What Is PIPEDA? Canada's Privacy Law Explained

What Is PIPEDA? Definition and Legislative History

PIPEDA received Royal Assent on April 13, 2000, and came into force in stages between 2001 and 2004. It was Canada's first comprehensive federal privacy law for the private sector, filling a gap left by the Privacy Act (which applies only to federal government institutions). The Act is formally cited as S.C. 2000, c. 5, and is divided into two main parts: Part 1 addresses the protection of personal information in the private sector, while Part 2 deals with electronic documents and amendments to the Canada Evidence Act.

The law was significantly amended in 2015 through the Digital Privacy Act (S.C. 2015, c. 32), which introduced mandatory data breach notification requirements. Under those amendments, organizations must report breaches of personal information to the OPC if the breach creates a real risk of significant harm to affected individuals, notify the affected individuals themselves, and maintain records of all breaches. The amendment also gave the OPC new enforcement powers, including the ability to compel organizations to comply with PIPEDA through Federal Court applications.

As of 2025, PIPEDA remains in effect, but its substantive provisions are expected to be replaced by the Consumer Privacy Protection Act (CPPA) under Bill C-27, which was reintroduced in 2022 and is progressing through Parliament. The CPPA would transform Canada's privacy landscape with significantly higher penalties (up to the greater of $25 million CAD or 5% of global revenue), new rights including data portability and Algorithmic Transparency, and expanded OPC enforcement powers including administrative monetary penalties. Organizations should treat current PIPEDA compliance as the baseline for preparing for the CPPA's more stringent requirements.

Who Does PIPEDA Apply To? Scope and Jurisdiction

PIPEDA applies to every organization that collects, uses, or discloses personal information in the course of commercial activity, unless the activity takes place entirely within a province that has enacted substantially similar privacy legislation. The OPC defines "commercial activity" broadly as any particular transaction, act, or conduct of a commercial character — including selling, bartering, or leasing customer lists.

Organizations Covered by PIPEDA

• Federally regulated organizations — banks, airlines, telecommunications companies, broadcasting, interprovincial transportation, and other federal works, undertakings, or businesses (FWUBs).
• Organizations in non-substantially-similar provinces — all businesses operating in provinces that have not passed their own substantially similar private-sector privacy laws. Currently, Ontario, New Brunswick, Nova Scotia, Prince Edward Island, Newfoundland and Labrador, Saskatchewan, Manitoba, Yukon, Northwest Territories, and Nunavut fall into this category.
• Interprovincial and international data transfers — any organization that transfers personal information across provincial or national borders in the course of commercial activity remains subject to PIPEDA, regardless of the province of origin.
• Cross-border businesses — US companies and other foreign organizations that collect personal information from Canadian residents in connection with commercial activities are subject to PIPEDA's requirements for those Canadian data subjects.

Provincial Laws That Replace PIPEDA

Three provinces have enacted substantially similar privacy legislation that has been recognized by the federal government as replacing PIPEDA for intra-provincial activities:

• Quebec — Act Respecting the Protection of Personal Information in the Private Sector (Law 25, formerly Bill 64), which has been significantly modernized with provisions including privacy impact assessments, data portability, and the right to erasure.
• British Columbia — Personal Information Protection Act (BC PIPA), which applies to most provincially regulated organizations in BC.
• Alberta — Personal Information Protection Act (Alberta PIPA), which covers provincially regulated private sector organizations in Alberta.

In addition, Ontario's Personal Health Information Protection Act (PHIPA) has been deemed substantially similar for health information handling by health information custodians, but Ontario has no substantially similar law for general commercial activities. Organizations in Ontario handling non-health personal information remain fully subject to PIPEDA.

This creates a complex compliance landscape: an organization with operations in Quebec (subject to Law 25), British Columbia (PIPA), and Ontario (PIPEDA) must navigate three distinct regimes. CyberSilo's Compliance Standards Automation solution helps organizations map and manage these overlapping obligations through a single, unified compliance framework.

