PIPEDA
Also known as: Personal Information Protection and Electronic Documents Act, Canadian privacy law, CPPA
PIPEDA (the Personal Information Protection and Electronic Documents Act) is Canada's federal privacy law for the private sector, governing how organizations engaged in commercial activities collect, use, and disclose personal information.
It is based on ten fair information principles drawn from the CSA Model Code. Two earlier bills to replace it (C-11 and C-27) died in Parliament. As of late 2026, a third, Bill C-36, would replace PIPEDA's privacy rules with the Protecting Privacy and Consumer Data Act, but PIPEDA remains in force until it passes.
PIPEDA, explained at three levels
At home
PIPEDA is Canada's main privacy law for private businesses. It says that when a company collects information about you (your name, email, purchase history) they must tell you why, get your consent, keep it secure, and only use it for the stated purpose. You have the right to access the information they hold about you and ask for corrections. Companies that misuse your data can face investigations by the Privacy Commissioner of Canada.
At work
PIPEDA applies to your organization if you collect, use, or disclose personal information in the course of commercial activities. This includes any business that operates across provincial boundaries or in provinces without substantially similar legislation. Federally regulated businesses, such as banks, telecommunications companies, and airlines, are always subject to PIPEDA regardless of province.
At home
PIPEDA's ten fair information principles are: accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and challenging compliance. Accountability is the foundation: organizations must designate an individual responsible for compliance (often a Chief Privacy Officer) and implement policies and practices to give effect to all ten principles.
At work
The Office of the Privacy Commissioner of Canada (OPC) enforces PIPEDA. The OPC investigates complaints, conducts audits, and issues findings and recommendations, but under PIPEDA, the OPC cannot impose fines directly. Individuals unsatisfied with an OPC finding can apply to the Federal Court for a remedy including damages. PIPEDA's breach notification requirements (added in 2018) require organizations to notify affected individuals and the OPC of breaches posing a real risk of significant harm.
At home
PIPEDA defines 'personal information' broadly as any information about an identifiable individual, excluding business contact information used in a professional capacity. Sensitive information (health data, financial records, racial or ethnic origin) requires a higher standard of protection and express consent. The 'real risk of significant harm' threshold for breach notification considers the sensitivity of the information, the number affected, and whether it was encrypted.
At work
From a practitioner standpoint, PIPEDA's EU adequacy status is a commercial asset: personal data can flow from the EU to organizations covered by PIPEDA without extra contracts such as Standard Contractual Clauses, and the European Commission's January 2024 review confirmed that status. Transfers out of Canada work differently: PIPEDA holds the sending organization accountable, so contracts must give the data comparable protection. Bill C-36 would replace OPC recommendations with a commission able to issue binding orders, with penalties of up to C$10 million or 3% of global revenue.
Real-world examples
At home
Marcus bought a jacket from a Canadian outdoor retailer online. Six months later he started receiving marketing emails he did not consent to. Under PIPEDA, Marcus can withdraw his consent to marketing, ask the retailer what personal data it holds about him, and file a complaint with the Office of the Privacy Commissioner of Canada. The unwanted emails may also breach Canada's Anti-Spam Legislation (CASL).
At work
The legal team at a Toronto-based fintech company reviewed their data sharing agreements with US analytics partners after their Privacy Officer flagged that personal data was being transferred to the US without adequate safeguards. They updated their contracts to require US partners to apply PIPEDA-equivalent protections and added consent language to the app's onboarding flow.
How it compares
| Feature | PIPEDA | GDPR | CCPA |
|---|---|---|---|
| Jurisdiction | Canada (federal, private sector) | European Union | California, USA |
| Enforcement | Privacy Commissioner recommends; Federal Court awards damages | Supervisory authorities: fines up to 4% of global revenue | California AG and CPPA, up to about $7,500 per intentional violation (adjusted for inflation) |
| Consent model | Express or implied based on sensitivity | Freely given, specific, informed, unambiguous | Opt-out for data sales; opt-in for sensitive data |
| Individual rights | Access, correction, complaint | Access, correction, erasure, portability, objection | Know, delete, opt-out, non-discrimination |
| Breach notification | Real risk of significant harm threshold | 72 hours to supervisory authority | Unreasonable delay standard |
PIPEDA is generally considered less prescriptive and less stringently enforced than GDPR but provides stronger rights than many US state laws. Bill C-36, tabled in 2026 after Bill C-27 died, would bring Canadian law closer to GDPR in rights, obligations, and penalties if passed.
For analysts
In BA artefacts for Canadian operations, PIPEDA requirements appear as consent management requirements, data minimization constraints, and breach response process requirements. Document the purpose and type of consent for each category of personal data collected, the retention period, and the third parties it will be shared with. Treat PIPEDA consent as an ongoing obligation: purposes must be communicated at or before collection, and new purposes require fresh consent. Useful NFR: 'The registration flow must present a clear statement of purpose for each category of personal data collected, with distinct opt-in controls for optional data uses, before account creation is completed.'
History & origin
PIPEDA received royal assent in April 2000 and came into force in stages starting January 1, 2001, first applying to federally regulated businesses. From January 2004 it applied to all commercial activity in provinces without substantially similar private-sector laws (Quebec, British Columbia, and Alberta have their own). The law was designed partly so Canada's protections would be judged 'adequate' under the EU's 1995 Data Protection Directive, and the European Commission granted that adequacy decision at the end of 2001. Reform attempts followed: Bill C-11 (2020) and Bill C-27 (2022), which would have created the Consumer Privacy Protection Act, both died when Parliament was dissolved or prorogued. In June 2026 the government tabled Bill C-36, the Protecting Privacy and Consumer Data Act, its third attempt.