What is PIPEDA, and does it apply to my business?

What is PIPEDA?

PIPEDA is the Personal Information Protection and Electronic Documents Act, Canada's federal law governing how private-sector organizations handle personal information during commercial activities. It sets the baseline rules for collecting, using, disclosing, retaining, and protecting personal information across the country, and it is overseen by the Office of the Privacy Commissioner of Canada (OPC).

Personal information under PIPEDA means information about an identifiable individual — names, contact details, ID numbers, financial and health information, online identifiers, and more. Commercial activity means any transaction, conduct, or regular course of business that is commercial in character, including selling, bartering, or leasing.

PIPEDA is built on ten fair information principles: accountability; identifying purposes; consent; limiting collection; limiting use, disclosure, and retention; accuracy; safeguards; openness; individual access; and challenging compliance. These principles, rather than a rigid checklist, define what compliance looks like in practice.

Does PIPEDA apply to my business?

PIPEDA applies to most private-sector organizations that collect, use, or disclose personal information in the course of commercial activity anywhere in Canada — including sole proprietors, small businesses, charities that engage in commercial activity, and large enterprises. There is no revenue or headcount threshold: a one-person consultancy handling customer data is covered just as a national retailer is.

It always applies to federally regulated businesses — such as banks, airlines, telecommunications and broadcasting companies, and interprovincial transportation — including how they handle employee personal information.

PIPEDA also governs the interprovincial and international flow of personal information, so it reaches transactions and data transfers that move between provinces or in and out of Canada, even where a provincial law otherwise applies within a province.

• You sell products or services to customers in Canada and collect their information.
• You operate a website or app that gathers personal information from Canadian users.
• You are a federally regulated business (banking, telecom, transportation, broadcasting).
• You transfer personal information across provincial or national borders in the course of business.

When does PIPEDA NOT apply — and what replaces it?

PIPEDA does not apply where a province has enacted private-sector privacy legislation that the federal government has declared substantially similar, and the activity in question takes place wholly within that province. There, the provincial law governs intra-provincial commercial activity instead — though PIPEDA still applies to interprovincial and international data flows and to federally regulated workplaces in that province.

Quebec's Law 25 (which amended the province's Act respecting the protection of personal information in the private sector) is the most prescriptive of these, imposing requirements such as a designated person in charge of privacy, mandatory privacy impact assessments for certain projects, and strict consent and transfer rules. British Columbia and Alberta each have a Personal Information Protection Act (PIPA) covering their private sectors.

PIPEDA also does not cover personal information handled purely for personal, domestic, journalistic, artistic, or literary purposes. Public-sector personal information is governed by separate federal and provincial public-sector privacy statutes rather than by PIPEDA.

• British Columbia — Personal Information Protection Act (PIPA BC)
• Alberta — Personal Information Protection Act (PIPA Alberta)
• Quebec — Law 25 (amending the Act respecting the protection of personal information in the private sector)
• Health information in several provinces is also governed by sector laws such as Ontario's PHIPA

What does PIPEDA require you to do?

At a minimum, PIPEDA requires you to be accountable for the personal information you hold and to handle it in line with the ten principles. In practice that means a defined set of obligations you can build into normal operations rather than treat as a one-time project.

Mandatory breach reporting is a key obligation: if a breach of security safeguards creates a real risk of significant harm to an individual, you must report it to the OPC, notify affected individuals, and keep records of all breaches — even those you do not report.

• Appoint someone accountable for privacy compliance in your organization.
• Obtain meaningful consent and clearly identify why you collect personal information.
• Collect only what you need, and limit use, disclosure, and retention to those purposes.
• Protect personal information with safeguards appropriate to its sensitivity.
• Publish a clear, accessible privacy policy and respond to individual access requests.
• Report breaches that pose a real risk of significant harm, notify affected individuals, and log all breaches.

What happens if you do not comply?

Non-compliance can trigger OPC investigations following individual or commissioner-initiated complaints, leading to public findings. For certain breaches — such as failing to report a reportable breach or destroying records to evade an investigation — PIPEDA contains offence provisions that carry fines on conviction.

The harder costs are often commercial and reputational. Customers, enterprise buyers, healthcare organizations, and government procurement teams increasingly require evidence of sound privacy practices before they will do business. A mishandled breach or a public OPC finding can erode trust far beyond any statutory penalty.

Canada's privacy framework is also evolving: federal reform has been proposed that would raise the bar and introduce significant administrative monetary penalties, so building good practices now positions you well for stricter requirements ahead.