"Is encryption legally required?" is one of the most common questions Canadian SMB owners ask when a client contract, an insurance application, or a privacy consultant first raises the topic — and the honest answer is more nuanced than a simple yes or no. Neither PIPEDA (the federal Personal Information Protection and Electronic Documents Act) nor Quebec's Law 25 (the Act respecting the protection of personal information in the private sector) uses the word "encryption" as a blanket, technology-specific mandate. Both statutes instead require businesses to maintain security safeguards that are "reasonable" or "appropriate to the sensitivity" of the personal information involved — deliberately technology-neutral language written to age well as tools change.
In practice, though, that technology-neutral language has a very concrete effect: for a growing list of situations, encryption has become the default expectation that "reasonable safeguards" is interpreted to mean, even without the word appearing in the statute. A business that skips it isn't automatically breaking a specific written rule, but it is taking on a much harder position to defend if something goes wrong — to a regulator, to a court in a private lawsuit, and increasingly to a cyber insurer deciding whether to pay a claim.
This guide walks through exactly where that line sits: what "reasonable safeguards" actually means in relation to encryption under Canadian and Quebec privacy law, the specific situations that push a business from "nice to have" to "you should really have this," the practical difference between encryption at rest, in transit, and end-to-end, the genuinely useful effect encryption can have on your breach notification obligations, and a concrete cost breakdown so you know what closing the gap actually costs — not vague enterprise pricing, real Canadian small-business numbers.
Who wrote this guide, and an important caveat
This article was written and reviewed by IT Cares certified technicians who regularly translate exactly this kind of legal-adjacent security question into concrete, actionable technical steps for Canadian SMBs. We are not a law firm and this is not legal advice — where the stakes are high (an active breach, a specific contract clause, or a regulatory inquiry), talk to privacy counsel. What we can tell you with confidence is what "reasonable" tends to look like in practice, and exactly what it costs to get there.
What "Reasonable Safeguards" Actually Means for Encryption
Both PIPEDA and Law 25 build their security obligations around a proportionality principle rather than a fixed checklist. PIPEDA's Principle 4.7 requires safeguards "appropriate to the sensitivity of the information," specifically naming physical, organizational, and technological measures, and gives encryption as an example of a technological measure without mandating it in every case. Law 25 uses similarly proportional language, requiring measures "appropriate to the sensitivity of the information, the purposes for which it is used, the quantity and distribution of the information, and its medium."
What this means practically is that the encryption bar moves depending on three things: how sensitive the data is, how exposed it is (a laptop that leaves the building is more exposed than a server locked in a data centre), and how much of it there is. A single business card scanned into a CRM is very different from a spreadsheet of 4,000 clients' Social Insurance Numbers and banking details. Regulators, and any court assessing whether "reasonable" safeguards were in place after a breach, weigh exactly this kind of proportionality — which is why a blanket "yes, always encrypt everything" answer is technically imprecise, even though it's rarely bad advice in practice for a small business without the resources to build a more nuanced, risk-tiered program.
The Commission d'accès à l'information (CAI), which enforces Law 25 in Quebec, and the Office of the Privacy Commissioner of Canada (OPC), which enforces PIPEDA federally, have both published investigation findings and guidance over the years that treat unencrypted sensitive data — particularly on lost or stolen portable devices — as a strong indicator that safeguards were not appropriate to the risk. This isn't a formal "encryption is mandatory" ruling, but it functions almost the same way in practice: if a laptop with unencrypted client health records is stolen from a car, "we didn't think we needed to encrypt it" is a very difficult position to defend after the fact.
📊 IT Cares field note: The clients who ask us about encryption compliance almost never ask before something happens — it's usually after a laptop goes missing, after a cyber insurance renewal form gets specific about it, or after a bigger client's procurement team sends a security questionnaire. The technical fix in most of those cases takes a day or two. The part that actually costs money and stress is the incident, contract renegotiation, or insurance gap that triggered the question in the first place.
