Before uploading a lecture, check two things: whether you may send that material to the service, and what the service will do with it. A privacy policy can help with the second question. It cannot grant permission on behalf of your instructor or classmates.
Canadian privacy rights can help you inspect and challenge how an organization handles information about you. The correct process depends on whether you are dealing with a commercial app, your university or another organization. This guide explains where to start, without assuming that one federal rule covers every student file.
A recording can involve other people’s information
A file can contain names, identifiable voices, questions and personal disclosures. A transcript can preserve those details even after the audio is removed. That does not make every definition in your course notes personal information: what matters is whether information relates to an identifiable person.
Imagine a tutorial about workplace discrimination. The lecture explanation and a classmate’s account of their own employer are different kinds of material. Before using an AI tool, consider whether you need the discussion at all. Your own explanation of the concept may be enough for revision.
UBC’s classroom-recording guidance says students need explicit permission or a formal accommodation to make recordings. It also asks them to check before uploading a recording to an AI transcription, translation or summarization tool. Other institutions have their own procedures; see our guide to recording lectures in Canada.
An exemption for personal activity in privacy legislation is not a substitute for checking recording permissions, copyright and course rules. Nor can the number of people in a group chat, by itself, settle which law applies to sharing a file.
Work out whose process you need
| Organization holding the information | Where to start |
|---|---|
| Commercial study app | Its privacy contact and the regulator identified for the relevant activity |
| University | The university’s access-to-information or privacy office |
| Accessibility service | Its approved tools and arrangements for your accommodation |
| Placement or research organization | Its confidentiality and data-management requirements before any upload |
The federal Privacy Commissioner explains that PIPEDA applies to commercial activities, while substantially similar private-sector laws in Alberta, BC and Quebec may apply instead for activities within those provinces. PIPEDA can still apply to cross-border transactions and federally regulated businesses. More than one law can be relevant to different activities. The company’s location or your postcode alone does not resolve the question.
For a university record, use the institution’s provincial process. Do not send a federal private-sector template and assume its deadline applies. Start with the records you actually need: a correction to an address, access to accommodation information, or an explanation of how a classroom recording is used.
Ask for useful information, in writing
The federal Commissioner’s access guide explains written requests under PIPEDA. Access is normally due within 30 calendar days at little or no cost. Specified extensions are possible, and the organization must explain a delay within the initial period. You can also challenge factual inaccuracies and ask for correction.
For an app, a focused request might identify:
- The account email and a date range.
- The personal information you want, such as account records and information associated with specified uploads.
- An explanation of how that information was used and shared.
- Any factual error you want corrected, with supporting details.
Use the published privacy channel. Keep a copy of the request and its acknowledgement, including any reference number. If the organization needs identity verification, ask how to provide it securely; do not attach extra identity documents to a general support message without checking.
An export button may give you the notes you need immediately. It may not include account logs or explain how information was used, so it is not necessarily equivalent to an access request. Likewise, deleting a visible file does not tell you how long backups or legally required records remain.
University deadlines can differ
Ontario’s official access guide covers institutions including universities. For complete requests received on or after 1 July 2026, its standard response period is 45 business days, subject to permitted extensions. The application fee is $5; a request to correct your own personal information has no application fee. Other provinces have their own rules. Check your university’s current instructions rather than copying Ontario’s deadline elsewhere.
Withdrawing consent is not automatic deletion
Under PIPEDA’s consent principle, withdrawal is subject to legal or contractual restrictions and reasonable notice. The organization must explain its implications.
Be specific about the outcome you want. Are you stopping optional model training, ending a service, removing an uploaded recording or closing the entire account? These actions may have different consequences. Ask what will be deleted, what must be retained, and when the change takes effect. Save any study notes you need before requesting deletion.
Storage and processing are different questions
A service may store notes in one country and send audio to a transcription supplier in another. Look beyond the location printed on its homepage.
The Commissioner’s cross-border guidance explains PIPEDA’s approach: outsourcing does not remove the organization’s responsibility, comparable protection must be arranged, and people should be told about foreign processing and possible access under foreign law. For processing within the original purpose, the guidance does not generally require separate consent merely for the transfer. It expressly does not decide provincial public-sector requirements.
That is not a compliance certificate for any particular app. A contract also cannot override the law of the country where processing occurs. Ask about the actual service, purpose and material involved.
Quebec has additional requirements. The Commission d’accès à l’information explains that organizations subject to its rules must assess privacy factors before communicating personal information outside Quebec, establish adequate protection and enter a written agreement. Its Law 25 overview also describes portability for computerized personal information collected from the person. These are specific obligations and rights, not a promise that every file generated by an app is portable.
Read an app policy against your actual task
For a recording you are allowed to process, make a short comparison before creating a whole term’s collection:
| Question | Detail to look for |
|---|---|
| Who receives the file? | The service operator and relevant transcription or AI suppliers |
| Where does it go? | Storage locations and processing locations |
| What happens after transcription? | Raw-audio deletion, note retention and failed-upload handling |
| Is training involved? | Whether the service or its suppliers use the content for model training, and any choices |
| How do I leave? | Export options, deletion procedure and retained-data explanation |
For clinical, placement or research material, follow the organization’s approved arrangements. Removing a name may not remove enough context to prevent identification. If approval is unclear, work with a general explanation you have written yourself rather than uploading the original case.
Our Canadian note-app comparison covers study use. Your university’s lecture-capture system may already supply what you need, under its own access and retention rules.
If a request is ignored
Keep the correspondence and follow up with the organization’s privacy contact. The federal Commissioner’s complaint guidance asks you to raise the concern with the organization first. If it remains unresolved, use the appropriate federal or provincial complaint route. A missed deadline does not automatically establish the outcome of a complaint.
Where Notibo fits
Notibo stores its application data in the EU, in Frankfurt, while transcription and AI-note processing use US-based providers under standard contractual clauses. Successful transcription is followed by deletion of the raw audio; a failed job may retain audio temporarily for retry. Check the privacy policy for the current providers and retention details. These arrangements do not, by themselves, establish that a particular university permits the upload.
Where use is authorised, Notibo can turn a recording into editable transcripts and study notes. Audio uploads have a 50 MB limit. The free plan includes 30 audio minutes per month; the 14-day Pro trial includes 240 minutes in total and requires no card. Start with a short, permitted file, check the result against your source, and export the notes you need.