PIPEDA (PIPEDA)
Canada’s Personal Information Protection and Electronic Documents Act, the federal private-sector privacy law.
Overview
PIPEDA governs how private-sector organisations collect, use and disclose personal information in commercial activity, based on ten fair information principles including consent, limiting use and safeguards. It requires breach reporting where there is a real risk of significant harm. Some provinces have substantially similar laws that apply instead.
As primary legislation it is binding law; regulators fill in and interpret its detail through rules, guidance and supervisory practice. The authorities most closely connected to it are OPC. It is often read together with Provincial privacy laws.
Check the official sources below for legal scope, applicable dates and exceptions. This entry is an explanatory reference, not legal advice.
Why it matters
It is the baseline privacy law for most Canadian businesses.
Who it affects
Private-sector organisations in Canada and those handling Canadians’ data.
Where it sits
Ten linked steps connect where you operate to the proof that you complied.
- 01Jurisdiction
- 02Industry
- 03Activity
- 04Authority
- 05Regulation
- 06Requirement
- 07Guidance
- 08Control
- 09Evidence
- 10Enforcement
Connections
The terms most closely tied to PIPEDA. Select one to open it.
What to do about it
- 1Confirm whether you are in scope: who it covers, which activities and where.
- 2Break it into testable requirements.
- 3Map each requirement to a control and an owner.
- 4Track amendments, implementing rules and guidance.
- 5Keep sealed evidence for every control run.
From requirement to evidence.
PIPEDA is mapped alongside provincial privacy laws, with overlaps and differences flagged.
Request early access →