Private AI Demo: Cited Answers From Canadian Privacy Law

What does it read?

Eight public documents, downloaded on 12 November 2026 and cut into 367 passages of up to 1,200 characters. Amendments not yet in force were left out of PIPEDA.

Document	Publisher	Passages
Personal Information Protection and Electronic Documents Act (PIPEDA)	Justice Laws Website	124
Breach of Security Safeguards Regulations	Justice Laws Website	8
Act respecting the protection of personal information in the private sector (Quebec)	LégisQuébec	98
Guidelines for processing personal data across borders	Office of the Privacy Commissioner of Canada	18
Principles for responsible, trustworthy and privacy-protective generative AI technologies	Office of the Privacy Commissioner of Canada	32
PIPEDA requirements in brief	Office of the Privacy Commissioner of Canada	9
What you need to know about mandatory reporting of breaches of security safeguards	Office of the Privacy Commissioner of Canada	36
Guidelines for obtaining meaningful consent	Office of the Privacy Commissioner of Canada	42

What did it answer?

Five questions a staff member at a Canadian firm might ask. Each answer is printed exactly as the model wrote it, with its six excerpts listed as sources. Under each one is our check against the excerpts and the law itself.

Question	Time	Our check
1. A cloud service in the United States	2 min 45 s	Right in substance, two citation slips
2. Sending a Quebec client's information outside Quebec	1 min 30 s	Correct
3. Reporting a breach and keeping the record	42 s	One wrong figure
4. The Privacy Commissioner on generative AI	1 min 36 s	Honest, but incomplete
5. The maximum fine in Ontario	53 s	Correct to say it doesn't know

Answer 1 of 5 · 165 seconds on the office PC · printed as written

Q · We want to use a cloud service in the United States to process client personal information. Is that allowed, and what do we have to tell our clients?

Yes, using a cloud service in the United States to process client personal information is allowed under certain conditions, but specific requirements must be met.

What is allowed:

Under PIPEDA, organizations may transfer personal information to a third-party service provider outside Canada, including the United States, provided that appropriate safeguards are in place [5].
The transfer is permitted if the organization assesses the risks to the integrity, security, and confidentiality of the personal information when transferred to a foreign jurisdiction [5].
The organization must ensure that the service provider protects the information with security safeguards appropriate to the sensitivity of the information [3].
The organization must also ensure that if the transaction does not proceed, the information is returned or destroyed within a reasonable time [3].

What must be told to clients:

Organizations must be transparent about their personal information handling practices [5].
Clients must be informed that their personal information may be sent to another jurisdiction (e.g., the United States) for processing [5].
Clients must be advised that while the information is in another jurisdiction, it may be accessed by courts, law enforcement, and national security authorities in that jurisdiction [5].

Additional considerations:

No contract can override the criminal, national security, or other laws of the country to which the information has been transferred [5].
Organizations must take into account all elements surrounding the transaction, including the foreign jurisdiction’s legal regime, and may decide that some transfers are unwise or that certain sensitive information should not be sent abroad [5].
While PIPEDA does not require a measure-by-measure comparison of foreign laws with Canadian laws, organizations must still conduct a thorough risk assessment [5].

In summary, the use of a U.S.-based cloud service is allowed if proper safeguards are in place and clients are informed about the cross-border transfer and the potential for access by foreign authorities [5].

Our check: right in substance, two citation slips

The core matches the Privacy Commissioner's cross-border guidance: sending information to a provider in another country for processing is allowed, you stay responsible for it, and you must tell clients it may be processed elsewhere and reached by that country's courts, police and national security agencies.

Two slips. The two points cited [3] come from PIPEDA section 7.2, which is about a prospective business transaction such as a sale or merger, not a cloud provider. And the last two "additional considerations" are in excerpt [6], not [5].

Answer 2 of 5 · 90 seconds on the office PC · printed as written

Q · Before we send personal information about a Quebec client outside Quebec, what does Quebec law require us to do?

