Northwest Territories: AI, privacy and software law

Privacy law6 instruments, 6 in force

Research summary (258 words)

The Northwest Territories has no general private-sector privacy statute and no federal exemption order for the Territory, so the federal Personal Information Protection and Electronic Documents Act governs personal information that organizations collect, use or disclose in the course of commercial activities in the Territory, and it is described in Canada's national entry. The Health Information Act (S.N.W.T. 2014, c. 2) is the Territory's own law for personal health information.

It binds health information custodians, a class that includes the Department of Health and Social Services, medical practitioners, pharmacists and the organizations and persons the regulations prescribe, and it reaches information managers and recipients of disclosed information through rules of their own. The Act binds the Government of the Northwest Territories. Because no federal order exempts a custodian from Part 1 of the federal Act, a private custodian answers to both.

The Access to Information and Protection of Privacy Act (S.N.W.T. 1994, c. 20) governs access to the records of public bodies and Part 2 of it protects the personal information they hold, including a privacy impact assessment duty in section 42.1; it is named here and not described as an instrument.

The Territory has no standalone privacy-notice statute, no data-broker statute, no statute on biometric information, voiceprints or faceprints, and no credit-reporting statute in its consolidated statute list. The Health Information Act limits disclosure of personal health information to the cases it lists and requires safeguards for information stored, used or disclosed outside the Territory, and no other restriction on transfers outside the Territory has been located.

Breach notification

Health Information Act, notice of a breach of personal health information

S.N.W.T. 2014, c. 2, s. 87Health Information Act

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived July 4, 2026. Publisher's page: https://www.justice.gov.nt.ca/en/files/legislation/health-information/health-information.a.pdf

In force since 1 Oct 2015. Binds public and private bodies.

What this law does

Subject to any prescribed exceptions, a health information custodian shall give notice to an individual, and to a prescribed person or organization if applicable, as soon as reasonably possible if personal health information about the individual is used or disclosed other than as permitted by the Act, lost or stolen, or altered, destroyed or otherwise disposed of without authorization.

What it requires

Data subject rights

Health Information Act, access to and correction of personal health information

S.N.W.T. 2014, c. 2, ss. 94-95, 101, 119Health Information Act

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived July 4, 2026. Publisher's page: https://www.justice.gov.nt.ca/en/files/legislation/health-information/health-information.a.pdf

In force since 1 Oct 2015. Binds public and private bodies.

What this law does

An applicant has a right of access to any record containing personal health information about the applicant that is in the custody or under the control of a health information custodian, subject to the exceptions in the Act. The right is subject to the payment of fees and disbursements set in accordance with the regulations, which must not exceed the costs of processing the access request.

Subject to the exceptions and time extensions the Act provides, not later than 30 days after receiving an access request, a custodian shall give the applicant a written response. An individual who believes there is an error or omission in a record containing personal health information about the individual may request the custodian in writing to correct it. A custodian shall not charge fees or disbursements for a correction request.

What it requires

Enforcement supervision

Health Information Act, review by the Information and Privacy Commissioner and offences

S.N.W.T. 2014, c. 2, ss. 141, 156, 192-194Health Information Act

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived July 4, 2026. Publisher's page: https://www.justice.gov.nt.ca/en/files/legislation/health-information/health-information.a.pdf

In force since 1 Oct 2015. Binds public and private bodies.

What this law does

An individual who makes an access request may ask the Information and Privacy Commissioner to review any decision, act or failure to act of a custodian that relates to the request. Where a report of the Commissioner sets out recommendations for action by a custodian, the custodian shall, within 30 days after receiving the report, decide whether or not to follow the recommendations.

Every person who contravenes or fails to comply with the Act or the regulations is guilty of an offence punishable on summary conviction and is liable to a fine not exceeding $500,000 in the case of a corporation or $50,000 in the case of any other person. An officer, director, agent or employee of a corporation who directed, authorized, assented to, acquiesced in or participated in the commission of the offence is a party to it and is liable to the punishment provided for the offence. A prosecution may not be commenced more than three years after the day the alleged offence was committed.

What it requires

Sensitive categories

Health Information Act, consent and the collection, use and disclosure of personal health information by custodians

S.N.W.T. 2014, c. 2, ss. 15, 27-29, 38-40Health Information Act

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived July 4, 2026. Publisher's page: https://www.justice.gov.nt.ca/en/files/legislation/health-information/health-information.a.pdf

In force since 1 Oct 2015. Binds public and private bodies.

What this law does

The Act applies to records containing personal health information that are in the custody or under the control of a health information custodian. The class of custodians includes the Department of Health and Social Services, a medical practitioner and a pharmacist.

Where the Act requires an individual's consent to the collection, use or disclosure of personal health information, the consent must be the individual's, must relate to the information, must be knowledgeable and must not be obtained through deception or coercion. A custodian shall not collect, use or disclose personal health information if non-identifying health information would be adequate for the intended purposes.

