PIPEDA Compliance: Canada's Private Sector Privacy Law Explained

PIPEDA, the Personal Information Protection and Electronic Documents Act, is Canada's federal privacy law for the private sector. It applies to organisations that collect, use or disclose personal information in the course of commercial activity, including many foreign companies that sell to Canadians. PIPEDA compliance rests on ten fair information principles, meaningful consent and, since November 2018, mandatory reporting of serious breaches.

The law is under reform. Bill C-36, introduced on 15 June 2026, would replace PIPEDA's privacy part with a new Protecting Privacy and Consumer Data Act, but at the time of writing it had not passed. This guide explains PIPEDA as it applies today, how provincial laws such as Quebec's Law 25 fit in, what vendors and processors must do, and what the proposed reform would change.

What is PIPEDA?

PIPEDA was enacted in 2000 and came fully into force in 2004. Part 1 governs personal information in the private sector; Part 2 deals with electronic documents. Its core requirements are in Schedule 1, which incorporates the Canadian Standards Association's Model Code for the Protection of Personal Information as ten fair information principles. The Office of the Privacy Commissioner of Canada (OPC) oversees the law, investigates complaints, issues guidance and can apply to the Federal Court.

"Personal information" means information about an identifiable individual. It includes names, contact details, identifiers, purchase history, device and location data, opinions and evaluations, and, in many cases, IP addresses and online identifiers that can be linked to a person. Business contact information used to communicate with someone in relation to their employment is excluded.

Who must comply?

• Private sector organisations collecting, using or disclosing personal information in commercial activity, in provinces without a substantially similar law, and for all interprovincial and international transfers.
• Federal works, undertakings and businesses, such as banks, airlines, telecoms and broadcasters, including their employee information.
• Foreign organisations with a real and substantial connection to Canada, such as companies offering online services to Canadians. Canadian courts and the OPC have applied PIPEDA to foreign technology companies.

Quebec, Alberta and British Columbia have private sector privacy laws recognised as substantially similar, which apply within those provinces instead of PIPEDA for intra-provincial activity. Ontario, New Brunswick, Newfoundland and Labrador and Nova Scotia have substantially similar laws for health information custodians. PIPEDA still applies to data crossing provincial or national borders. Alberta's and British Columbia's Personal Information Protection Acts also cover employee information of provincially regulated employers, which PIPEDA does not, and Alberta has its own mandatory breach reporting rule. A company with staff or customers in several provinces may therefore deal with more than one regulator.

Is PIPEDA mandatory or voluntary?

Mandatory for covered organisations. There is no size threshold: small businesses engaged in commercial activity are covered. There is no certification, but organisations must be able to demonstrate accountability.

The ten fair information principles

1. Accountability: an organisation is responsible for personal information under its control, must designate someone accountable, and remains responsible for information transferred to third parties for processing.
2. Identifying purposes: purposes must be identified at or before collection.
3. Consent: knowledge and consent are required for collection, use or disclosure, except where the law allows otherwise.
4. Limiting collection to what is necessary for identified purposes, by fair and lawful means.
5. Limiting use, disclosure and retention to the purposes for which information was collected, and keeping it only as long as necessary.
6. Accuracy: information must be accurate, complete and up to date as needed for its purposes.
7. Safeguards: security protections appropriate to the sensitivity of the information.
8. Openness: policies and practices must be readily available.
9. Individual access: individuals can access their information and challenge its accuracy.
10. Challenging compliance: individuals can challenge compliance with the person accountable.

Section 5(3) adds an overarching rule: an organisation may collect, use or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances, even with consent.

Meaningful consent

The OPC's Guidelines for obtaining meaningful consent, in effect since January 2019, set seven guiding principles. Organisations must emphasise key elements in their notices: what information is collected, with which parties it is shared, for what purposes, and any meaningful risk of harm. They must allow individuals to control the level of detail they get and when, give clear options to say yes or no to non-essential purposes, present consent information in creative, user-friendly ways, consider the consumer's perspective, make consent a dynamic and ongoing process, and be accountable by documenting their approach.

