Key definitions

Personal information (PI)

Any information about a natural person that allows that person to be identified (s. 2). A name, an email, an IP address tied to an account, a student number, a product usage history: all are PI as soon as they can be linked to someone.

Example. A SaaS log contains jean@client.ca exported 240 rows. That is PI, even if it is "just" a log.

Sensitive information

PI is sensitive when it gives rise to a high reasonable expectation of privacy, because of its nature (medical, biometric, financial, intimate, etc.) or the context of its use (s. 12). Consequence: consent must be express, and protections are stronger.

Example (school). A student's file (learning difficulties, health, behaviour) is sensitive.

De-identification (pseudonymization)

Information is de-identified when it no longer allows the person to be directly identified, for example when a name is replaced by an identifier. It remains PI: a key or a cross-reference can re-identify it.

Anonymization

Information is anonymized when it is irreversibly impossible to identify the person, directly or indirectly. It may then only be used for serious and legitimate purposes, following the anonymization regulation (s. 23 and Anonymization Regulation). A dataset that is merely "masked" is not necessarily anonymized.

Detailed legal framework: see the reference guide — Key concepts of Law 25.