Want a straight answer on what your business actually needs encrypted?
Our certified technicians map your data and devices and give you a prioritized, right-sized action list — from $119.99.
Encryption at Rest vs. In Transit vs. End-to-End: What They Actually Protect
"Encryption" gets used as a single word for several genuinely different protections, and knowing which one you need where is the difference between spending money effectively and buying the wrong tool for the job.
Encryption at rest protects data while it's sitting still — on a laptop's hard drive, a server, a USB stick, or in cloud storage. If a laptop is stolen and its disk is encrypted, the thief gets a locked box, not readable client files. This is the single highest-impact category for most SMBs, because lost and stolen devices remain one of the most common real-world breach scenarios, and it's also the cheapest to implement, since it's usually already built into your operating system for free.
Encryption in transit protects data while it's moving — between a browser and a website (that's what the padlock/HTTPS means), between an email client and a mail server, or between an app and its cloud backend. Almost all modern business software handles this automatically today; the main risk area is custom or legacy systems that haven't been updated to enforce it, or Wi-Fi networks (especially public ones) where an unencrypted connection could be intercepted.
End-to-end encryption is the strictest category: it means only the sender and the intended recipient can read the content, not even the platform carrying it in between. This matters most for highly sensitive communications — health records, legal documents, financial statements sent to an external party — where you specifically don't want even the email provider or messaging platform to be able to access the content. It's the least commonly needed of the three for typical SMB operations, but the most important where it does apply.
| Type | What It Protects | When It's Expected | Common Tools | Typical SMB Cost |
|---|---|---|---|---|
| At rest | Data stored on a device, server, or in the cloud | Any laptop or portable device holding client/employee personal data; databases with sensitive fields | BitLocker, FileVault, VeraCrypt, cloud provider default encryption | Free (OS built-in) to $8-20/user/month for managed enterprise tools |
| In transit | Data moving between systems or over a network | Any web form, email, or app transmitting personal or payment data; virtually always expected today | TLS/HTTPS, VPN, secure email gateways | Usually free/built-in; VPN $5-12/user/month if needed |
| End-to-end | Content readable only by sender and recipient, not the platform itself | Highly sensitive external communications: health, legal, financial documents to third parties | Encrypted email add-ons, secure file-share links, signal-protocol messaging | $5-15/user/month for dedicated tools, or per-document secure share services |
The Practical Trigger Points: When Encryption Stops Being Optional
Rather than a single legal rule, think of encryption necessity as a set of triggers that each independently raise the bar. If any of these apply to your business, treat encryption as close to non-negotiable rather than a future nice-to-have:
- You store Social Insurance Numbers, health information, or financial account details. This is the clearest category where "sensitivity of the information" pushes hard toward encryption being part of reasonable safeguards — these are exactly the data types regulators, courts, and insurers scrutinize hardest after a breach.
- Data leaves the building on a laptop, phone, or USB drive. Portable devices are lost and stolen constantly, and it's one of the few breach scenarios almost entirely preventable with a single setting change (full-disk encryption) that most businesses simply never turn on.
- You transfer data across borders — to a U.S.-based SaaS vendor, an offshore contractor, or a parent company abroad. Cross-border transfers raise the sensitivity bar under both PIPEDA and Law 25's accountability principles, and encryption in transit plus strong access controls at the destination becomes part of demonstrating adequate protection.
- You handle a large volume of records, not just a handful. Both statutes explicitly weigh "quantity" — a breach of 4,000 client records is treated more seriously than a breach of 4, which means the safeguards expected scale up with your database size, not just the sensitivity of any single record.
- A client contract, vendor agreement, or cyber insurance application specifically asks about it. Even where the law itself stays general, a signed contract or insurance application that says "yes, encrypted" creates a specific, enforceable commitment — and answering "yes" when it isn't actually true is a much bigger legal and financial risk than the underlying gap itself.
