A Practice Note describing the laws, regulations, enforcement practices, and local resources to consider when developing, implementing, and maintaining an information security program in Canada and as applied to data originating from Canada. It also addresses the Personal Information Protection and Electronic Documents Act and Canada's substantially similar provincial private sector privacy laws, including Alberta's Personal Information Protection Act, British Columbia's Personal Information Protection Act, and Quebec's Act Respecting the Protection of Personal Information in the Private Sector. The Note also addresses Office of the Privacy Commissioner of Canada guidance, cybersecurity industry standards, and Government of Canada programs, including the Canadian Centre for Cyber Security. For more Canadian cybersecurity resources, see Cybersecurity Toolkit (Canada).