Data privacy: How some Canadian businesses and organizations are adapting to online security threats

It’s Data Privacy Week in Canada—an opportunity for all businesses and organizations to reflect on how they handle personal information. This year’s theme is “prioritize privacy by design.”

In 2025, the Canadian Survey on Business Conditions asked businesses and organizations across the economy a series of questions about digital infrastructure and technologies, including cybersecurity. Let’s have a look at some of the key findings that may relate to managing data privacy.

In the second quarter of 2025, roughly one in five Canadian businesses and organizations (19.8%) planned to take new or additional cybersecurity actions over the next 12 months.

Conversely, close to half (47.6%) did not plan on taking any new cybersecurity measures, and nearly three in five of those businesses and organizations (58.4%) said it was primarily because they did not need them. Additionally, almost one-third (32.2%) said they already implemented necessary actions, while 7.4% cited not having the financial resources to do so.

More than two in five businesses and organizations (42.6%) in information and cultural industries—a broad sector which includes telecommunications and computing infrastructure providers—said they planned to take new or additional cybersecurity actions, the highest rate among sectors.

Second among sectors with such plans was finance and insurance (37.1%), which includes banks and other financial institutions.

Close to half (46.7%) of manufacturing businesses and organizations said they did not plan to take new cybersecurity measures, and of those, 15.4% cited a lack of financial resources as a reason—the highest proportion for this reason among sectors.

In the second quarter of 2025, almost one in six businesses and organizations (15.7%) planned to adopt or incorporate security software tools over the next 12 months.

Businesses and organizations in finance and insurance (29.7%) were the most likely among sectors to do this, followed by those in professional, scientific, and technical services (24.8%).

Among the 12.2% of businesses and organizations in the second quarter of 2025 that had used artificial intelligence to deliver goods and services in the past 12 months, close to one in five (18.5%) said they changed data collection or management practices.

Slightly higher proportions of businesses and organizations that had used artificial intelligence said they developed new workflows (40.1%), while others purchased cloud services or cloud storage (25.7%) or computing power or specialized equipment (17.9%).

Visit Statistics Canada’s Trust Centre to learn more about how the agency protects your privacy and that of your businesses or organization whenever you’re participating in one of our many surveys.

Our colleagues at the Office of the Privacy Commissioner also have resources for both individuals and businesses to be better informed about data privacy.