The single most common gap we find
In IT Cares assessments, the most frequent finding isn't "no encryption anywhere" — it's partial encryption that the business believed was complete. A company laptop gets BitLocker enabled during setup, but three replacement laptops bought later during a hiring push never get the same treatment. Cloud storage is encrypted at the provider level, but local synced copies on unencrypted personal laptops aren't. Treat encryption as an ongoing process tied to device provisioning, not a one-time project you check off and forget.
The Breach Notification Angle: How Encryption Can Change Your Legal Exposure
This is where encryption has a genuinely concrete, quantifiable legal benefit beyond the general "reasonable safeguards" argument. Both PIPEDA and Law 25 base the mandatory breach notification duty on whether the incident creates a "real risk of significant harm" (PIPEDA's language) or a comparable risk standard under Law 25. If personal information is stolen but was strongly encrypted, and — critically — the encryption keys were not also compromised in the same incident, a business can often reasonably conclude the risk of significant harm is low or absent, because the data itself remains unreadable to whoever took it.
This is sometimes informally called a "safe harbor" effect, though neither statute uses that exact term or grants a blanket, automatic exemption. What it actually does is give you strong, defensible grounds to conclude notification isn't required — a materially better position than facing that same analysis with plaintext data, where the risk of harm is almost impossible to argue is low. Practically, this means:
- If an encrypted laptop is stolen and the recovery key wasn't stored on a sticky note taped to it (yes, this happens), you likely do not need to notify affected individuals or the regulator, because the thief cannot read the data.
- If the same laptop was unencrypted, you almost certainly do need to notify — which means direct notification costs, regulatory scrutiny, reputational impact, and potentially the private lawsuits Law 25 specifically enables.
- The benefit only holds if key management is also solid — an encrypted drive with the recovery key stored in the same stolen bag, or a weak/reused encryption password, doesn't get you the same protection.
This nuance is important enough that it's worth repeating: encryption reduces risk and gives you a strong factual basis to conclude notification isn't required — it is not an automatic legal exemption, and the specific facts of any real incident should be assessed with legal counsel before deciding not to notify. But as a risk-reduction investment, few controls offer this direct a return relative to their cost.
Free and Low-Cost Tools vs. Paid Enterprise Suites
One of the most persistent myths that keeps SMBs from encrypting is the assumption that it requires expensive enterprise software. For the large majority of small businesses, that's simply not true.
Free, built-in options
BitLocker is included with Windows 10/11 Pro, Enterprise, and Education editions at no extra cost — it just needs to be turned on, with the recovery key saved somewhere safe (ideally your Microsoft 365 admin account or a password manager, never a sticky note or an unlabeled USB drive). FileVault is the macOS equivalent, built into every Mac since OS X Lion, similarly free and just needs enabling. For businesses running Windows Home editions, which don't include BitLocker, the free open-source tool VeraCrypt provides comparable full-disk and container-level encryption at no licensing cost, though it requires more manual setup and doesn't integrate with centralized management the way BitLocker does with Microsoft 365/Intune.
Paid, managed options
Where paid tools earn their cost is centralized management: being able to see, from a single dashboard, that every company device is actually encrypted, remotely retrieve recovery keys, and enforce the policy on new devices automatically rather than relying on someone remembering to enable it manually. Microsoft 365 Business Premium bundles this kind of centralized BitLocker management through Intune at no extra software cost beyond the subscription tier you may already have. Dedicated enterprise encryption and data-loss-prevention (DLP) suites, which add features like automatic classification of sensitive files and encryption enforcement based on content, typically run $8-20 per user per month and are usually only worth it once a business has 25+ employees or handles data sensitive enough to need automated classification rather than manual policy.
