Short answer first: a recording of your lecture, the transcript made from it and the notes generated off that transcript are all personal information, and Canadian privacy law gives you four things over them that matter in practice. You can see what an organization holds about you, you can challenge it and have it corrected, you can withdraw consent, and you can complain to a commissioner who investigates. Under the federal law a business has 30 calendar days to answer an access request and may not charge you more than a minimal fee.
The part most students get wrong is not the rights. It is which law applies, because Canada has a federal privacy act, three provincial acts that replace it, a separate set of public-sector acts for universities, and one province, Quebec, whose Law 25 changes have been coming into force since September 2023 and now put it closer to Europe than to Ottawa. The other thing students get wrong is what "stored in Canada" means when they read it in a privacy policy.
Whose data is in a lecture recording?
Usually three sets of people in one file. You, through your account and how you use the tool. The instructor, whose voice and material fill most of the hour. Your classmates, if anyone asked a question from the floor.
PIPEDA defines personal information as "information about an identifiable individual", and the Privacy Commissioner's interpretation bulletin makes clear that a voice qualifies. It lists employee voices as personal information, says "A voiceprint is personal information even though it may not necessarily tell much about an individual", and adds that "Information need not be recorded for it to constitute personal information", giving oral conversations as an example. A recording of a class is personal information about everyone on it.
Record for your own study and keep the file to yourself, and the federal law leaves you alone. Section 4 of PIPEDA says the Act does not apply to "any individual in respect of personal information that the individual collects, uses or discloses for personal or domestic purposes and does not collect, use or disclose for any other purpose." The Commissioner's plain-language summary gives "a personal greeting card list" as the example of what that covers.
Read the words "any other purpose". A recording of an instructor and forty classmates posted to a course group chat is hard to describe as personal or domestic. So the rule you can act on is simple. Your own device, yes. Anyone else's, no. Your university's rules on recording are stricter than the privacy law in any case, and we go through them in can you record lectures at Canadian universities.
Which law applies to the app you upload to?
It depends on where the company is and where you are, which is the part that makes Canada different from the UK or the EU.
| Where | Private-sector law | Regulator | Access clock |
|---|---|---|---|
| Federal default, and every province without its own act | PIPEDA | Office of the Privacy Commissioner of Canada | 30 calendar days, extendable by up to 30 |
| Quebec | Act respecting the protection of personal information in the private sector, as amended by Law 25 | Commission d'accès à l'information du Québec | Set by the Act; public bodies answer in 20 days |
| Alberta | Personal Information Protection Act | Office of the Information and Privacy Commissioner of Alberta | 45 days |
| British Columbia | Personal Information Protection Act | Office of the Information and Privacy Commissioner for British Columbia | 30 business days |
The Commissioner's page on provincial laws that may apply instead of PIPEDA explains the split. Alberta's and BC's Personal Information Protection Acts and Quebec's private-sector act have been deemed substantially similar to PIPEDA, so an organization subject to one of them is "generally exempt from PIPEDA with respect to the collection, use, or disclosure of personal information that occurs within that province." PIPEDA still applies to federally regulated businesses everywhere, and, the part that matters for a study app, to "transactions involving personal information transferred across borders." A note-taking app based abroad that serves a student in Montreal or Vancouver is therefore usually answering to both the federal Commissioner and the provincial one.
The PIPEDA summary also lists the ten fair information principles the Act is built on: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance. Four of them are the rights below.
Which rights are worth knowing?
Four, and the Commissioner's guide for the public is the place to start.
- Access. "PIPEDA gives people a general right to access their personal information held by businesses subject to this law." You are also entitled to know how it has been used and to whom it has been disclosed. Under Principle 9, the organization must "Respond to the request as quickly as possible, and no later than 30 days", at "minimal or no cost", and explain any acronyms so the information is understandable.
- Correction. Principle 9 again: individuals "have the right to challenge the accuracy and completeness of the information, and have that information amended as appropriate." Where you and the organization disagree, the Commissioner's guide says "you have the right to have your concerns recorded", and Principle 9 requires the organization to pass amended information to third parties that had access to it where appropriate.
- Withdrawal of consent. Principle 3: "Individuals can withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice, and you must inform individuals of the implications of withdrawal." For a note-taking app, the implication is usually that the account and its contents go. That is the closest thing PIPEDA has to a right to erasure, and it is worth knowing that the federal law does not contain a general deletion right of the European kind.
- Complaint. "If you feel that the organization is withholding more information than it should, you have a right to file a complaint with us." What happens next is in the section on being ignored.
Quebec adds rights the federal law lacks. The Commission d'accès à l'information's page on the main changes brought by Law 25 says that since 22 September 2024, at the person's request, organizations must communicate to them "dans un format technologique structuré et couramment utilisé" any computerized personal information collected from them, which is a portability right. Since September 2023 a person can ask a business "de cesser de diffuser leurs renseignements personnels ou de désindexer tout hyperlien rattaché à leur nom" where the dissemination causes them harm. And at collection the organization must tell you the purposes and the means of collection and your rights.
Name the right when you write. A request that says "access request under PIPEDA Principle 9" is harder to lose than one that says "can I have my stuff".