Before sending personal information about a Quebec client outside Quebec, Quebec law requires the following under the Act respecting the protection of personal information in the private sector (CQLR c P-39.1):

Conduct a privacy impact assessment that considers:
- The sensitivity of the information [1];
- The purposes for which it is to be used [1];
- The protection measures (including contractual ones) that would apply [1];
- The legal framework in the destination state, including its personal information protection principles [1].
Ensure that the assessment establishes the information will receive adequate protection, particularly in light of generally recognized principles regarding the protection of personal information [1].
Enter into a written agreement with the recipient that takes into account:
- The results of the privacy impact assessment [1];
- Any terms agreed upon to mitigate risks identified in the assessment [1].
Apply the same requirements if the organization entrusts a person or body outside Quebec with collecting, using, communicating, or keeping the information on its behalf [1].

These requirements are explicitly stated in section 17 of the Act [1].

Our check: correct

It matches section 17 of the Quebec Act point by point: a privacy impact assessment with its four factors, the "adequate protection" test, a written agreement, and the same rule when someone outside Quebec handles the information for you.

Answer 3 of 5 · 42 seconds on the office PC · printed as written

Q · We had a privacy breach. When do we have to report it to the Privacy Commissioner, and how long do we keep a record of it?

You must report a privacy breach to the Privacy Commissioner of Canada within 72 hours of determining that the breach has occurred [3].

You must keep a record of the breach for 24 months (2 years) after the day on which the organization determines that the breach has occurred [4].

Our check: one wrong figure

"72 hours" is in none of its six excerpts, and it is wrong for PIPEDA. Section 10.1(2) says the report is made "as soon as feasible" after you determine the breach happened. (72 hours is the deadline under Europe's GDPR.)

The citation gave it away: [3] is the regulation on what a report must contain, and it says nothing about timing. The search never returned PIPEDA's timing line, even when we tried 12 excerpts instead of 6. The 24-month record rule is right: section 6 of the Regulations.

Answer 4 of 5 · 96 seconds on the office PC · printed as written

Q · What does the Privacy Commissioner say organizations should do before putting personal information into a generative AI tool?

The provided excerpts do not contain any direct statement from the Privacy Commissioner about what organizations should do before putting personal information into a generative AI tool.

However, based on the principles outlined in the documents:

Organizations should inform individuals about how personal information is collected, used, and disclosed throughout the generative AI system’s lifecycle [2].
They should ensure that individuals are aware they are interacting with a generative AI tool and are informed about privacy risks and available mitigations (e.g., not entering personal information unless necessary) [1].
Developers and providers should inform users and organizations about the primary and secondary purposes of data use, including whether personal information from prompts is used for further training [2].
Organizations must ensure that personal information is collected only for necessary purposes and by lawful means [4].

None of these excerpts state what the Privacy Commissioner specifically advises organizations to do before inputting personal information into a generative AI tool. Therefore, the exact advice from the Privacy Commissioner is not present in the provided documents.

Our check: honest, but incomplete

Every point it makes is in its excerpts, and it says plainly that they don't answer the question directly. But the Commissioner's principles do answer it: under limiting collection, use and disclosure, they advise using anonymized or de-identified information in prompts instead of personal information, where possible and reasonable. That passage is in the index; the search didn't return it.

Answer 5 of 5 · 53 seconds on the office PC · printed as written

Q · What is the maximum fine in Ontario for failing to report a privacy breach?

The provided excerpts do not contain information about fines in Ontario for failing to report a privacy breach. The excerpts discuss penalties under Quebec's Act respecting the protection of personal information in the private sector (CQLR c P-39.1), which includes fines up to $25,000,000 or 4% of worldwide turnover, but these do not apply to Ontario. The documents also reference PIPEDA and the Breach of Security Safeguards Regulations, but they do not specify maximum fines for Ontario. Therefore, the maximum fine in Ontario cannot be determined from the given excerpts.

Our check: correct to say it doesn't know

Its excerpts give no Ontario fine, and it said so instead of guessing. Its Quebec figure matches section 91 of the Quebec Act.

The index did hold a better answer, though. PIPEDA covers most private businesses in Ontario, and its section 28 sets fines of up to $100,000 for knowingly failing to report a breach. With 8 excerpts instead of 6, the search returns that section as excerpt 7.

What do the five answers show?

Two are right, one is right with citation slips, one is incomplete, and one has a wrong figure. That is why every answer carries its citations: the 72-hour error took one click to catch.
In three answers, the search missed a passage the index held. The model only sees the six excerpts it is given. More excerpts helped once: with 8, the search for answer 5 finds PIPEDA's fine section. The search also returns at most 2 excerpts per document, so one long act can't crowd out the rest.
In two, the model went past its excerpts: answer 1 applied a business-sale rule to a cloud question, and answer 3 added a deadline from outside the documents, against its instructions.
Time: 42 seconds to 2 minutes 45 seconds per answer. The first answer includes 27 seconds of loading the model into memory; after that it stays loaded. In four of the five, most of the wait is the model reading the excerpts and its instructions (33 to 61 seconds) before it writes a word; answer 1, the longest, spent 77 seconds writing.