A custodian shall not collect, use or disclose more personal health information than is reasonably necessary to meet the purpose. A custodian shall not collect personal health information about an individual unless one of the listed grounds applies, the first being that the individual has consented and the collection is necessary for a lawful purpose.

A custodian shall not disclose personal health information about an individual unless the custodian has the express consent of the individual and the disclosure is necessary for a lawful purpose, or the disclosure is permitted or required by this or another Act or by an Act or regulation of Canada. Before disclosing personal health information, a custodian shall take reasonable steps to verify that the recipient is authorized to collect it and is the intended recipient.

A recipient of personal health information disclosed by a custodian shall not use or disclose it for any purpose other than the one for which the custodian was authorized to disclose it, or to carry out a legal duty. The Act does not apply to a record containing personal health information about an employee or agent of the custodian that is not made or maintained primarily for the purpose of providing or assisting in the provision of a health service to that person.

What it requires

Health Information Act, information managers and their agreements with custodians

S.N.W.T. 2014, c. 2, s. 13Health Information Act

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived July 4, 2026. Publisher's page: https://www.justice.gov.nt.ca/en/files/legislation/health-information/health-information.a.pdf

In force since 1 Oct 2015. Binds public and private bodies.

What this law does

An information manager is a person or organization that provides a health information custodian with the processing, storage, retrieval or disposal of personal health information, the transforming of it, or information management, information system or information technology services. Before using the services of an information manager, a custodian shall enter into an information management agreement with it, subject to subsection (3) and any exceptions set out in the regulations.

The agreement must contain terms under which the information manager agrees to comply with the Act, the regulations and the custodian's standards, policies and procedures, and to maintain administrative, technical and physical safeguards for the information. An information manager to which personal health information is disclosed shall not collect, use or disclose it except in accordance with the agreement, and shall not contravene the agreement.

What it requires

Health Information Act, safeguards, electronic health records and privacy impact assessments

S.N.W.T. 2014, c. 2, ss. 8, 85-86, 88-89Health Information Act

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived July 4, 2026. Publisher's page: https://www.justice.gov.nt.ca/en/files/legislation/health-information/health-information.a.pdf

In force since 1 Oct 2015. Binds public and private bodies.

What this law does

A custodian shall establish or adopt standards, policies and procedures to implement the Act and the regulations, including the requirements under sections 85 to 88. A custodian shall take reasonable measures to maintain administrative, technical and physical safeguards for the protection of personal health information, including for protection of information that is to be stored or used outside the Northwest Territories or disclosed to a person or organization outside the Territories.

A custodian shall implement controls that limit the persons who may use the information to those authorized to do so. The measures for the security of records must include measures to address the risks of electronic health records that are based on nationally or territorially recognized information technology security standards and processes.

A custodian shall take reasonable measures to ensure that personal health information is accurate and complete in collecting it and before using or disclosing it. A public custodian and a prescribed custodian shall prepare a privacy impact assessment for a proposed new information system or communication technology, or a proposed change to one, that relates to the collection, use or disclosure of personal health information.

What it requires

Scraping law1 instrument, 1 in force

Research summary (138 words)

The Northwest Territories has no territorial computer-misuse, anti-scraping, database-right, text-and-data-mining or robots.txt statute.

Unauthorized use of a computer and copyright are federal matters, described in Canada's national entry, and personal information collected from public web pages falls under the federal Personal Information Protection and Electronic Documents Act, and under the Health Information Act where a health information custodian collects it, as described in the Territory's privacy entry and in Canada's national entry.

The territorial statute that governs how a contract is formed online is the Electronic Transactions Act, which gives legal effect to a contract expressed by clicking and to one formed by the interaction of electronic agents but does not mention browsewrap terms, crawling or scraping, so whether terms posted on a site bind a crawler that never clicked is left to the common law of contract.

Contract terms of service (ToS)

Electronic Transactions Act, electronic contracts and electronic agents

S.N.W.T. 2011, c. 13, ss. 1, 16-18Electronic Transactions Act

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived September 23, 2025. Publisher's page: https://www.justice.gov.nt.ca/en/files/legislation/electronic-transactions/electronic-transactions.a.pdf

In force. Binds public and private bodies.

What this law does

Unless the parties agree otherwise, an offer, the acceptance of an offer or any other matter that is material to the formation or operation of a contract may be expressed by means of electronic information or an electronic document, or by an action intended to result in electronic communication, such as touching or clicking on an appropriately designated icon or place on a computer screen.

A contract is not invalid or unenforceable solely because it is in electronic form or because an electronic document has been used in its formation. A contract may be formed by the interaction of an electronic agent and an individual or by the interaction of electronic agents.