How long do they have, and what does it cost?
Under PIPEDA, 30 calendar days. The Commissioner's guide says "The organization is supposed to give you access to your personal information within 30 calendar days", and "It should cost you little or nothing to access your personal information. The law requires an organization to respond to your request at minimal or no cost to you." The deadline can be extended by up to 30 more days where meeting it "would unreasonably interfere with the activities of the organization" or where consultations make it impractical, and the organization has to tell you within the first 30 days that it is extending.
The provinces run different clocks. Alberta's government guide says organizations under PIPA must respond within 45 days "unless they appropriately extend the time", may charge a fee for access but not for a correction, and must correct your information "as soon as reasonably possible, and notify any other organization(s) to which they may have previously disclosed it." BC's Information and Privacy Commissioner says a private organization has "30 business days in which to respond", with extensions permitted in some cases, and that you can ask the Commissioner's office for a review of the result.
Keep the clock on your side
- Send the request by email so the date of receipt is not in doubt. Every regulator here says the request must be in writing.
- Say which law and which right you are relying on, and which data you mean: the audio, the transcripts, the notes, the flashcards, the account logs.
- Diary the deadline. Thirty calendar days for PIPEDA, 45 for Alberta, 30 business days for BC.
- If nothing arrives, reply on the same thread and ask them to confirm when they received it.
How do you make an access request in practice?
The Commissioner's guide says "You need to put your request to the organization in writing", and lists what to include. Follow the list, because a vague request invites a request for clarification, which slows everything down.
- Your full name, including any former name the organization may hold.
- Your address, so they can match you to an account.
- Your account number or the email you signed up with.
- A detailed description of the personal information you want. For a note-taking app: the audio files, the transcripts, the generated notes and flashcards, and any usage or account logs. Ask as well how the information has been used and to whom it has been disclosed, because Principle 9 entitles you to both, and ask which countries it has been processed in.
Send it to the privacy contact in the privacy policy. Openness is one of PIPEDA's ten principles, so a policy with no contact at all is already an answer about the company. An export button and a delete button inside the product are the same rights without the email, and worth more than any paragraph in a policy.
What does "stored in Canada" mean in a privacy policy?
Where your files are stored and where they are processed are two different questions. A tool can keep your recordings and notes on servers in Canada or the EU and still send the audio to a speech-to-text provider in the United States, because many of the strongest ones are there. Both sentences can be true at once. "Your data is stored in Canada" is not a promise that your audio never leaves it.
The Commissioner's guidelines for processing personal data across borders set out how PIPEDA treats that. Three points.
- Accountability. "An organization is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing." The Canadian business cannot point at its American supplier.
- Comparable protection. The organization must use "contractual or other means to provide a comparable level of protection while the information is being processed by the third party." That is the Canadian version of the standard contractual clauses you see in European policies.
- Transparency. The organization must "make it plain" to you that your information may be processed in a foreign country and "may be accessible to law enforcement and national security authorities of that jurisdiction", in "clear and understandable" language, ideally "at the time the information is collected."
What the guidelines do not require is your separate consent. A transfer to a processor "is a use" of the information rather than a disclosure, and where it is used for the purpose it was collected for, "additional consent for the transfer is not required." So a Canadian policy that says your audio goes to a US processor is not confessing to a breach. It is doing what the guidelines ask. A policy that says nothing about transfers at all is the one to worry about.
Quebec is stricter, and it is the province a student should read as if it were a different country. The Commission's Law 25 page says that since September 2023, "Avant de communiquer un renseignement personnel à l'extérieur du Québec, une organisation doit procéder à une évaluation des facteurs relatifs à la vie privée", a privacy impact assessment, before any personal information is communicated outside Quebec. The organization also has to tell you at collection that the information may leave the province. A note-taking app with users in Montreal is expected to have done that assessment for its US speech-to-text provider before your first upload.
The Commissioner's page on provincial laws, above, notes that PIPEDA continues to apply to cross-border transfers regardless of which province you are in. The practical upshot is the same everywhere: do not ask whether a tool is Canadian. Ask where the audio goes, and see whether the policy will tell you.
What to check before you upload a term of lectures
The cross-border guidelines and Principle 9 between them tell you what a privacy policy should already say. Read it for these.
- Who the organization is. A company name and an address, not just a product name, and a named privacy contact.
- Third parties, including processors. The good version is a named list, including the speech-to-text and AI providers, because those are the companies that actually hear the audio.
- Where it goes. Which countries, and the statement that data there may be subject to that country's laws. A policy that says "we comply with PIPEDA" and nothing about transfers has skipped the question the Commissioner told it to answer.
- How long they keep it. Limiting retention is one of the ten principles. Better if the period is in the policy already.
- Training. Does the policy say, provider by provider, whether your recordings and notes are used to train models? "We never train on your data" is an easy sentence to write and a hard one to keep, because the audio passes through companies the tool does not own. A policy that names each provider and says what each is contractually allowed to do is the more honest document.
- Your rights and where to complain. Access, correction, withdrawal, and the name of the commissioner.
If you are still choosing a tool, we compared the main options on exactly these points in the best note-taking app for Canadian students.
