Canada software delivery: settle PIPEDA, Quebec's Law 25 and bilingual acceptance before the build

OutsourcingVN is operated by Netbase JSC, so this guide comes from a supplier that would like your project. It draws on a multi-tenant SaaS platform Netbase has helped build for a North American client and on Canada's official federal and Quebec privacy references for the questions your own advisers should answer. The guides index lists the guides for other markets.

Contents

• What makes a Canada-facing build different?
• What did Netbase build for a North American SaaS platform?
• How do PIPEDA and Quebec's Law 25 differ in practice?
• Which bilingual and accessibility decisions come before launch?
• Worked scenario: a customer requests their data under Law 25
• Which questions should you ask a supplier?
• What usually goes wrong?
• How this guide is sourced and where it stops
• Common questions
• Plan the first release

What makes a Canada-facing build different?

Three decisions shape a Canada-facing scope more than any single feature list, and each needs a named owner before development starts.

• Federal privacy baseline. The Personal Information Protection and Electronic Documents Act sets fair-information principles that most commercial products must follow, covering consent, purpose, access and safeguards.
• Quebec's own regime. A business operating in Quebec faces Law 25 on top of PIPEDA, with its own duties such as a named privacy officer, breach notification and a published privacy policy.
• Bilingual acceptance. Quebec's language expectations and national buyer demand push many products toward English and French from the first release, which touches layout, search and generated documents just as much as visible copy.

A buyer's legal advisers should confirm which of PIPEDA and Law 25 applies to a given product, since Quebec's regime layers extra duties on top of the federal baseline rather than replacing it, then set the accessibility and bilingual scope the first release actually needs.

What did Netbase build for a North American SaaS platform?

For a Canada-facing SaaS brief, the nearest registered evidence is a multi-tenant ERP platform: since 2020, Netbase has acted as offshore development and managing partner for a US software company that offers the product to small and mid-sized businesses. The registered first phase, running 2020 to 2023, targeted agency customers and added a shared multi-tenant foundation, CRM, real-time team messaging, HR tools, a knowledge base, configurable fields and workflows, project and work management, and integrations with outside services, on a stack of React, Next.js, Laravel, Strapi and four separate databases running on AWS. A later phase aimed at retail customers was still on the roadmap when the source document was written, and it is not counted as delivered here. The multi-tenant cloud ERP SaaS platform record has the full scope; neither the client nor the product is named.

How do PIPEDA and Quebec's Law 25 differ in practice?

Quebec's Law 25 does not replace PIPEDA; it adds obligations on top of it for any organisation operating there, so a Canada-facing product serving Quebec residents should plan for both sets of duties from the same privacy programme.

Worked scenario: a customer requests their data under Law 25

1. Request received. A Quebec customer emails asking for a copy of their personal information in a portable format.
2. Identity check. Support verifies the requester's identity through the account's existing verification method, not a new one invented for the request.
3. Data assembly. Engineering exports the account's structured personal information, excluding anything that belongs to other customers or cannot be attributed to one person.
4. Format decision. The export uses a structured, commonly used format rather than a screenshot or a support-ticket summary.
5. Response within the window. The privacy officer sends the export and a plain-language note on what it contains before the deadline the business has committed to internally.
6. Record kept. The request and response are logged, so a similar future request does not start from zero.

A proposal that cannot describe step 3, in particular how the export separates one customer's data from another's, has not yet scoped data portability.

Which questions should you ask a supplier?

• Have you built a bilingual English and French journey before, and can we see it? Ask for a specific screen, not a general claim.
• Who is the named privacy officer, and is their contact information published? It should be a real person at your organisation.
• How do you handle a data-portability request end to end? Look for identity verification, a structured export and a logged record.
• What counts as an automated decision in our product? A good answer names the specific feature and how a person can ask for an explanation.
• Who reports a breach to the Commission d'accès à l'information? It should be your organisation, with the supplier providing the technical facts.
• What is excluded from the first release? A good proposal lists a second language or a later feature as an exclusion.

What usually goes wrong?

• French added as an afterthought. Signal: layout and length problems appear only after English is finished. Owner: the product owner, testing bilingual copy from the first increment.
• Law 25 treated as PIPEDA with a French label. Signal: no named privacy officer, no separate consent flow. Owner: the compliance lead.
• Data-portability requests handled ad hoc. Signal: each request takes a different shape. Owner: engineering, with a repeatable export process.
• Accessibility tested only on a mockup. Signal: real screen-reader use surfaces problems after launch. Owner: the product owner, with testing on the built product.

How this guide is sourced and where it stops

This guide uses the Office of the Privacy Commissioner of Canada's own PIPEDA pages and the Commission d'accès à l'information's page on Law 25, both checked on 2026-09-29, and a Netbase delivery record approved in the OutsourcingVN claim register. It is written for product, operations and procurement leads preparing a brief. It does not decide whether Law 25 applies to your organisation; that stays with your advisers. Netbase JSC operates from a single office in Hanoi, Vietnam, and Canada-facing work is delivered remotely from there.

Plan the first release

Bring your PIPEDA and Law 25 scope, your bilingual release boundary, your named privacy officer and your accessibility testing plan. The total software delivery cost worksheet helps you compare proposals that include bilingual review and privacy work, and the methodology page explains how the claims on this page are recorded. Our guide to data security and compliance in outsourcing lists the contract questions that sit around a privacy programme. For other North American and European markets, the United States guide covers state privacy law and contract terms, and the UK guide covers UK data protection and IP assignment.

Custom Product Engineering is the service for a bounded build, and global delivery explains how remote delivery is organised. OutsourcingVN is Netbase's own outsourcing-services platform: submit a project with your privacy and bilingual requirements, and a person will reply with whether discovery or a bounded implementation is the right next step.

Related services and solutions