, died when the federal government prorogued Parliament in January 2025. AIDA would have been Canada’s first national AI-specific legislation, regulating high-impact AI systems including those used in employment decisions. Its collapse left Canada without a federal AI regulatory framework. Bill C-36 (PPCDA), tabled in June 2026, addresses the privacy side of that gap but does not include a standalone AI regulatory framework equivalent to what AIDA proposed. Observers expect that a successor to AIDA may be introduced in a future session of Parliament.

Can an employee or candidate request an explanation of an AI hiring decision?

In Quebec, yes — explicitly, under Law 25 Section 12.1. If a decision was made exclusively by automated processing, candidates can request the personal information used, the principal factors behind the decision, and human review. Under PIPEDA, individuals already have a right to access their personal information held by organizations, which may extend to data used in automated decisions. Under the incoming PPCDA, transparency requirements for automated decision-making in significant employment contexts would apply nationally. Employers who cannot explain how an AI-influenced decision was made — or what data drove it — are increasingly exposed to both regulatory and human rights liability.

Human Judgment, Always in the Loop

At Groom & Associates, every search is led by a senior consultant who applies human judgment, contextual knowledge, and genuine accountability to every hiring recommendation. We use technology to enhance — not replace — the judgment that makes the difference between a good hire and the right hire. In a world where algorithmic bias and opaque AI decisions are becoming live legal and ethical risks, we offer employers something increasingly valuable: a hiring process where someone is always responsible.

Our services: Executive Search & Headhunting | IT & Technology Recruitment

Sources & References

1. Government of Canada: Bill C-36 / PPCDA — Backgrounder (June 15, 2026)
2. Government of Canada: Tables Legislation to Protect Canadians’ Privacy in the Digital Age (June 15, 2026)
3. McCarthy Tétrault: Bill C-36 — What Organizations Need to Know About Canada’s New Privacy Reform
4. Lawson Lundell: Canada Rewriting the Privacy Rule Book — Bill C-36 Guide
5. BetaKit: With Update to Canada’s Privacy Laws, Feds Are Building a ‘Super-Regulator’
6. HRD Canada: Federal Privacy Bill Targets Employee Data and AI Hiring, With Fines Up to 5% of Revenue
7. ClearBreach: Bill C-36 — Canada’s New Privacy Law for Small Businesses
8. IAPP: Canada’s Bill C-36 Introduces Privacy Reforms and Enforcement Changes
9. Global Relay: AIDA AI Risk Management in Canada — Patchworking While the Act Is on Pause
10. Torys LLP: Can HR Use AI to Recruit, Manage, and Evaluate Employees?
11. Boughton Law: Navigating AI in Recruitment — Legal Considerations for Canadian Employers (2025)
12. Canadian Labour and Employment Law: AI in Hiring — Legal Considerations (2025)
13. Ogletree: AI in Job Postings — What Employers in Canada Need to Know
14. IQ Partners: Canada’s Hiring Shake-Up — AI Screening, Job Postings, Pay Transparency (Ontario Bill 149)
15. VidCruiter: Quebec’s Law 25 and AI in Hiring
16. CallSphere: Quebec Law 25 — AI Automated Decisions and 2026 CAI Guidance
17. Augure AI: Law 25 AI Compliance Guide for Quebec Businesses
18. AI Governance Canada: Quebec Law 25 — AI and Automated Decision Requirements
19. Employsome: AI Laws for HR 2026 — Complete Global Compliance Guide
20. Wolseley Law: Navigating AI Laws in Canada — What Businesses Need to Know (2025)