The Ten Fair Information Principles of PIPEDA

Schedule 1 of PIPEDA outlines ten fair information principles that form the operational heart of the law. Every PIPEDA compliance program must be built around these principles:

Principle 1: Accountability (Section 4.1)

An organization is responsible for personal information under its control and must designate a Privacy Officer or equivalent individual to oversee compliance. This includes responsibility for information transferred to third parties for processing. The Privacy Officer's name or title must be made available upon request.

Principle 2: Identifying Purposes (Section 4.2)

Organizations must identify and document the purposes for collecting personal information before or at the time of collection. Purposes must be limited to what a reasonable person would consider appropriate in the circumstances. If new purposes arise later, fresh consent must be obtained.

Principle 3: Consent (Section 4.3)

Knowledge and consent are required for the collection, use, or disclosure of personal information, except where inappropriate. The OPC has issued detailed guidance on meaningful consent, requiring that organizations: (a) explain the purposes clearly and prominently; (b) inform individuals of the consequences of withholding or withdrawing consent; (c) provide a simple withdrawal mechanism; and (d) obtain express consent for sensitive information. Implied consent may be acceptable only for non-sensitive information used in ways consistent with a reasonable person's expectations.

Principle 4: Limiting Collection (Section 4.4)

Organizations must not collect personal information indiscriminately. Collection must be limited to what is necessary for the identified purposes. The OPC interprets "necessary" strictly — it must be demonstrably required, not merely useful or convenient.

Principle 5: Limiting Use, Disclosure, and Retention (Section 4.5)

Personal information must not be used or disclosed for purposes other than those for which it was collected, except with consent or as required by law. Retention must be limited to the period necessary to fulfill the identified purposes, after which information must be destroyed, erased, or anonymized in a secure manner.

Principle 6: Accuracy (Section 4.6)

Personal information must be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used. Inaccuracy can directly harm individuals (e.g., incorrect credit information or health records), so organizations must implement processes to update information and minimize the risk of error.

Principle 7: Safeguards (Section 4.7)

Personal information must be protected by security safeguards appropriate to its sensitivity. Safeguards must include physical measures (locked filing cabinets, restricted access), organizational measures (employee training, security clearances, need-to-know access), and technological measures (encryption, access controls, audit logs, intrusion detection). The CCCS ITSG-33 framework provides a detailed risk management approach to determining appropriate safeguards.

Principle 8: Openness (Section 4.8)

Organizations must make readily available to individuals specific information about their policies and practices relating to the management of personal information. This typically takes the form of a privacy policy that covers: the name/title of the Privacy Officer; how to access personal information; how to challenge compliance; what information is collected and the purposes; and how information is used, disclosed, and retained.

Principle 9: Individual Access (Section 4.9)

Upon written request, an organization must inform an individual whether it holds personal information about them and provide access to that information. The individual has the right to challenge the accuracy and completeness of the information and request amendments. Organizations must respond to access requests within 30 days (with a possible 30-day extension) and cannot charge excessive fees for access.

Principle 10: Challenging Compliance (Section 4.10)

An individual has the right to challenge an organization's compliance with PIPEDA by contacting the designated Privacy Officer. The organization must investigate all complaints, establish procedures to receive and process them, and inform complainants of the outcome. If the complaint is not resolved to the individual's satisfaction, they may file a complaint with the OPC.

PIPEDA Consent Requirements: Meaningful Consent in Practice

Consent is the linchpin of PIPEDA compliance, and the OPC has made clear that "check-the-box" or buried-in-terms-of-service consent models are insufficient. The OPC's Guidelines for Obtaining Meaningful Consent (2018, updated 2023) establish four core requirements:

• Emphasize key information — organizations must bring important consent information to individuals' attention at the point of collection, not bury it in a privacy policy. This includes what data is collected, with whom it is shared, and any reasonably expected consequences of providing or withholding consent.
• Allow individuals to control the level of detail — provide layered notices that allow users to drill down for more detail while receiving the essential information upfront.
• Provide clear options to say yes or no — consent mechanisms must be clear, prominent, jargon-free, and readily accessible. Pre-checked boxes or opt-out consent models are only appropriate for non-sensitive information used in a manner consistent with reasonable expectations.
• Make consent withdrawal simple — individuals must be able to withdraw consent at any time, subject to legal or contractual restrictions, and the withdrawal process must be as easy as giving consent.

