By Daniel de Almeida Afonso · Last updated: October 7, 2026
PIPEDA is the Personal Information Protection and Electronic Documents Act, Canada's federal privacy law for private-sector organizations. It sets the rules for how businesses collect, use, and disclose personal information during commercial activity, and it rests on ten fair information principles. This guide covers who must comply, the ten principles, breach reporting, penalties, recent Privacy Commissioner findings, and the federal bill now before Parliament that would replace the law's privacy rules.
Secure Privacy is a consent management platform, and this guide is written for the privacy, legal, and marketing teams who have to turn PIPEDA into day-to-day practice.
What is PIPEDA and what does it require?
PIPEDA requires organizations to be accountable for the personal information they handle, to obtain meaningful consent, to collect only what they need, to protect it, and to give people access to it. The Office of the Privacy Commissioner of Canada (OPC) describes the law as applying to private-sector organizations that collect, use, or disclose personal information in the course of commercial activity.
The law received Royal Assent in 2000 and came into force in stages, reaching all commercial activity in 2004. The Digital Privacy Act of 2015 added mandatory breach reporting, which took effect on November 1, 2018.
PIPEDA is not a rulebook of technical controls. It is a principles-based law, so regulators judge whether your practices are reasonable for the sensitivity of the data and the purpose of use.
Who does PIPEDA apply to?
PIPEDA applies to private-sector organizations that collect, use, or disclose personal information in the course of commercial activity. It also covers federal works, undertakings, and businesses, including their employee information. The trigger is commercial activity, not company size or legal form.
That wording has three practical effects:
- A for-profit business of any size is covered when it handles personal information commercially.
- A charity or non-profit is covered only if it engages in commercial activity, such as selling a paid service or trading donor lists for value.
- Federally regulated organizations, such as banks, airlines, telecommunications companies, and broadcasters, are covered across Canada, including for their employees' information.
PIPEDA does not apply to:
- Federal government institutions, which fall under the Privacy Act.
- Personal information handled only for personal or domestic purposes.
- Personal information handled only for journalistic, artistic, or literary purposes.
- Business contact information, such as a name, title, work address, or work email, when used only to communicate with someone about their job.
Does PIPEDA apply to companies outside Canada?
It can. The Act is silent on foreign organizations, but the OPC and the Federal Court apply a "real and substantial connection" test. In PIPEDA Findings #2019-005, the OPC took jurisdiction over 411Numbers. The company was incorporated in Hong Kong, but its sole owner ran it from Canada.
The Federal Court went further in A.T. v. Globe24h.com (2017), applying PIPEDA to a Romanian website that republished Canadian court decisions. If you market to Canadians or process their data at scale, plan on PIPEDA being in scope.
How do provincial privacy laws fit in?
Alberta, British Columbia, and Quebec have private-sector privacy laws that the federal government has recognized as substantially similar to PIPEDA. Organizations in those provinces follow the provincial law for personal information collected, used, or disclosed within the province.
PIPEDA still applies when personal information crosses provincial or national borders, and it still applies to federal works in every province. A Quebec retailer selling to customers in Ontario will usually answer to both regimes. Quebec's rules are the most demanding, so read our guide to Quebec's Law 25 if you serve Quebec residents.
Health privacy adds another layer. Ontario's Personal Health Information Protection Act, along with the health information laws of New Brunswick, Nova Scotia, and Newfoundland and Labrador, have been recognized as substantially similar for health information custodians.
| Your situation | Law that generally applies |
|---|---|
| Business operating only in Alberta, B.C., or Quebec | The provincial private-sector law |
| Business in those provinces that sends data across provincial or national borders | Provincial law and PIPEDA |
| Business in Ontario, the Atlantic provinces, the Prairies (outside Alberta), or the territories | PIPEDA |
| Federally regulated business such as a bank or airline | PIPEDA, across Canada |
| Foreign business with a real and substantial connection to Canada | PIPEDA |
This table is a starting point, not legal advice. Sector rules for health, finance, and telecommunications can apply on top of it.
What counts as personal information under PIPEDA?