Express consent is generally needed where information is sensitive, where the use is outside reasonable expectations, or where it creates a meaningful risk of significant harm. Implied consent may suffice for less sensitive, expected uses. Consent from children under 13 is generally not considered meaningful, and the OPC expects parental consent in such cases. Individuals can withdraw consent subject to legal or contractual restrictions and reasonable notice.

Breach of security safeguards: reporting and records

Since 1 November 2018, organisations must:

• Report to the OPC any breach of security safeguards involving personal information under their control where it is reasonable to believe the breach creates a real risk of significant harm (RROSH) to an individual, as soon as feasible after determining that a breach occurred.
• Notify affected individuals in those cases, as soon as feasible, with the information set out in the regulations.
• Notify other organisations, such as law enforcement, that may be able to reduce the risk of harm.
• Keep a record of every breach of security safeguards, whether reportable or not, for 24 months after determining the breach occurred, and provide records to the OPC on request.

"Significant harm" includes bodily harm, humiliation, damage to reputation or relationships, financial loss, identity theft and negative effects on credit records. The factors are the sensitivity of the information and the probability of misuse. Knowingly failing to report, notify or keep records is an offence with fines up to C$100,000.

When a vendor processes data for a client, the client generally has control and the reporting duty. The vendor must tell the client quickly enough for the client to assess and report, which is why contracts set notification timelines.

Transfers for processing and cross-border data

PIPEDA does not prohibit transferring personal information outside Canada. Under the accountability principle, an organisation that transfers information to a third party for processing remains responsible and must use contractual or other means to provide a comparable level of protection. The OPC's 2009 cross-border guidelines also expect organisations to be transparent that information may be processed in a foreign jurisdiction and may be accessible to that jurisdiction's courts and authorities. Quebec is stricter: Law 25 requires a privacy impact assessment before communicating personal information outside Quebec.

Individual access

Organisations must respond to access requests within 30 days, extendable in limited cases, at minimal or no cost. They must provide the information in a form the person can understand, explain how it has been used and to whom it has been disclosed, and correct inaccurate information. Refusals must be explained and are limited to grounds set out in the Act, such as information about other people or solicitor-client privilege.

Quebec Law 25 and other provincial laws

Quebec's Act respecting the protection of personal information in the private sector, modernised by Law 25 with obligations phased in between September 2022 and September 2024, is now the strictest privacy law in Canada. It requires a designated person in charge of privacy, published governance policies, privacy impact assessments for certain projects and transfers outside Quebec, privacy by default settings, transparency for automated decisions, a portability right, incident reporting to the Commission d'accès à l'information, and administrative penalties up to C$10 million or 2 percent of worldwide turnover, with penal fines up to C$25 million or 4 percent. A product serving Quebec users needs to meet Law 25 as well as PIPEDA.

Proposed reform: Bill C-36

Canada has twice tried to replace PIPEDA's privacy rules. Bill C-11 (2020) and Bill C-27 (2022) both died when Parliament was dissolved or prorogued. Bill C-36, introduced on 15 June 2026, would enact the Protecting Privacy and Consumer Data Act and repeal Part 1 of PIPEDA. Commentators describe it as largely based on the Consumer Privacy Protection Act from Bill C-27, without the separate AI law that bill contained, and with changes such as a new commissioner model and risk assessment before transfers outside Canada. LEGISinfo listed the bill at second reading in the House of Commons when this guide was reviewed. Its content may change before any enactment, and it would likely have a transition period. Plan on PIPEDA applying for now, and watch the bill's progress.

How to comply, step by step

1. Confirm which laws apply: PIPEDA, Quebec, Alberta or BC laws, and health laws, based on your users and activities.
2. Designate an accountable person and publish contact details.
3. Inventory personal information, purposes, sensitivity, retention and third parties.
4. Review consent against the OPC guidelines, using express consent for sensitive or unexpected uses.
5. Publish a clear privacy policy with layered notices in the product.
6. Implement safeguards proportional to sensitivity.
7. Set up access and correction handling with a 30-day deadline.
8. Build a breach process with RROSH assessment, reporting, notification and a 24-month breach record.
9. Put contracts in place with processors requiring comparable protection and breach notice.
10. Train staff and review annually.

