Personal Information Protection and Electronic Documents Act
Canada's federal private-sector privacy law, governing how organisations collect, use and disclose personal information in the course of commercial activity. It takes a principles-based approach built around meaningful consent and accountability.
Who it applies to
- Private-sector organisations conducting commercial activity in Canada
- Organisations transferring personal data across provincial or national borders
- Federally regulated businesses across all provinces
Key requirements
- Meaningful, informed consent for collection, use and disclosure
- Limiting collection to what's necessary for identified purposes
- Safeguards proportionate to the sensitivity of the information
- Breach reporting to the OPC where there's real risk of significant harm
- Individual access to, and correction of, their own personal information
Maximum penaltyFines up to CAD $100,000 per violation under certain provisions, with reform proposals seeking higher caps
Official resources
Praeferre's summary is a starting point, not legal advice. For the authoritative text and current guidance, go directly to the governing body.
Questions we get asked
PIPEDA applies to: Private-sector organisations conducting commercial activity in Canada; Organisations transferring personal data across provincial or national borders; Federally regulated businesses across all provinces.
The core obligations are: Meaningful, informed consent for collection, use and disclosure; Limiting collection to what's necessary for identified purposes; Safeguards proportionate to the sensitivity of the information; Breach reporting to the OPC where there's real risk of significant harm; Individual access to, and correction of, their own personal information. Each is summarised in plain English above, with a link to the official text.
Effective: 2001, with ongoing amendments. Regulator: Office of the Privacy Commissioner of Canada (OPC).
Fines up to CAD $100,000 per violation under certain provisions, with reform proposals seeking higher caps.
Praeferre's GRC Automation engine monitors the policies, document repositories and web pages that carry your risk under PIPEDA, on a cadence you set, and turns every scan into an audit trail you can put in front of an auditor or regulator. Alongside it, rights requests and consent records sit in Consents Manager.
See how Praeferre automates PIPEDA compliance
Continuous monitoring, evidence and reporting for PIPEDA — alongside every other framework you need to satisfy.