Canada's e-signature framework combines a federal model law with a parallel civil law regime in Quebec. The Uniform Electronic Commerce Act (UECA), drafted by the Uniform Law Conference of Canada in 1999, has been adopted by the federal government and every province and territory except Quebec, each through its own implementing statute (the Ontario Electronic Commerce Act, British Columbia's Electronic Transactions Act, and similar acts elsewhere). Quebec runs on its own Act to Establish a Legal Framework for Information Technology, a civil law instrument that reaches largely the same result through different mechanics.

UECA takes a functional-equivalence approach borrowed from the UN Model Law on Electronic Commerce: an electronic signature is valid wherever the law requires a signature, provided it reliably identifies the signer and shows their intent to sign. There is no tiered system comparable to the EU's eIDAS. A separate, narrower concept exists at the federal level: the Secure Electronic Signature, defined under the Secure Electronic Signature Regulations (SOR/2005-30) and built on PKI certificates issued by a listed certification authority. It carries a statutory presumption of reliability under the Canada Evidence Act, but only a short list of federal filings requires it, chiefly statutory declarations and affidavits made under federal law.

The exclusion list is short and consistent across provinces, though exact wording varies slightly by statute. Wills, codicils, and testamentary trusts are excluded everywhere. So are powers of attorney over financial affairs, negotiable instruments such as promissory notes and bills of exchange, and any document that requires registration at a provincial land title office. Notarization cannot be done virtually anywhere in Canada, which matters for the small set of documents that require a notary rather than a witness. Outside that list, UECA's default rule applies: if the law would accept a signature, it accepts an electronic one.

Federal privacy law runs on a separate track from e-signature law. PIPEDA governs how private-sector organizations handle personal information nationally, with Alberta and British Columbia operating their own substantially similar provincial statutes that displace PIPEDA within those provinces. Quebec's Law 25, fully in force since September 2024, layers GDPR-style obligations on top: privacy impact assessments for certain processing activities, a 24-hour breach notification window, and stronger consent requirements. None of these three regimes impose a general data localization rule for standard commercial e-signature processing. The restrictions that do exist are sector-specific: Ontario's PHIPA keeps health information inside Canada, and federal Protected B/C and classified information must stay in Canada regardless of sector.

Canada has held a partial EU adequacy decision since 2002, one of the earliest granted under what's now GDPR. It covers commercial organizations subject to PIPEDA and permits data to flow from the EU into Canada without Standard Contractual Clauses or other supplementary safeguards. The decision runs in the EU-to-Canada direction; the reverse flow, a Canadian company sending data to an EU-hosted processor like Firma.dev, is governed by PIPEDA itself, which allows cross-border transfers with notice and comparable protections rather than requiring a specific adequacy finding.

For a SaaS company building on Firma.dev, the practical picture is straightforward. Standard electronic signatures cover commercial contracts, employment agreements, NDAs, software licenses, and nearly everything else a B2B platform needs to sign in Canada, across every province including Quebec. The Secure Electronic Signature requirement only comes up for a narrow set of federal statutory filings that fall outside typical commercial contracting, and the document exclusion list is short enough to check once and build into a workflow rather than something that needs legal review on every contract.