Canadian Case Studies: What This Looks Like in Practice
Case Study 1: The Halifax Dental Clinic — What an Unencrypted Laptop Actually Costs
A four-chair dental practice in Halifax, Nova Scotia, had a front-desk laptop stolen from a staff member's car during a break-in — the laptop contained a local, unencrypted backup of patient scheduling and treatment records for roughly 1,800 patients, synced there for a front-desk workflow nobody had reviewed in years. Because the drive was unencrypted, the practice's privacy counsel concluded there was a real risk of significant harm and mandatory notification under PIPEDA (health information intersects with both provincial health privacy law and PIPEDA for a private clinic) was required. The clinic's actual costs: a specialized privacy law consultation (~$3,200), a notification mailing and call centre setup for affected patients (~$6,500), a required report to the applicable privacy regulator, and an estimated 60+ staff hours managing patient concerns and follow-up over six weeks. Total direct cost: roughly $11,000, not counting the reputational impact of a small, name-known local practice having to send a breach letter to nearly two thousand patients. The fix that would have prevented all of it — enabling BitLocker on that one laptop — would have taken about 20 minutes.
Case Study 2: The Laval Accounting Firm — How Encryption Turned a Phishing Incident Into a Non-Event
A 12-person accounting firm in Laval, Quebec, serving mostly small business and individual tax clients, had rolled out full-disk encryption on all staff laptops and encrypted cloud backups roughly eight months before a staff member fell for a convincing phishing email that resulted in a compromised email account. The attacker gained access to the mailbox but could not access the firm's client file server, which required separate multi-factor authentication and sat on an encrypted, access-controlled share the phished account didn't have rights to. Because the compromised system was limited to email — and the firm could demonstrate the client data itself remained on properly encrypted, access-segmented storage the attacker never reached — their privacy counsel and cyber insurer both concluded the incident did not trigger mandatory Law 25 notification for the broader client base, only a smaller, targeted notice to a handful of individuals whose information appeared directly in the compromised mailbox. The firm's total incident cost, including a forensic review to confirm scope (~$4,500) and account remediation, came to about $6,000 — a fraction of what a full client-base breach notification would have cost, directly because the encryption and access segmentation limited the blast radius.
Case Study 3: The Calgary E-Commerce Retailer — Encrypting Ahead of a PCI-DSS Review
A mid-sized home goods e-commerce retailer in Calgary, Alberta, processing roughly $2.8 million in annual online sales, was preparing for their first formal PCI-DSS Self-Assessment Questionnaire (SAQ D, since they ran a partially self-hosted checkout) and discovered during the process that customer order data, including partial payment metadata, was stored unencrypted in an older order-management database that predated their current systems. They engaged a contractor to implement database-level encryption for sensitive fields and migrate to a properly encrypted backup solution ahead of their PCI review deadline. The project took five weeks and cost approximately $7,200 in contractor fees plus internal project management time, and directly resolved what would otherwise have been a PCI compliance failure that could have jeopardized their ability to keep processing card payments through their acquiring bank.
📊 IT Cares field note: Notice the pattern across all three cases: the businesses that had encryption already in place before an incident spent a few thousand dollars and moved on with minimal disruption. The one that didn't spent roughly double, plus weeks of staff time and a hit to client trust. Encryption is one of the rare security controls where the "insurance value" of having it in place before something happens is almost impossible to overstate.
Encryption Readiness Checklist
Use this checklist to map where your business currently stands. Work through it device by device and system by system rather than assuming "we're covered" based on one or two things you remember configuring.