PIPEDA defines personal information as information about an identifiable individual. Examples include a name, age, ID number, email address, income, ethnic origin, blood type, opinions about a person, medical and employment records, and credit history. The definition is broad on purpose, and online identifiers can qualify when they can be linked to a person.
Sensitivity matters. Health and financial data, for example, call for stronger safeguards and, usually, express consent.
What are the 10 principles of PIPEDA?
The ten fair information principles sit in Schedule 1 of the Act, and compliance is measured against them. Each one is binding on organizations in scope.
- Accountability. Appoint someone responsible for compliance and protect data you transfer to third parties.
- Identifying purposes. State why you collect information at or before the time you collect it.
- Consent. Get meaningful consent for collection, use, and disclosure.
- Limiting collection. Collect only what you need for the stated purposes, by fair and lawful means.
- Limiting use, disclosure, and retention. Use data only for the purposes people agreed to, and keep it only as long as necessary.
- Accuracy. Keep information accurate, complete, and current for its purpose.
- Safeguards. Protect information in proportion to its sensitivity.
- Openness. Make your privacy policies and practices easy to find and understand.
- Individual access. Tell people what you hold about them, how you use it, and let them challenge and correct it.
- Challenging compliance. Run a complaint process and tell people how to escalate to the OPC.
How consent works in practice
Consent must be meaningful, which means people understand what they are agreeing to. Express consent is expected for sensitive information, and implied consent can work for low-risk, reasonable uses. You cannot make consent a condition of service unless the data is necessary for that service.
For websites, consent usually surfaces as a cookie and tracking banner. Our PIPEDA cookie banner guide covers how to set one up, and a consent management platform such as Secure Privacy can store the consent records that prove what each visitor agreed to.
Who owns compliance inside the organization
The accountability principle means a named person must oversee PIPEDA compliance. That person handles access requests, complaints, vendor oversight, and staff training. Many organizations already have this role under another law, and our data protection officer guide explains how to scope it.
Access requests and retention
When someone asks in writing for their information, PIPEDA requires a response within 30 days, with limited extensions allowed. Retention needs a policy. Keep personal information only while it serves the identified purpose, then delete it or anonymize it properly.
What rights do individuals have under PIPEDA?
Individuals can:
- Know why their information is collected, used, or shared.
- Withdraw consent, subject to legal and contractual limits.
- Access their personal information and ask for corrections.
- Expect it to be accurate, complete, and protected.
- File a complaint with the organization and then with the OPC.
When must you report a data breach under PIPEDA?
You must report a breach of security safeguards to the OPC and notify affected individuals when it creates a "real risk of significant harm," often shortened to RROSH. The OPC guidance on breach reporting asks you to weigh two factors: how sensitive the information is, and how likely it is to be misused.
If the threshold is met, three duties follow:
- Report to the OPC as soon as feasible, with the circumstances, date, number of people affected, and steps taken.
- Notify affected individuals, with enough detail for them to reduce their own risk.
- Tell any other organization that can help reduce the harm.
You must also keep a record of every breach, including ones you judge below the threshold, for 24 months. Knowingly failing to report or to keep records is an offence.
How is PIPEDA enforced, and what are the penalties?
The OPC works as an ombudsman. It investigates complaints, can start its own investigations, publishes findings, and negotiates compliance agreements. It cannot issue fines or binding orders.
After an investigation, the complainant or the Commissioner can take the matter to the Federal Court. The court can order an organization to change its practices, publish a notice of the changes, and pay damages to the complainant, including damages for humiliation.
Fines come from the offence provisions in section 28. Knowingly contravening certain obligations, including breach reporting, breach record-keeping, and obstructing an OPC investigation, can bring fines of up to CAD $10,000 on summary conviction and CAD $100,000 on indictment. These are criminal penalties for specific offences, not a per-violation fine for any privacy lapse.
For most organizations the larger costs are an investigation, a public finding, remediation work, and lost customer trust.
What have recent OPC findings shown?
Recent findings show the OPC focusing on consent, retention, and the handling of data for AI and advertising:
- TikTok (September 2025). A joint investigation found that TikTok had not obtained meaningful consent for its handling of data, including for young users. TikTok agreed to stronger age assurance and to stop advertisers from targeting users under 18, with limited exceptions.
