PIPEDA
PIPEDA is Canada’s federal private-sector privacy law, which governs how businesses collect, use, and disclose personal information in the course of commercial activity.
The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to businesses across Canada that handle personal information in commercial activities, unless a province has enacted substantially similar legislation (as Quebec, BC, and Alberta have for their private sectors). It is built around 10 fair information principles, including accountability, meaningful consent, limiting collection, and safeguards.
PIPEDA is enforced by the Office of the Privacy Commissioner of Canada (OPC). Since 2018 it has required organizations to report breaches "of security safeguards" that pose a real risk of significant harm to both the OPC and affected individuals, and to keep records of all breaches.
A planned modernization, the Consumer Privacy Protection Act (CPPA) under Bill C-27, died on the Order Paper when Parliament was prorogued in January 2025, so PIPEDA remains the law in force.
