This is general information and not legal advice. Privacy obligations depend on what data you handle, where your users are, and what sector you operate in. Get advice from a lawyer before relying on any of it.
The current position
PIPEDA — the Personal Information Protection and Electronic Documents Act — is the federal statute governing how private-sector organisations handle personal information in the course of commercial activity. If your app collects personal data and you are a commercial operation, it is the baseline.
Quebec, British Columbia and Alberta have provincial private-sector privacy laws that have been recognised as substantially similar, which can change which regime applies to your users.
What is changing
Bill C-27 has been proposed to replace PIPEDA with a more demanding framework, including a separate regime for artificial intelligence systems. Anyone tracking the timeline should check its current status directly rather than trust a summary with a date on it — including this one.
What it means for a build
The practical implications land in the same places regardless of which statute applies: collect only what the product needs, be able to say clearly what you collect and why, and be able to delete it on request. Account deletion is also an App Store requirement independent of any privacy law.
Retrofitting deletion into a data model that assumed records are permanent is genuinely expensive, which is why this belongs in the design phase.