That is what the free prototype is for: you see answers like these on a sample of your own documents, misses included, before you pay anything.

What runs where?

Everything that touches the documents runs on one office PC in Ontario. This is the demo's data map.

Piece	Where it lives	Outside AI provider?
The eight documents	Downloaded once from the public sites above, stored on the PC	No
Passages and index	PostgreSQL with pgvector, on the PC	No
Embeddings	BGE-small-en-v1.5 through fastembed, on the PC	No
The model	Qwen3 30B-A3B (instruct) on Ollama, on the PC, reachable only from the PC itself	No
Questions and answers	Asked and answered on the PC, then copied onto this page	No
Builder's AI coding assistant	Claude Code wrote the scripts and read parts of the public text to check the extraction and the answers. Its model runs outside Canada.	Yes, public text only

That last row is fine for public law. With your documents it never happens: coding tools work on code and made-up sample files only, in the free prototype and in your build.

How was it built?

Downloaded and cleaned the documents

A script keeps each page's main text and its headings, so every passage knows where it sits, such as "Division 1.1 Breaches of Security Safeguards". Menus, page furniture and amendments not in force are dropped.
Indexed them the way example 01 does

The same passage size (up to 1,200 characters, 150 overlapping), the same embedding model, and the same PostgreSQL tables. Indexing all 367 passages took 42 seconds.
Searched with example 01's code, unchanged

Each question is matched by meaning (pgvector) and by words (PostgreSQL full-text search), merged by reciprocal rank fusion, with at most 2 excerpts from any one document. The top 6 excerpts go to the model.
Answered with example 01's instructions, unchanged

The model is told to use only the numbered excerpts, cite them like [1] or [2][4], quote figures and dates exactly as written, and say plainly when the excerpts don't contain the answer.

What does it do, and what doesn't it do?

It does

Answer from eight public documents, with numbered citations and a source list linked to the law itself
Run entirely on one office PC: documents, index, model, questions and answers
Say when its excerpts don't answer the question, as answers 4 and 5 did

It doesn't

Give legal advice. This is a demo of the method, not a privacy-law service.
Get everything right. One answer in five had a wrong figure, which is why the citations are there.
Find every relevant passage. In three answers, a better passage was in the index but not in the six excerpts.
Answer fast. With no GPU, an answer takes 42 seconds to 2 minutes 45 seconds.
Stay current by itself. The documents are as downloaded on 12 November 2026.

Questions about this demo

Why publish an answer that's wrong?

Because it's what the system actually said, and it shows the failure you should expect: a confident figure that isn't in the excerpts. The citation made it easy to catch. Hiding it would make the other four answers worth less.

Is this the same as example 01?

The search code, the instructions to the model and the model are the same: Qwen3 30B-A3B (instruct) on Ollama, with example 01's search and prompt file used unchanged. The machine is smaller (6 cores here, 16 there), the documents are public web pages instead of project files, and the index is 367 passages instead of 35,381.

Can a 6-core office PC with no GPU really run a 30-billion-parameter model?

Yes, slowly. Qwen3 30B-A3B is a mixture of experts: it reads only a small part of itself for each word it writes, so it runs on 32 GB of memory and an ordinary CPU. Here that meant 42 seconds to 2 minutes 45 seconds per answer.

Could the free prototype on our documents run like this?

Yes, that's the setup: our own test machine in Ontario, a local model, a copy of one sample folder, never your live file store. The copy and its index are deleted within 14 days of the prototype call, and AI coding tools never see your files.

A private AI assistant answering from Canadian privacy law, on an office PC with no GPU

What does it read?

What did it answer?

What do the five answers show?

What runs where?

How was it built?

Downloaded and cleaned the documents

Indexed them the way example 01 does

Searched with example 01's code, unchanged

Answered with example 01's instructions, unchanged

What does it do, and what doesn't it do?

It does

It doesn't

Questions about this demo

See the client build, or the prices

Want answers like these from your own files?