What is PIPEDA?
PIPEDA is Canada’s federal law for how private-sector organisations collect, use and disclose personal information in commercial activity. It is principles-based: its Schedule 1 sets out ten fair information principles drawn from a national standard.
Who does it apply to?
Private-sector organisations that handle personal information in the course of commercial activity across Canada, and federally regulated businesses, such as banks, airlines and telecoms, for their employees. Provinces with “substantially similar” laws, namely Quebec, Alberta and British Columbia, apply their own private-sector laws within the province. PIPEDA still applies to cross-border and interprovincial transfers. Quebec’s Law 25 adds stricter, GDPR-like duties there.
The ten principles
- Accountability
- Identifying purposes
- Consent
- Limiting collection
- Limiting use, disclosure and retention
- Accuracy
- Safeguards
- Openness
- Individual access
- Challenging compliance
Key duties
- Obtain meaningful consent appropriate to the sensitivity of the information. Consent must be express for sensitive data.
- Protect personal information with security safeguards appropriate to its sensitivity.
- Give individuals access to their information and let them challenge its accuracy.
- Breach reporting: report to the OPC, and notify affected individuals, when a breach of security safeguards creates a real risk of significant harm. Keep records of all breaches.
- Remain accountable for information transferred to service providers, including abroad, through contracts and other means.
How does it relate to other frameworks?
Canada has an EU adequacy decision for organisations subject to PIPEDA. Reform proposals to replace it with a new consumer privacy law have been introduced in the past; check the OPC for the current position.
Sources and official references
- PIPEDA overview — Office of the Privacy Commissioner of Canada (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with Parliament of Canada; overseen by the Office of the Privacy Commissioner of Canada (OPC).
