🇨🇦Personal Information Protection and Electronic Documents Act
A law built around knowledge and consent, not a legal-basis menu
The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's federal private-sector privacy law. It has applied to organisations handling personal information in the course of commercial activity since January 2001, but understanding how it is structured — and why that structure matters — is more useful than knowing the date it came into force.
PIPEDA is built around one central idea: if you want to collect, use or disclose someone's personal information, you generally need their knowledge and consent. Not a legitimate-interest balancing test. Not a broad contractual-necessity gateway. Knowledge and consent. The Act treats consent as the default and lists the specific situations in which information may be handled without it. Layered on top is the reasonable-purposes test in section 5(3): an organisation may collect, use or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances — a ceiling that applies even when consent has been given.
Who the Act covers — and who it doesn't
PIPEDA applies to every organisation that collects, uses or discloses personal information in the course of commercial activities, and to personal information about employees of a federal work, undertaking or business. "Commercial activity" includes the selling, bartering or leasing of donor, membership or fundraising lists. There is no general revenue threshold and no small-business exemption — what matters is whether the handling occurs in the course of commercial activity.
The Act does not apply to a government institution covered by the Privacy Act, to an individual handling information for purely personal or domestic purposes, or to an organisation handling information solely for journalistic, artistic or literary purposes. It also does not apply to business contact information used only to communicate with someone in relation to their employment or profession. Where a province has enacted legislation deemed substantially similar to PIPEDA, organisations in that province may be exempted from PIPEDA for intra-provincial activity — but PIPEDA continues to apply to interprovincial and international flows and to federally regulated workplaces. Do not attribute provincial private-sector statutes to PIPEDA itself; Quebec's Law 25 and the British Columbia and Alberta PIPA regimes are separate laws with their own requirements.
The Act uses an accountability-based role model rather than a controller/processor split. An organisation is responsible for personal information under its control, including information transferred to a third party for processing, and must use contractual or other means to provide a comparable level of protection while a third party processes it (Principle 4.1.3). That responsibility does not transfer away through an outsourcing arrangement.
The consent requirement — and what makes it valid
Principle 4.3 requires the knowledge and consent of the individual for collection, use or disclosure, except where inappropriate. Section 6.1 sharpens this: consent is only valid if it is reasonable to expect that an individual the organisation's activities are directed to would understand the nature, purpose and consequences of what they are consenting to. Consent cannot be obtained through deception (4.4.2), and an organisation may not, as a condition of supplying a product or service, require consent to collection, use or disclosure beyond what is necessary to fulfil the explicitly specified and legitimate purposes (4.3.3).
The form of consent must reflect the sensitivity of the information. Express consent should generally be sought where information is likely to be considered sensitive; implied consent may be appropriate for less sensitive information (4.3.6). Some information — such as medical and income records — is almost always sensitive, but any information can be sensitive depending on context (4.3.4). An individual may withdraw consent at any time subject to legal or contractual restrictions and reasonable notice, and the organisation must inform them of the implications of withdrawal (4.3.8).
The Act then lists the narrow circumstances in which information may be collected, used or disclosed without knowledge or consent — for example, where collection is clearly in the individual's interest and consent cannot be obtained in a timely way, for the investigation of a breach of an agreement or contravention of law, in an emergency threatening life, health or security, or where required by law (sections 7(1)–(3)). These are specific exceptions, not a general flexibility, and several require the organisation to inform the Commissioner or the individual.
Purpose, collection and retention — the limiting principles
Purposes must be identified at or before the time of collection (Principle 4.2), and where information is later to be used for a new purpose, that purpose must be identified and — unless an exception applies — fresh consent obtained before use. Collection is limited to what is necessary for the identified purposes and must be by fair and lawful means (Principle 4.4). Use, disclosure and retention are limited under Principle 4.5: information must not be used or disclosed for purposes other than those for which it was collected except with consent or as required by law, and must be retained only as long as necessary to fulfil those purposes. Information used to make a decision about an individual must be retained long enough to let the individual access it after the decision is made (4.5.2), and section 8(8) requires retention of information that is the subject of an access request for as long as needed to let the individual exhaust any recourse.
Safeguards and the breach-reporting regime
Principle 4.7 requires security safeguards appropriate to the sensitivity of the information, protecting against loss, theft, and unauthorised access, disclosure, copying, use or modification — through physical, organisational and technological measures. A failure of those safeguards is exactly what triggers Division 1.1. Where it is reasonable to believe a breach of security safeguards creates a real risk of significant harm to an individual, the organisation must report to the Commissioner as soon as feasible, notify the affected individual with enough information to let them reduce or mitigate the harm, and notify any other organisation or government institution that could help reduce the risk. "Significant harm" expressly includes bodily harm, humiliation, damage to reputation or relationships, loss of employment or business opportunity, financial loss, identity theft, negative effects on a credit record, and damage to or loss of property. Regardless of whether the threshold is met, section 10.3 requires the organisation to keep and maintain a record of every breach of security safeguards, and to provide those records to the Commissioner on request.
