https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/
The burden is on the Canadian business to ensure that they comply with the law. Same goes for GDPR in Europe, CCPA in California, and whatever other data regulation laws.
Larger companies will vet their vendors for security and compliance (since they don't want to break the law), and if you don't meet their standards then they won't buy your product. Smaller companies don't know or care.