Sensitive information — health data, financial data, biometric data, sexual orientation, political or religious beliefs, and information about minors — requires explicit, opt-in consent. The OPC has also indicated that where a data breach could cause significant harm, the underlying personal information should be treated as sensitive, requiring the higher consent standard.

PIPEDA Data Breach Notification Requirements

Since the 2015 Digital Privacy Act amendments, PIPEDA has required organizations to follow a three-tier breach notification framework:

• Report to the OPC — any breach of personal information that poses a real risk of significant harm to affected individuals must be reported to the OPC. "Significant harm" includes bodily harm, humiliation, damage to reputation, loss of employment, business or professional opportunities, financial loss, identity theft, fraud, or damage to credit records. The OPC must be notified as soon as feasible.
• Notify affected individuals — if the real risk of significant harm threshold is met, organizations must notify every affected individual directly (by mail, email, or telephone). The notification must contain a description of the breach, the personal information involved, steps the organization has taken to mitigate the harm, and contact information for the Privacy Officer.
• Maintain breach records — organizations must keep records of every breach of personal information, regardless of whether it meets the reporting threshold. The OPC can request these records during an investigation or compliance review. Breach records must be retained for a minimum of 24 months after the breach.

Penalties for failing to report a breach or maintain required records can reach $100,000 CAD per violation on summary conviction. Under the proposed CPPA, these penalties would rise dramatically and could be issued as administrative monetary penalties without the need for a criminal prosecution.

How PIPEDA Enforcement Works: OPC Powers and Penalties

The OPC has a graduated enforcement model. Most cases begin with a complaint investigation or a Commissioner-initiated review. If the OPC finds a violation, it may:

• Issue a finding of non-compliance with recommendations for remedial action.
• Enter into a compliance agreement with the organization, which becomes legally binding and enforceable in Federal Court.
• Apply to the Federal Court for an order requiring the organization to correct its practices, publish a notice, or pay damages to affected individuals.
• Publish the organization's name and the details of the non-compliance (naming-and-shaming), which can cause significant reputational harm.

Under current PIPEDA, the OPC cannot directly impose fines — criminal penalties of up to $100,000 CAD per count require prosecution by the Public Prosecution Service of Canada. However, Bill C-27's proposed CPPA would grant the OPC the power to issue administrative monetary penalties of up to the greater of $25 million CAD or 5% of the organization's global revenue for serious violations, a quantum that aligns with the European Union's GDPR and significantly raises the financial stakes for non-compliance.

PIPEDA vs. Quebec Law 25: Key Differences for Multi-Province Organizations

Organizations operating in Quebec and other provinces must navigate the differences between PIPEDA and Quebec's Law 25, which has been substantially modernized. Key distinctions include:

Organizations with operations in Quebec must comply with Law 25 for intra-provincial activities while remaining subject to PIPEDA for interprovincial and international data flows and as FWUBs. CyberSilo's Canada cybersecurity compliance services provide a unified compliance framework that maps both PIPEDA and Quebec Law 25 requirements, eliminating the risk of gaps in either regime.

