Meet PIPEDA privacy obligations with less manual effort

PIPEDA is the Personal Information Protection and Electronic Documents Act, Canada's federal privacy law for the private sector. It sets rules for how organisations collect, use and disclose personal information in commercial activity, based on ten fair information principles in Schedule 1. The Office of the Privacy Commissioner of Canada oversees it, investigating complaints and publishing guidance. Since November 2018 it has also required organisations to report certain breaches of security safeguards.

Private sector organisations that collect, use or disclose personal information in the course of commercial activity in Canada must comply with PIPEDA, including foreign businesses with a real and substantial connection to Canada. Federally regulated businesses, such as banks, airlines and telecoms providers, must also apply it to employee data. Where Alberta, British Columbia or Quebec privacy laws apply, those generally govern activity within the province, but PIPEDA still covers interprovincial and international transfers.

The ten PIPEDA fair information principles are accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance. They are set out in Schedule 1 of the Act, which adopts the CSA Model Code for the Protection of Personal Information, and section 5 makes them binding. Together they cover the whole life cycle of personal information, from collection to disposal.

Knowingly contravening certain PIPEDA duties is an offence carrying fines of up to CAD 100,000 on indictment, or up to CAD 10,000 on summary conviction. These offences include failing to report or record a breach of security safeguards, obstructing an investigation and retaliating against whistleblowers. Individuals can also apply to the Federal Court after an OPC investigation, and the court can award damages and order an organisation to change its practices.

Under PIPEDA, an organisation must report a breach of security safeguards to the Privacy Commissioner as soon as feasible when it is reasonable to believe the breach creates a real risk of significant harm to an individual. It must also notify affected individuals and relevant organisations that could reduce the harm. Every breach, whether reportable or not, must be recorded, and the regulations require records to be kept for 24 months.

PIPEDA and GDPR share core ideas such as accountability, consent, purpose limitation, safeguards and individual access rights, so a GDPR programme covers much of PIPEDA. PIPEDA is principles-based and relies more on meaningful consent, while GDPR offers six lawful bases. GDPR also allows far larger administrative fines. The European Commission recognises PIPEDA as providing adequate protection for commercial organisations, which supports data flows from the EU to Canada.

PIPEDA remains in force, but the federal government has tried to replace it more than once. Bill C-11 and Bill C-27, which proposed a Consumer Privacy Protection Act, both died on the order paper. A third bill, Bill C-36, was introduced in June 2026 to enact a Protecting Privacy and Consumer Data Act. Until a new law is passed and in force, organisations must keep complying with PIPEDA.

Yes. OneClickComply supports PIPEDA today. It shares controls with GDPR, ISO 27001 and SOC 2, so evidence you collect once counts across them. OneClickComply helps you organise policies, safeguards, vendor oversight and breach records, but compliance is judged by the Privacy Commissioner and the courts, not by a certificate.