Encryption Readiness Checklist
- ☐ Full-disk encryption (BitLocker/FileVault/VeraCrypt) enabled on every company laptop and desktop that touches client or employee data
- ☐ Recovery keys stored securely and centrally (Microsoft 365 admin, password manager) — not on the device, not on paper attached to the device
- ☐ Encryption in transit (HTTPS/TLS) enforced on every customer-facing web form and login page
- ☐ Cloud storage and file-sync services confirmed to encrypt data at rest by default (most major providers do — verify, don't assume)
- ☐ Backups — local and cloud — encrypted, not just the primary working copies
- ☐ USB drives and portable media either encrypted or, better, phased out in favour of secure cloud transfer
- ☐ Company-issued mobile phones have device encryption and passcode/biometric lock enabled (on by default on most modern phones, but verify for older devices)
- ☐ Database fields holding SIN, health, or financial data specifically reviewed for field-level or database-level encryption, not just relying on general server encryption
- ☐ Vendor and processor contracts reviewed for encryption commitments matching what you're actually promising your own clients
- ☐ New device provisioning process includes encryption as a mandatory step, not a manual afterthought
- ☐ Encrypted, end-to-end tools available for staff who regularly send highly sensitive documents to external parties
Budget & Pricing: What Encryption Actually Costs a Canadian SMB
Real, concrete Canadian dollar figures rather than vague ranges — these numbers assume a typical small business in the 5-30 employee range:
- Built-in OS encryption (BitLocker/FileVault): Free in terms of software licensing (already included in Windows Pro/Enterprise and all Mac editions). Budget roughly $50-150 per device in one-time IT labour to enable it properly, verify it completed, and securely store the recovery key.
- VeraCrypt for Windows Home editions: Free software, but expect somewhat more setup time per device (~1-2 hours) since it lacks centralized management.
- Business password managers (needed to securely store recovery keys and encryption passphrases): roughly $3-8 per user per month.
- Centralized management via Microsoft 365 Business Premium/Intune: If you're not already on this tier, upgrading typically adds $10-15 per user per month over a lower tier, but bundles centralized encryption management with several other security features.
- Enterprise encryption/DLP suites: $8-20 per user per month, generally only cost-effective once you're past roughly 25 employees or handling data sensitive enough to justify automated classification.
- A professional, project-managed encryption rollout for a 15-20 person office (auditing current state, enabling encryption everywhere, setting up key management, documenting the result for compliance purposes): typically $1,500-$5,000 depending on how many devices and systems are involved.
- IT Cares security assessments that map exactly where your encryption gaps are start at $119.99 for a focused review.
Canadian Government and Regulatory Resources
These are legitimate, free resources to go deeper on the regulatory side:
- Office of the Privacy Commissioner of Canada (OPC) — priv.gc.ca publishes guidance on PIPEDA's safeguarding principle, including specific commentary on encryption and technological safeguards, plus a searchable database of past investigation findings that illustrate how "reasonable safeguards" has been interpreted in real cases.
- Commission d'accès à l'information (CAI) — cai.gouv.qc.ca is the Quebec regulator enforcing Law 25, publishing guidance documents specifically aimed at businesses working through their Law 25 obligations, including security safeguard expectations.
- Innovation, Science and Economic Development Canada (ISED) — ic.gc.ca hosts digital security resources and small business guidance connected to Canada's broader cybersecurity strategy.
- Business Development Bank of Canada (BDC) — bdc.ca offers cybersecurity advisory content and, in some cases, financing support for SMBs looking to invest in security infrastructure including encryption tooling.
Want to know exactly where your encryption gaps are?
IT Cares' security audits map your devices, data flows, and storage locations against what Law 25 and PIPEDA actually expect, and hand you a prioritized, concrete action list — not a generic checklist. If ongoing management makes sense for your business, our cybersecurity services can implement and maintain encryption across your fleet so it doesn't quietly drift out of date as devices get replaced.
Frequently Asked Questions
Ready to Know Exactly Where You Stand on Encryption?
IT Cares reviews your real devices, data, and storage locations and gives you a concrete, prioritized action plan — not a generic legal disclaimer.
Comments (3)
We assumed our cloud backup was "already encrypted" because the provider said so, but nobody had checked our synced local copies on staff laptops. This pushed us to actually verify instead of assuming.
The breach notification section finally explained why our lawyer kept asking whether the stolen laptop was encrypted before deciding if we had to notify anyone. Made a confusing conversation make sense.
Appreciated that this didn't just say "encrypt everything" without explaining the actual cost. The BitLocker vs VeraCrypt breakdown was exactly what I needed for our mixed Windows Home/Pro fleet.
Leave a Comment