A Canadian subscription business suffered a minor exposure of customer email addresses through a misconfigured analytics tool. The privacy team assessed it, concluded it did not create a real risk of significant harm, and — correctly — decided no report to the Commissioner or notification to individuals was required. What the team did not do was log it. Over the following eighteen months a series of similarly "minor" incidents were each judged below the reporting threshold and each went unrecorded. When a later, larger incident drew a complaint, the Commissioner exercised the power under section 10.3(2) to request the organisation's breach records. There were none. The reporting decisions may have been defensible on their facts, but section 10.3 requires a record of every breach of security safeguards regardless of threshold — and the absence of that record became its own compliance failure, and evidence that the organisation could not demonstrate it was assessing breaches at all.
Individual access, accuracy and challenging compliance
Under Principle 4.9 and section 8, an individual may request access to the personal information an organisation holds about them, an account of how it has been used, and a list of the third parties to which it has been disclosed. The organisation must respond with due diligence and in any case no later than thirty days after receiving the request, may extend that period only on the specific grounds in section 8(4), and is deemed to have refused if it fails to respond in time. Access may be refused only on the limited grounds in section 9 and 9(3) — for example, where granting access would reveal personal information about a third party (which must be severed where possible), would reveal confidential commercial information, or where the information is protected by solicitor-client privilege. Principle 4.6 requires information to be as accurate, complete and up to date as the purposes require, and Principle 4.9 gives the individual the right to challenge accuracy and have information amended.
Principle 4.10 — Challenging Compliance — requires the organisation to have accessible complaint procedures, to investigate all complaints, and to take appropriate corrective measures including amending policies and practices where a complaint is found justified. This sits beneath the statutory complaints route to the Privacy Commissioner.
Enforcement — an ombudsman model, not administrative fines
This is where PIPEDA differs most sharply from the GDPR. The Privacy Commissioner of Canada operates an ombudsman model: the Commissioner investigates complaints, may initiate complaints, may conduct audits where there are reasonable grounds to believe the Act is being contravened, attempts resolution through mediation and conciliation, and issues a report of findings and recommendations. The Commissioner cannot levy administrative monetary penalties. Enforcement instead runs through compliance agreements under section 17.1 and through the Federal Court: after receiving the Commissioner's report, a complainant (or the Commissioner with consent) may apply to the Court, which can order an organisation to correct its practices, order it to publish notice of corrective action, and award damages — including damages for humiliation. Separately, section 28 makes it an offence — punishable by fines up to $100,000 on indictment — to knowingly contravene the breach-reporting, record-keeping or whistleblower-protection provisions, or to obstruct the Commissioner. The practical consequence is that the reputational weight of public findings and the prospect of Federal Court orders, rather than direct regulator fines, drive compliance.
Section 5(3) — Reasonable purposes: information may be handled only for purposes a reasonable person would consider appropriate, even where consent exists.
Section 6.1 and Principle 4.3 — Consent: knowledge and consent required; valid only if the individual can reasonably understand the nature, purpose and consequences.
Principles 4.2, 4.4, 4.5 — Purpose, limiting collection, and limiting use, disclosure and retention across the lifecycle.
Principle 4.1.3 — Accountability for transfers: comparable protection by contractual or other means while a third party processes the information.
Principle 4.7 — Safeguards: physical, organisational and technological protection proportionate to sensitivity.
Principles 4.6, 4.9 and section 8 — Accuracy, individual access and correction; thirty-day response rule; deemed refusal on failure to respond.
Section 9 — Access limits: third-party information must be severed; limited grounds for refusal.
Division 1.1 (sections 10.1–10.3) — Breach reporting to the Commissioner, notification to individuals and other organisations, and record-keeping for every breach.
Sections 11–17.1 — Ombudsman enforcement: complaints, investigation, compliance agreements, Federal Court hearings and remedies.
PIPEDA is not a documentation exercise. It is a principle-based accountability framework with knowledge-and-consent at its core and a reasonable-purposes ceiling above it. Your checklists tell you what to do. This law tells you why: because every purpose must be identified before you collect, every consent must be meaningful and appropriate to sensitivity, every transfer to a processor must carry comparable protection, every access request must be answered within thirty days, and every breach of your safeguards must be recorded — and reported when it could seriously harm someone. The Commissioner will not fine you directly, but a public finding, a compliance agreement, or a Federal Court order awarding damages is the real consequence of getting it wrong.