Documentation you will need

• Privacy management program and designated accountable person.
• Personal information inventory and retention schedule.
• Privacy policy and in-product notices.
• Consent records where express consent is used.
• Access request log.
• Breach records for 24 months and OPC reports.
• Processor contracts and assessments.
• Privacy impact assessments, required in Quebec for some projects.

Enforcement and penalties

The OPC investigates complaints and can open investigations on its own initiative. It issues findings and recommendations and can enter compliance agreements, but under PIPEDA it cannot issue fines. Complainants or the OPC can apply to the Federal Court, which can order compliance and award damages. Fines up to C$100,000 apply to specific offences such as failing to report breaches or obstructing investigations. Bill C-36 and its predecessors proposed much larger administrative penalties, and Quebec's Law 25 already has them.

Common mistakes for SaaS and IT companies

• Assuming PIPEDA does not apply to foreign companies.
• Relying on long privacy policies instead of emphasising key elements at the right moment.
• Using implied consent for sensitive data or unexpected secondary uses such as profiling.
• Not keeping records of non-reportable breaches.
• Ignoring Quebec's Law 25 when serving Quebec users.
• Retaining data indefinitely.

Best practices, tools and technologies

• Use layered, just-in-time notices and granular toggles for optional processing.
• Build self-service access, correction and deletion in account settings.
• Encrypt data and restrict access by role.
• Log incidents in a breach register with RROSH assessments.
• Automate retention and deletion.
• Align with ISO/IEC 27701 or the NIST Privacy Framework to structure the program.

We build consent flows, self-service privacy settings and audit logging into web and SaaS platforms through our web application development service.

How PIPEDA relates to other laws

Law or framework	Relationship
GDPR	The EU recognises Canada as adequate for commercial organisations subject to PIPEDA, easing transfers from the EU.
CCPA/CPRA and US state laws	US counterparts; PIPEDA relies more on consent, US laws on opt-outs.
Quebec Law 25	Stricter provincial law with large penalties and transfer assessments.
ISO/IEC 27701	Privacy management system that supports accountability.
SOC 2	Common evidence for vendor safeguards.

Real-world example

A US project management SaaS with Canadian customers, built partly by an Indian development team, designates a privacy officer, adds just-in-time notices for optional analytics, keeps analytics off until users opt in for sensitive features, lets users export and delete their data, keeps a breach register for every incident, and requires its subprocessors to report incidents within 48 hours. Its privacy policy explains that data may be processed in the US and India. For Quebec customers it completes a privacy impact assessment of its transfers.

Next steps

1. Confirm whether PIPEDA and provincial laws apply to you.
2. Designate an accountable person.
3. Review consent and notices against OPC guidance.
4. Set up the breach register and reporting process.
5. Track Bill C-36.

Frequently asked questions

Does PIPEDA apply to companies outside Canada?

Yes, where there is a real and substantial connection to Canada, such as offering services to Canadians and collecting their information.

Does PIPEDA have a size threshold?

No. It applies to organisations of any size engaged in commercial activity.

When must a breach be reported?

As soon as feasible, to the OPC and affected individuals, when it is reasonable to believe the breach creates a real risk of significant harm.

How long must breach records be kept?

24 months after the organisation determines a breach occurred, for all breaches of security safeguards.

Can personal information be stored outside Canada?

Yes, but the organisation stays accountable, must ensure comparable protection by contract and should be transparent; Quebec requires an assessment first.

What is meaningful consent?

Consent based on clear information about what is collected, why, who it is shared with and the risks, with real choices for non-essential uses.

How quickly must access requests be answered?

Within 30 days, with limited extensions.

Can the Privacy Commissioner fine companies?

Not under PIPEDA; it can investigate and go to Federal Court, and fines apply only to specific offences.

Is PIPEDA being replaced?

Bill C-36, introduced in June 2026, would replace its privacy part, but it has not yet passed.

Does Quebec follow PIPEDA?

Within Quebec, its own private sector law, as modernised by Law 25, applies instead, and it is stricter.

Is PIPEDA recognised by the EU?

Yes. The EU recognises Canada's commercial organisations subject to PIPEDA as providing adequate protection.