Scope
This guide explains Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) for private-sector organizations managing personal information in commercial activities. It's designed for security engineers and privacy teams dealing with cross-border data flows, consent management, and compliance with federal Personal Information Protection and Electronic Documents Act.
You'll find requirement breakdowns, implementation strategies, and a handy reference table. Note that this guide doesn't cover provincial laws in Alberta, British Columbia, or Quebec, which have similar statutes that override PIPEDA for in-province data handling.
Key Concepts
Personal Information: Any data about an identifiable individual, such as names, addresses, IP addresses, device identifiers, opinions, employee files, and credit records. Business contact information used solely for professional purposes (name, title, work email, business phone) is excluded.
Commercial Activity: Any transaction or conduct of a commercial nature, including selling or leasing membership lists and fundraising activities. Not-for-profits are exempt unless they engage in commercial activities.
Sensitivity: This is context-dependent. Medical and financial information is generally sensitive, while a general newsmagazine's subscriber list may not be. Higher sensitivity requires stronger consent and safeguards.
Substantially Similar: Alberta, British Columbia, and Quebec have privacy laws deemed similar to PIPEDA. For data handled entirely within one of these provinces, provincial law usually applies. Once data crosses a provincial or national border, PIPEDA governs.
Requirements Breakdown
PIPEDA is based on ten fair information principles in Schedule 1, plus mandatory breach reporting added in 2018. Here's what each principle requires:
Principle 1, Accountability: Designate a privacy officer responsible for compliance. Their contact details must be publicly available. You're accountable for personal information transferred to third-party processors.
Principle 2, Identifying Purposes: Document the purpose of data collection before collecting it. State the purpose on the collection form.
Principle 3, Consent: Obtain knowledge and consent before collecting, using, or disclosing personal information. Sensitive data requires explicit opt-in consent.
Principle 4, Limiting Collection: Collect only what is necessary for the stated purpose, using fair and lawful means. Don't request a social insurance number to run a newsletter.
Principle 5, Limiting Use, Disclosure, and Retention: Use data only for the collected purpose. Retain it only as long as needed. Schedule deletion for abandoned-cart records and expired accounts.
Principle 6, Accuracy: Ensure data is correct and complete enough for sound decision-making. Allow customers to fix incorrect shipping addresses or account details.
Principle 7, Safeguards: Protect personal information with security controls suited to its sensitivity. Encrypt stored payment details. Hash or tokenize identifiers where appropriate.
Principle 8, Openness: Publish how you handle personal information in clear language. Your privacy policy must be accessible and easy to understand.
Principle 9, Individual Access: Respond to access requests within 30 days. Provide a copy of the data you hold, how it's been used, and who it's been shared with. Allow individuals to challenge and correct inaccuracies.
Principle 10, Challenging Compliance: Route privacy complaints to your designated privacy officer. Investigate every complaint. If unresolved, the complainant can escalate to the Office of the Privacy Commissioner of Canada.
Breach Reporting (added 2018, effective November 1, 2018): Report breaches involving personal information to the Privacy Commissioner if there's a real risk of significant harm. Notify affected individuals and keep records of every breach.
Implementation Guidance
Determine Your Jurisdiction: You're under PIPEDA if:
- Your data crosses a provincial or national border (most online businesses qualify)
- You're a federally regulated business (banks, airlines, railways, telecoms)
- You operate in Yukon, Northwest Territories, or Nunavut
- You're a foreign business with a substantial connection to Canada (selling to Canadian customers counts)
Map Your Data Flows: Identify every point where personal information crosses a border. A Vancouver shop selling only to BC customers and hosting data in BC answers to BC's PIPA. Once that shop ships to Ontario or uses a U.S. provider, PIPEDA applies to those cross-border flows.
Build a Consent Record: Document what you told the user, when they consented, and what they consented to. Store consent artifacts (checkbox states, timestamps, privacy-policy versions) in a tamper-evident log. Sensitive data requires opt-in; don't rely on pre-checked boxes.
Schedule Retention Limits: Set retention schedules tied to business purposes. When the purpose expires, delete the data. If you're keeping payment records for tax compliance, document that purpose and the retention period it requires.
Publish Contact Details: Your privacy officer's name and contact information must be public. Include it in your privacy policy, on your contact page, and anywhere a user might look for it.
Common Pitfalls
Assuming Business Contact Info Is Always Exempt: A work email used for professional contact is exempt. If you sell or rent that contact list, PIPEDA applies to every address on it.
Treating Consent as Binary: Sensitivity is context-dependent. An email address for a newsletter needs less formal consent than a medical history. Match your consent mechanism to the data's sensitivity.
Ignoring Cross-Border Triggers: Moving to a U.S. cloud provider or shipping to another province brings you under PIPEDA, even if your business is in a province with its own privacy law.
Conflating Enforcement Bodies: The Office of the Privacy Commissioner of Canada enforces PIPEDA. The Competition Bureau handles competition and misleading-advertising law. Privacy complaints go to the Privacy Commissioner, not the Competition Bureau.
Assuming the Commissioner Can Fine You: Under current law, the Privacy Commissioner can't levy fines. Investigations end in findings and recommendations. If ignored, the complainant or the Commissioner can ask the Federal Court to order changes and award damages. The only fines (up to $100,000) come from a court prosecuting specific offences in section 28, such as knowingly failing to report a breach.
Quick Reference Table
| Requirement | Section | What You Must Do | Example |
|---|---|---|---|
| Accountability | Schedule 1, 4.1 | Designate a privacy officer; publish contact details | Privacy officer email on website footer |
| Identifying Purposes | Schedule 1, 4.2 | Document purpose before collection; state it on the form | "We collect your birthdate to verify age" |
| Consent | Schedule 1, 4.3 | Obtain knowledge and consent; opt-in for sensitive data | Checkbox for health-information consent |
| Limiting Collection | Schedule 1, 4.4 | Collect only what the purpose needs | Don't ask for SIN to send a newsletter |
| Limiting Use/Retention | Schedule 1, 4.5 | Use only for stated purpose; delete when done | 90-day retention for abandoned carts |
| Accuracy | Schedule 1, 4.6 | Let users correct mistakes | Account-settings page to update address |
| Safeguards | Schedule 1, 4.7 | Encrypt/protect based on sensitivity | AES-256 for payment details |
| Openness | Schedule 1, 4.8 | Publish plain-language privacy policy | Policy at /privacy, linked in footer |
| Individual Access | Schedule 1, 4.9 | Respond to access requests within 30 days | Provide copy of data held and usage |
| Challenging Compliance | Schedule 1, 4.10 | Investigate every complaint | Route complaints to privacy officer |
| Breach Reporting | Section 10.1 | Report if real risk of significant harm | Notify Commissioner within required timeframe |
No-Consent Exceptions (Section 7): You can handle personal information without consent only in narrow cases: complying with a subpoena or warrant, collecting a debt owed to you, investigating a suspected breach of law or contract where asking would tip off the subject, an emergency threatening life or health, or using publicly available information as defined in regulations.
Current Enforcement Authority: Office of the Privacy Commissioner of Canada. The Commissioner investigates, audits, and issues findings and recommendations but cannot levy administrative fines under the current law.
Reform Status: Bill C-36 (introduced June 15, 2026, first reading as of September 2026) would repeal Part 1 of PIPEDA and introduce administrative penalties up to the higher of $10 million or 3% of global revenue, a new Digital Safety and Data Protection Commission, and new rights including data deletion and portability. Until it passes, PIPEDA remains the law.