- Loblaw (March 2026). The OPC found that Loblaw's retention of data from closed PC Optimum accounts breached retention rules, because removing names and email addresses was not enough to anonymize it.
- OpenAI (May 2026). In a joint investigation with provincial regulators, the regulators found that OpenAI lacked valid consent for broad collection of personal information used to train ChatGPT. OpenAI made commitments, and some provincial regulators left parts of the matter unresolved.
The shared lesson is that "anonymized" data and "publicly available" data are not exempt, and that consent has to match what people would reasonably expect.
Is PIPEDA being replaced?
Not yet, but a replacement bill is moving. Bill C-27, which would have created the Consumer Privacy Protection Act, died when Parliament was prorogued on January 6, 2025.
On June 15, 2026, the government introduced Bill C-36. It would enact the Protecting Privacy and Consumer Data Act, replacing the privacy rules in Part 1 of PIPEDA. Law firm summaries describe a new regulator, the Data Protection Commission of Canada, and administrative monetary penalties of up to the greater of CAD $10 million or 3% of global revenue.
The Parliament of Canada's LEGISinfo page listed the bill at second reading in the House of Commons when we checked. Until it passes and comes into force, PIPEDA remains the law. The bill's provisions may change before then, so check the status before you plan around specific penalty figures.
How does PIPEDA compare to the GDPR?
PIPEDA and the GDPR share core ideas: purpose limitation, consent, security, and individual access. The GDPR is stricter on legal bases, has explicit data subject rights such as erasure and portability, and carries administrative fines. PIPEDA is principles-based and enforced through an ombudsman model. See our full PIPEDA vs GDPR comparison for a side-by-side view.
A practical PIPEDA compliance checklist
- Confirm whether PIPEDA, a provincial law, or both apply to each of your data flows.
- Name the person accountable for privacy and publish their contact details.
- Map the personal information you collect and write down the purpose for each item.
- Set consent mechanisms that match the sensitivity of the data, including cookie consent.
- Write retention rules and delete or properly anonymize data when the purpose ends.
- Prepare a breach response plan, with an RROSH assessment step and a 24-month breach log.
- Set up processes for access requests and complaints, with a 30-day response target.
Secure Privacy publishes a free PIPEDA compliance checklist and a Canada PIPEDA solution page if you want a starting point.
Frequently asked questions
Does PIPEDA apply to small businesses?
Yes. PIPEDA has no size threshold. A sole proprietor selling to customers is covered if the business collects, uses, or discloses personal information in the course of commercial activity, unless a substantially similar provincial law applies instead.
Does PIPEDA apply to non-profits?
Only when they engage in commercial activity. A charity that sells goods or services, or trades donor lists for value, is likely covered. Core charitable activity usually is not. Provincial private-sector laws can reach non-profit activity that PIPEDA does not.
Does PIPEDA apply to companies outside Canada?
It can. The OPC and the Federal Court apply a real and substantial connection test. Foreign organizations that operate from Canada, market to Canadians, or process Canadians' data at scale should assume PIPEDA applies.
Can the OPC fine companies under PIPEDA?
No. The OPC investigates and publishes findings but cannot fine. Fines of up to CAD $100,000 apply only to specific offences, such as knowingly failing to report a breach, and the Federal Court can award damages.
How fast must I respond to an access request?
Within 30 days of receiving the written request, with limited extensions permitted. Going past that window without a valid extension is a contravention.
Is Bill C-27 still in force or pending?
No. Bill C-27 died on the order paper on January 6, 2025. A new bill, C-36, was introduced on June 15, 2026, and PIPEDA remains in force while it is considered.
Bottom line
PIPEDA is Canada's baseline private-sector privacy law. It applies where commercial activity meets personal information, and it works through ten principles that regulators interpret case by case. Build around consent, purpose limits, safeguards, and a tested breach process, and watch Bill C-36.
If you need help with the consent side, Secure Privacy's consent management platform can handle cookie consent and consent records. You can also book a call with the team.
This article is general information, not legal advice. Check the current text of the law and consult counsel for your situation.
