PIPEDA

What is PIPEDA?

PIPEDA, the Personal Information Protection and Electronic Documents Act, is Canada's federal private-sector privacy law. It sets rules for how organisations obtain consent for, collect, use, disclose and safeguard personal information. The Parliament of Canada enacted it in 2000, and it applies to organisations that handle personal information in the course of commercial activities.

The Act is S.C. 2000, c. 5. Its consolidated text is on the Justice Laws website, last amended on 4 March 2025, and the Privacy Commissioner of Canada oversees it.

A replacement is before Parliament. Bill C-36 would enact a new Protecting Privacy and Consumer Data Act and amend PIPEDA. It had its first reading in the House of Commons on 15 June 2026 and awaits second reading, so PIPEDA remains the law to cite.

Why it matters

A Canadian customer sends a privacy schedule. It names PIPEDA, and nobody on your side can say whether the Act applies to you, to them, or to both.

That uncertainty is the usual first encounter. Three pressures sit behind it:

• Canadian customers and partners. Contracts and due-diligence questionnaires may name PIPEDA and expect you to show how you handle consent, access requests and security.
• Cross-border data flows. Provinces with their own similar laws are exempt only for activity inside the province, so data that crosses a provincial or national border can carry PIPEDA duties with it.
• UK transfers. The UK's adequacy regulations for Canada are only partial, so a UK exporter has to check the Act applies before relying on them (see the UK position below).

Partial adequacy is not adequacy for the whole country.

Who it applies to

PIPEDA is a private-sector law. For an organisation within its scope it is mandatory: it is statute, not a voluntary standard, and there is no certification to hold. It covers personal information an organisation collects, uses or discloses in the course of commercial activities, and employee data in federally regulated businesses such as banks and airlines.

It does not apply to federal government institutions covered by the Privacy Act, to purely personal use, or to journalistic, artistic or literary work. The Act does not say where an organisation must be based, so whether it reaches a firm with no presence in Canada is a question for legal advice.

Quebec needs separate attention. Quebec, Alberta and British Columbia have their own private-sector privacy laws, and exemption orders under the Act take activity inside those provinces out of PIPEDA. Data that crosses their borders stays within it.

For an ISO 27001 holder, the link is narrow. PIPEDA does not require ISO 27001, but its safeguards principle asks for security suited to the sensitivity of the information, and an ISMS is one credible way to show that. The nearest Annex A control is A.5.34 Privacy and protection of PII.

The UK position

A UK firm meets PIPEDA when it sends personal data to Canada, or receives it from there. Under UK GDPR Chapter V, the UK has adequacy regulations for Canada, but they are partial. The ICO says that if you intend to rely on them, you must check that PIPEDA will apply to the personal information you are transferring.

That has two practical consequences:

• Canadian commercial recipients. Adequacy works only where PIPEDA applies to the recipient. If it does not, you need appropriate safeguards or an exception.
• Canadian public bodies. PIPEDA does not apply to them, so transfers to them fall outside the adequacy regulations and need the same fallback.

For a UK firm of 25 to 250 people, the first encounter is usually a Canadian customer or a supplier in Canada, not a regulator.

Key requirements

PIPEDA works through ten fair information principles, set out in Schedule 1 of the Act. They cover the life of a piece of personal information, from the decision to collect it to the moment someone asks to see it:

• Accountability. The organisation is responsible for the personal information it controls and names someone accountable for compliance.
• Identifying purposes. State why you collect personal information at or before the time you collect it.
• Consent. Get the person's knowledge and consent to collect, use or disclose it, except where that would be inappropriate.
• Limiting collection. Collect only what the stated purposes need.
• Limiting use, disclosure and retention. Use and disclose it only for those purposes, and keep it only as long as they need.
• Accuracy. Keep it as accurate, complete and up to date as its purposes need.
• Safeguards. Protect it with security suited to its sensitivity.
• Openness. Make your privacy policies and practices easy to find.
• Individual access. On request, tell people what you hold about them and how it is used, give them access, and let them challenge its accuracy.
• Challenging compliance. Let people raise a complaint with the person accountable for compliance.

The Act adds duties of its own:

• Breach reporting. Report a breach of security safeguards to the Commissioner, and tell the people affected, where it creates a real risk of significant harm.
• Complaints and audits. The Commissioner investigates complaints and can audit an organisation's practices. A complainant can then take the matter to the Federal Court.

A privacy notice that nobody can trace to a purpose, a consent or a named owner is a document, not a control.

For the exact wording of each principle and its obligations, read the Act itself on the Justice Laws website.

Frequently asked questions