PIPEDA Enforcement Examples: Lessons from Recent OPC Cases

Understanding how the OPC applies PIPEDA in practice helps organizations prioritize their compliance efforts. Notable enforcement cases include:

• Equifax Canada (2019) — The OPC found that Equifax's use of consumers' personal information for marketing purposes without adequate consent violated PIPEDA. The OPC recommended Equifax obtain express consent for such uses and improve its breach response procedures. Equifax entered into a compliance agreement and implemented the recommended changes.
• LifeLabs (2020) — Following a data breach affecting approximately 15 million customers, the OPC found that LifeLabs had failed to implement adequate safeguards to protect the sensitive personal and health information in its custody. The Federal Court subsequently approved a settlement including a $9.8 million CAD compensation fund for affected individuals.
• Facebook/Cambridge Analytica (2019) — The OPC's investigation found that Facebook failed to obtain meaningful consent from Canadian users whose personal information was shared with the third-party app "This Is Your Digital Life" and subsequently with Cambridge Analytica. The OPC recommended Facebook implement meaningful consent mechanisms and verify that third-party developers have legitimate access to user data.
• Clearview AI (2021) — The OPC, jointly with provincial privacy commissioners, found that Clearview AI's collection of facial images from the internet without consent violated PIPEDA. The OPC ordered Clearview AI to cease collecting and disclosing images of individuals in Canada and to delete existing images. The Federal Court upheld the OPC's finding and imposed a compliance order.

These cases demonstrate that the OPC actively investigates cross-border data flows, third-party data sharing, consent mechanisms, and security safeguards. Organizations subject to PIPEDA should review their own practices against the deficiencies identified in these high-profile cases.

Building a PIPEDA Compliance Program: A Practical Framework

For organizations subject to PIPEDA, establishing a formal compliance program is the most reliable path to meeting the ten fair information principles. CyberSilo recommends the following phased approach:

PIPEDA and Third-Party Data Processors: Vendor Risk Management

Under PIPEDA's accountability principle (Principle 1), an organization remains responsible for personal information that it transfers to a third party for processing — even if the third party is contractually obligated to protect it. This has direct implications for vendor risk management:

• Contractual safeguards — every contract with a third-party data processor must include provisions requiring the processor to provide at least the same level of protection as required under PIPEDA, to use the information only for the specified purposes, and to notify the organization of any breaches.
• Due diligence — organizations must conduct appropriate due diligence on third-party processors before transferring personal information, including assessing the processor's security controls, data handling practices, and privacy policies.
• Cross-border transfers — when personal information is transferred to a US company or other foreign entity, organizations must consider the OPC's guidance on cross-border data transfers, which requires that the organization assess whether the foreign jurisdiction provides adequate protection for the information and, where applicable, implement supplementary measures (contractual clauses, data residency requirements, privacy impact assessments).
• Ongoing monitoring — vendor risk management is not a one-time exercise. Organizations must periodically reassess their processors' compliance posture, particularly following the processor's own security incidents or changes in control.

CyberSilo's Compliance Standards Automation solution includes a vendor risk management module that automates the assessment, contracting, and monitoring lifecycle for third-party data processors under PIPEDA and other frameworks.

The Future of Canadian Privacy Law: Bill C-27 and Beyond

PIPEDA's current form is increasingly viewed as outdated. Bill C-27, the Digital Charter Implementation Act, proposes to replace Part 1 of PIPEDA with three new pieces of legislation: the Consumer Privacy Protection Act (CPPA), the Personal Information and Data Protection Tribunal Act (PIDPTA), and the Artificial Intelligence and Data Act (AIDA). Key changes expected under the CPPA include:

• Higher penalties — up to the greater of $25 million CAD or 5% of global revenue, with a new Personal Information and Data Protection Tribunal to adjudicate appeals.
• New individual rights — data portability, the right to erasure (de-indexing), and the right to withdraw consent at any time.
• Algorithmic transparency — organizations must disclose how automated decision-making systems use personal information to make predictions, recommendations, or decisions that could significantly affect individuals.
• Mandatory privacy impact assessments — PIAs will be required for any activity that poses a significant risk of harm to individuals.
• Simplified consent — the CPPA aims to reduce consent fatigue by allowing organizations to rely on the legitimate interests of the organization or a third party in certain circumstances, similar to GDPR's legitimate interest basis.

While Bill C-27 has not yet passed as of early 2025, organizations should treat its provisions as the future compliance baseline. Privacy programs built to CPPA standards will be well-positioned regardless of the timing of the legislative transition.