Bill 131: Privacy and Credit Protection Act

Any business operating in Nova Scotia that collects, stores, or processes customer personal data — think e-commerce retailers, financial services firms, insurance brokers, healthcare-adjacent businesses, or even local service providers that capture client details — will need to review how they handle that data. Businesses acting as data controllers or processors must implement security measures to prevent data breaches and must delete personal data once it's no longer needed for its original purpose. Consumer reporting agencies face specific new obligations around credit file security freezes and cannot charge consumers fees for placing or lifting them. The penalties are steep — up to $30 million or 4% of worldwide annual revenue, whichever is higher — meaning even mid-sized companies face material financial exposure for non-compliance, not just large enterprises.