Nunavut

Nunavut has no statute or regulation on artificial intelligence, and no AI-transparency, high-risk system, training-data, prohibited-practice, governance or sector rule appears in its consolidated statute list, in the 2024 and 2025 annual volumes of the Statutes of Nunavut or among the bills before the Legislative Assembly in 2026.

The Access to Information and Protection of Privacy Act (C.S.Nu., c. A-20), which binds public bodies, requires a minister to submit a privacy impact assessment, or the results of a preliminary assessment showing that none is required, when a program or service of a public body is developed or redesigned, and its text contains no provision on automated decisions, algorithms or artificial intelligence. That Act's personal-information duties are described in the territory's privacy entry. The federal position is described in Canada's national entry.

Nunavut has no territorial statute governing the private sector's handling of personal information, and no health information Act, privacy-notice statute or data-broker law appears in its consolidated statute list, in the 2024 and 2025 annual volumes of the Statutes of Nunavut or among the bills before the Legislative Assembly in 2026.

The federal Personal Information Protection and Electronic Documents Act therefore governs commercial activity in the territory and is described in Canada's national entry, and this entry restates none of it.

The territory's one privacy regime is public-sector: the Access to Information and Protection of Privacy Act (C.S.Nu., c. A-20), consolidated to May 31, 2024, applies to records in the custody or under the control of a public body, which means a department, branch or office of the Government of Nunavut or an agency, board, commission, corporation, office, municipality or other body designated in the regulations.

Under it the head of a public body must protect personal information by making reasonable security arrangements (section 42), a minister must submit a privacy impact assessment, or the results of a preliminary assessment showing that none is required, when a program or service is developed or redesigned (section 42.1), a public body must report a material breach of privacy to the Information and Privacy Commissioner (section 49.9), and a public body must notify an individual of a breach that creates a real risk of significant harm to the individual (section 49.10).

That Act binds public bodies and is named here as the public-sector regime. The Consumer Protection Act (R.S.N.W.T. 1988, c. C-17), in the consolidation current to October 11, 2012, has Parts on disclosure of the cost of borrowing, prepayment privileges and relief against acceleration and forfeiture, and it contains no provision on credit reporting, personal information or privacy.

The Public Health Act, the Medical Care Act and the Hospital Insurance and Health and Social Services Administration Act are public-sector health Acts, and their confidentiality provisions are not described here.

Nunavut has no statute that sets security requirements for a software product or connected device, requires a private organization to report a cyber incident or an exploited vulnerability to an authority, or imposes a cyber-resilience regime on a software or platform provider.

Its security duty sits inside its privacy regime: section 42 of the Access to Information and Protection of Privacy Act (C.S.Nu., c. A-20) requires the head of a public body to protect personal information by making reasonable security arrangements against unauthorized access, collection, use, disclosure or disposal, and that Act's breach reporting and notification duties are described in the territory's privacy entry.

The Emergency Measures Act, the Safety Act and the Technical Standards and Safety Act are titled for emergencies, safety and technical standards and not for cyber security or critical infrastructure, and the titles of the Acts in the 2024 and 2025 annual volumes and of the bills before the Legislative Assembly in 2026 name no such subject. The federal overlays are described in Canada's national entry.

Nunavut has no adult-content age-verification law, social-media minor-access restriction, app-store or device age-verification requirement, or age-appropriate design code. No Act in the territory's consolidated statute list is titled for age verification, minors' use of social media, app stores or age-appropriate design, and the titles of the Acts in the 2024 and 2025 annual volumes of the Statutes of Nunavut and of the bills before the Legislative Assembly in 2026 name no such subject.

The Education Act (C.S.Nu., c. E-10), in the official consolidation current to July 1, 2021, contains no provision that uses the words social media, internet, online, electronic device or cyber. The federal Bills S-209 and C-34 are described in Canada's national entry.

Nunavut has no territorial press-publisher right, news-bargaining code, hot-news misappropriation rule, linking or framing statute, or text-and-data-mining opt-out. Copyright, including fair dealing, and the news-bargaining regime are federal law, found in the Copyright Act and the Online News Act and described in Canada's national entry.

The territory's Defamation Act (C.S.Nu., c. D-10) applies to defamation published in a newspaper or by broadcasting and contains no provision on hyperlinks, electronic publication or the internet. Its definition of broadcasting is the dissemination of radioelectric communication, including radio-telegraph, radiotelephone and the wireless transmission of writing, signs, signals, pictures and sounds by means of Hertzian waves.