What does your university hold about you?
More than any app does, and under a different law. The federal Commissioner's summary says "Municipalities, universities, schools, and hospitals are generally covered by provincial laws." The Office's list of provincial and territorial laws names them: the Freedom of Information and Protection of Privacy Act in Ontario, overseen by the Information and Privacy Commissioner of Ontario; an act of the same name in BC, overseen by its Information and Privacy Commissioner; the Act respecting Access to documents held by public bodies and the Protection of personal information in Quebec, overseen by the Commission d'accès à l'information; the Protection of Privacy Act in Alberta; and the Freedom of Information and Protection of Privacy Act in Nova Scotia.
Your file at the university includes your marks, attendance, fee records, your accommodation plan if you have one, and every lecture capture recording in which your voice was picked up. The universities say so themselves. The University of Ottawa's recording guidelines say the university "must collect, use, maintain, disclose and dispose of personal information in a manner consistent with" FIPPA and keep class recordings "for one year from the date the final grade is official." Waterloo says its recordings "are subject to the Freedom of Information and Protection of Privacy Act (FIPPA)". What Canadian lecture capture records goes through the systems campus by campus.
Asking your university
The Ontario government's freedom of information page says FIPPA covers "Ontario government ministries, agencies, community colleges and universities", that "There is a mandatory $5 application fee for each FOI request", that there is "no application fee for a request to make a correction to your own personal information", and that you can appeal to the Information and Privacy Commissioner, with a ten dollar fee for a personal information appeal. The clock changed this summer: "Starting July 1, 2026, the time to respond to FOI access requests changes from 30 calendar days to 45 business days." In BC, the Commissioner's office says public bodies have "30 business days in which to respond" and you may ask it to review the result. In Quebec, the government's access page says public bodies have "a maximum of 20 days to answer a request", with a possible 10-day extension, that you may correct personal information that is "incomplete, inaccurate or equivocal", and that if refused or ignored you have "30 days to request a review by the Commission d'accès à l'information."
Where the university may keep it
Two provinces restrict where public bodies may store personal information, which is why a university in Vancouver or Halifax will ask harder questions of a cloud vendor than one in Toronto. BC's FOIPPA policy manual quotes section 33.1: "A public body may disclose personal information outside of Canada only if the disclosure is in accordance with the regulations, if any, made by the minister responsible for this Act." The regulation, in force since November 2021, requires the head of a public body to make an assessment of each program or system "in which personal information that is sensitive is disclosed to be stored outside of Canada." UBC's Learning Spaces page still advertises that its Panopto recordings are "stored on UBC's Panopto server located in Canada" and that "data is never stored outside of Canada."
Nova Scotia's Personal Information International Disclosure Protection Act requires public bodies, a category that expressly includes universities, to ensure personal information "remains in Canada, is accessed, and is disclosed only in Canada, unless certain circumstances exist." Dalhousie's privacy policy, approved on 9 December 2022, says "Disclosures of personal information outside of Canada, including storage and access, must be done in compliance with" that Act. The province has since adopted a new Freedom of Information and Protection of Privacy Act, Bill 150, which privacy lawyer David Fraser describes as one that "revokes and replaces" the standalone statute, allows storage or access outside Canada only "in accordance with specific regulations", and "will come into effect in April of 2027". A Nova Scotia student should expect the wording to change and the principle to survive.
None of that binds the app on your phone. It binds the university, and it is the reason a Canadian institution's own lecture capture is a safer place for a recording of your classmates than an outside service is.
What if they ignore you?
Chase in writing first. The federal Commissioner's report a concern page says: "Always try to resolve the issue with the organization you had a problem with before reporting a concern to the OPC or other privacy-related government organizations." Keep the correspondence.
Then file. The Office's guide to the complaint process explains what happens: investigators "Clarify the complaint to clearly identify the issues for investigation", "Gather evidence relevant to the investigation, from the parties as well as third-parties", and issue findings and recommendations. The Commissioner "cannot impose fines for contraventions", and has a year to issue findings, but can enter "a Compliance Agreement, enforceable by the Federal Court", and "the Federal Court has the power to award damages to a complainant." If the organization is provincially regulated in Alberta, BC or Quebec, the provincial commissioner is the right door. Alberta's guide says you "may make a complaint to the Office of the Information and Privacy Commissioner (OIPC)", BC's Commissioner offers a review, and the Commission d'accès à l'information publishes its request forms in English. A missed 30-day deadline is a well-trodden path, and you are not being awkward by walking it.
Where Notibo fits
Notibo is an example of the storage and processing split rather than an exception to it. Your recordings, notes and flashcards are stored in the EU on Supabase in Frankfurt. The audio is transcribed by speech-to-text providers in the United States, and the AI notes are also produced on US processors, under standard contractual clauses. That is a transfer of the kind the Commissioner's guidelines describe, and it is disclosed for that reason. Uploads are capped at 50 MB, long recordings are split into 30-minute files on the phone and joined back into one transcript, and the free plan covers 30 minutes of recording a month. Our privacy policy names each provider, so you can run it through the checklist above the same way you would run any other tool through it.