The Personal Information Protection and Electronic Documents Act sets the federal rules for personal information in commercial activity. It applies alongside Law 25 when your data crosses provincial or national borders.
- Type
- Federal law (Canada)
- Full name
- Personal Information Protection and Electronic Documents Act (SC 2000, c. 5)
- Regulator
- Office of the Privacy Commissioner of Canada (OPC)
- Applies to
- Commercial activity across borders and all federally regulated businesses
- Key principle
- Ten fair information principles (Schedule 1)
- Status
- In force; replacement proposed in Bill C-36
What it is
Part 1 of PIPEDA sets ten fair information principles for collecting, using and disclosing personal information in commercial activity: accountability, identifying purposes, consent, limiting collection, limiting use and retention, accuracy, safeguards, openness, individual access and challenging compliance. It includes mandatory reporting of breaches of security safeguards.
Why it exists
To balance individuals’ privacy with the legitimate need of organizations to use information, and to support trust in e-commerce. It is the basis of the European Union’s adequacy decision for Canada, which lets EU data flow to Canadian commercial organizations.
Who it applies to
Private-sector organizations handling personal information in commercial activity across provincial or national borders, and all federally regulated works, undertakings and businesses, including their employee data. In Quebec, Alberta and British Columbia, provincial law governs in-province activity; PIPEDA still covers interprovincial and international transfers.
Authority and enforcement
The Office of the Privacy Commissioner investigates complaints, audits, and enters compliance agreements. Its findings are not binding orders; complainants or the OPC can go to the Federal Court, which can order remedies and damages. Some offences, such as failing to report a breach, carry fines.
- 2000
PIPEDA receives royal assent.
- 2001-01-01
Part 1 applies to federally regulated businesses and to interprovincial and international data flows.
- 2004-01-01
Full application to commercial activity in the provinces.
- 2015-06
Digital Privacy Act (Bill S-4) adds breach provisions, compliance agreements and clarifies valid consent.
- 2018-11-01
Mandatory breach reporting, notification and record-keeping come into force.
- 2020-11-17
Bill C-11 proposes a Consumer Privacy Protection Act; it dies when Parliament dissolves in 2021.
- 2022-06-16
Bill C-27 is introduced; it dies on prorogation on 2025-01-06.
- 2026-06-15
Bill C-36 is introduced to replace Part 1.
Systems and tools
- Safeguards proportionate to the sensitivity of the information
- Breach detection and a breach record kept for 24 months
- Access-request handling within 30 days
Processes
- Meaningful consent; express consent for sensitive information
- Breach reports to the OPC and notices to individuals when there is a real risk of significant harm
- Contracts giving comparable protection when processing is outsourced
Governance
- A designated privacy officer
- A privacy management program with policies and training
- Limits on collection, use and retention
If you do not comply
- Fines up to $100,000 for offences such as knowingly failing to report a breach
- Federal Court orders and damages
- Published OPC findings and reputational harm
- Questions from EU partners relying on Canada’s adequacy status
Announced and upcoming changes
- Bill C-36Introduced 2026-06-15 and at second reading as of 2026-10-03. It would replace Part 1 with the Protecting Privacy and Consumer Data Act.
- TimingEven after royal assent, new obligations are expected to come into force later, after consultation.
Status checked 2026-10-03. Dates can move; confirm with the official sources below.
- PIPEDA (Justice Laws) ↗
- Breach of Security Safeguards Regulations (SOR/2018-64) ↗
- OPC: about PIPEDA ↗
- Office of the Privacy Commissioner of Canada ↗
Related insights
Consumer-driven banking: the security bar for fintechs and payment providers
Canada's open banking regulations were proposed on 2026-06-27. Who must participate, the four accreditation pathways, the security and breach-reporting requirements, and how RPAA-registered PSPs…
Read the insight →The EU’s Digital Omnibus: what proposed GDPR changes could mean for Canadian businesses
The European Commission's Digital Omnibus proposes major GDPR changes, from the definition of personal data to breach deadlines. It is not law yet. Here…
Read the insight →Answering client security questionnaires without starting from zero every time
Security questionnaires eat sales and security time. A practical method to build a reusable answer library, back it with evidence and keep it current.
Read the insight →