An electronic agent is a computer program or any other electronic means used to initiate an act or to respond to electronic documents or acts, in whole or in part, without review by an individual at the time of the response or act.

If an individual makes a material error in the course of an electronic transaction with an electronic agent belonging to another person, the transaction is not enforceable by the other person if the electronic agent does not give the individual an opportunity to prevent or correct the error, the individual promptly notifies the other person of the error, and the further conditions the section states are met.

What it requires

Where nothing was found4 areas of law

These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.

AI law

The Northwest Territories has no statute or regulation on artificial intelligence, and no AI-transparency, high-risk system, training-data, prohibited-practice, governance or sector rule has been located. The titles of the bills of the 20th Legislative Assembly listed as bills 1 to 53 on June 16, 2026 name no such subject.

The Access to Information and Protection of Privacy Act, which binds public bodies, and the Health Information Act contain no provision on artificial intelligence, algorithms or automated decision-making.

Section 42.1 of the former requires a public body, during the development of a proposed enactment, system, project, program or service that involves the collection, use or disclosure of personal information, to prepare a privacy impact assessment and submit it to the head of the public body, and the personal-information duties of both are named in the Territory's privacy entry. The federal position is described in Canada's national entry.

As of 26 October 2026.

Cybersecurity law

The Northwest Territories has no statute that sets security requirements for a software product or connected device, requires a private organization to report a cyber incident or an exploited vulnerability to an authority, or imposes a cyber-resilience regime on a software or platform provider.

Its security duties sit inside its privacy regimes: section 85 of the Health Information Act requires a custodian to take reasonable measures to maintain administrative, technical and physical safeguards for personal health information, and section 42 of the Access to Information and Protection of Privacy Act requires the head of a public body to protect personal information by making reasonable security arrangements, and both are named in the Territory's privacy entry.

No Act in the Territory's consolidated statute list is titled for, or directed at, cyber security or critical infrastructure, and the titles of the bills of the 20th Legislative Assembly listed as bills 1 to 53 on June 16, 2026 name no such subject. The federal overlays are described in Canada's national entry.

As of 26 October 2026.

Age gating law

The Northwest Territories has no adult-content age-verification law, social-media minor-access restriction, app-store or device age-verification requirement, or age-appropriate design code. The Film Classification Act, which applies only to films exhibited to the public in a theatre, bars attendance by the classes of people that a film's audience classification excludes.

No other Act in the Territory's consolidated statute list is titled for, or directed at, age verification, minors' use of social media, app stores or age-appropriate design, and the titles of the bills of the 20th Legislative Assembly listed as bills 1 to 53 on June 16, 2026 name no such subject. The federal position is described in Canada's national entry.

As of 26 October 2026.

Reuse law

The Northwest Territories has no territorial press-publisher right, news-bargaining code, hot-news misappropriation rule, linking or framing statute, or text-and-data-mining opt-out. Copyright, including fair dealing, and the news-bargaining regime are federal law, found in the Copyright Act and the Online News Act and described in Canada's national entry.

No Act in the Territory's consolidated statute list is titled for, or directed at, news aggregation, linking, framing or the reuse of published content, and the titles of the bills of the 20th Legislative Assembly listed as bills 1 to 53 on June 16, 2026 name no such subject.

As of 26 October 2026.

Case law

No current case law for Northwest Territories AI law
No current case law for Northwest Territories privacy law
No current case law for Northwest Territories scraping law
No current case law for Northwest Territories cybersecurity law
No current case law for Northwest Territories communications law
No current case law for Northwest Territories content moderation law
No current case law for Northwest Territories product and AI liability law
No current case law for Northwest Territories age gating law
No current case law for Northwest Territories reuse law

Reporting clocks that run here2 instruments

The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of the Northwest Territories comes first, then the law of the bodies above it that applies here.

The law of the Northwest Territories

as soon as reasonably possible

Health Information Act, notice of a breach of personal health information

S.N.W.T. 2014, c. 2, s. 87privacy law, in force since 1 October 2015

The sentence the clocks are read from

Subject to any exceptions the regulations prescribe, give notice to the individual as soon as reasonably possible if personal health information about the individual is used or disclosed other than as the Act permits, is lost or stolen, or is altered, destroyed or otherwise disposed of without authorization (s. 87).

The law of Canada, which applies in the Northwest Territories

as soon as feasible

PIPEDA breach of security safeguards regime

S.C. 2000, c. 5, ss. 10.1-10.3privacy law, in force since 1 November 2018

The sentence the clocks are read from

Report any breach of security safeguards involving personal information under the organization's control to the Privacy Commissioner as soon as feasible, if it is reasonable to believe the breach creates a real risk of significant harm to an individual.

Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

This page covers the instruments LexLint has researched to a stage. Instruments named in the law library but not yet researched are counted in the head and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.