PIPEDA, the Personal Information Protection and Electronic Documents Act, is Canada's federal privacy law for private-sector organizations that collect, use or disclose personal information in the course of commercial activity. Businesses it covers must follow 10 fair information principles, report serious data breaches and keep a record of every breach.
If you sell to Canadians, run a Canadian business or hold Canadian customers' data, PIPEDA is the law to know first, but not always the only one. The Office of the Privacy Commissioner of Canada (OPC) says three provinces have their own private-sector laws, and data that crosses borders brings PIPEDA back in. Here's how to tell which applies to you.
Does PIPEDA apply to your business?
| Your situation | Which law the OPC says applies |
|---|---|
| Private business collecting personal information in commercial activity, in most provinces | PIPEDA |
| Business handling personal information only within Alberta, British Columbia or Quebec | Generally that province's own private-sector privacy law |
| Any business where personal information crosses provincial or national borders | PIPEDA, even in Alberta, BC or Quebec |
| Federally regulated organization (banks, airlines, telecoms, broadcasters, inter-provincial transport) | Always PIPEDA, including employees' information |
| Business in the Northwest Territories, Yukon or Nunavut | PIPEDA, as they're treated as federally regulated |
| Not-for-profits and charities | Generally not, unless they're doing commercial activity outside their core mandate |
The cross-border rule is the one online businesses miss. If you're in Quebec but customer data moves to another province or country in the course of your business, the OPC says PIPEDA applies to it. For Quebec's own regime, my guide to Quebec's Law 25 covers the provincial rules.
The 10 fair information principles
- Accountability: someone in your business is responsible for privacy.
- Identifying purposes: say why you're collecting information before or when you collect it.
- Consent: get meaningful consent for collection, use and disclosure.
- Limiting collection: collect only what you need for the purpose you named.
- Limiting use, disclosure and retention: don't use it for something else, and don't keep it longer than you need.
- Accuracy: keep it accurate enough for its purpose.
- Safeguards: protect it with security that matches its sensitivity.
- Openness: make your privacy practices easy to find and understand.
- Individual access: people can ask what you hold about them.
- Challenging compliance: people can complain, and you need a way to deal with it.
The OPC lists these 10 principles, from Schedule 1 of the Act, as the key responsibilities for businesses. The short explanations after each one are mine; the OPC publishes detailed guidance on each.
What counts as personal information
The OPC defines it broadly: any factual or subjective information, recorded or not, about an identifiable individual. Its examples include age, name, ID numbers, income, opinions, evaluations, comments, employee files, credit records and even a person's intentions, such as planning to buy something or change jobs. That last one matters for marketers: purchase intent data about an identifiable person is personal information.
What PIPEDA doesn't cover
- Business contact information, such as a name, title, work address, phone number or email, used only to contact someone about their job or profession
- Personal information collected purely for personal purposes, like a greeting card list
- Information used solely for journalistic, artistic or literary purposes
- Federal government bodies under the Privacy Act, and provincial or territorial governments
The business contact exemption is narrower than it sounds. It covers using a work email to contact someone about their work. It doesn't turn a list of work emails into a free-for-all for any purpose. For commercial email to Canadians, Canada's anti-spam law, CASL applies on top of PIPEDA.
Breach reporting: the rule with teeth
Under PIPEDA, the OPC says organizations must report to the Privacy Commissioner any breach of security safeguards that poses a real risk of significant harm, notify the affected individuals, and keep records of all breaches, whether or not they pose that risk. You assess real risk of significant harm by looking at how sensitive the information is and how likely misuse is.
Here's the detail most small businesses miss: the law requires you to keep records of every breach for two years, including the small ones you decided not to report. And it's an offence to knowingly break the reporting, notification and record-keeping rules, which could lead to fines. The OPC doesn't fine anyone itself; it can refer cases to the Attorney General of Canada, which could lead to prosecution.
A PIPEDA starter checklist
- Name a person responsible for privacy.
- List what personal information you collect, why, and where it's stored, including outside Canada.
- Update your privacy policy so it explains purposes, consent and how to ask for access.
- Set retention periods and delete what you no longer need.
- Start a breach log today, even if it's empty, and keep entries for two years.
My verdict
For most Canadian small businesses, PIPEDA comes down to five habits: collect less, say why, get consent, protect it, and keep a breach log. If you're in Alberta, BC or Quebec, check your provincial law too, and remember that the moment data leaves the province, PIPEDA is back in play.
If you also have customers in California, our CCPA guide covers the state law that applies once you do.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Frequently asked questions
What is PIPEDA?
PIPEDA is the Personal Information Protection and Electronic Documents Act, Canada's federal privacy law for private-sector organizations that collect, use or disclose personal information in commercial activity.
Does PIPEDA apply in Quebec, Alberta and BC?
Those provinces have their own substantially similar private-sector laws, so organizations there are generally exempt from PIPEDA for information handled within the province. PIPEDA still applies when personal information crosses provincial or national borders.
What are the 10 principles of PIPEDA?
Accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance.
Does PIPEDA apply to non-profits?
The OPC says PIPEDA doesn't generally apply to not-for-profit and charity groups unless they're engaging in commercial activities that aren't central to their mandate.
Must every data breach be reported under PIPEDA?
You must report breaches that pose a real risk of significant harm and notify affected individuals, but you must keep records of all breaches for two years.
Is business contact information covered by PIPEDA?
Not when it's collected, used or disclosed solely to communicate with someone about their employment or profession, according to the OPC.
Who enforces PIPEDA?
The Office of the Privacy Commissioner of Canada oversees it. The OPC doesn't issue fines, but it can refer possible offences to the Attorney General of Canada.
