Privacy Map

Canada. Comprehensive data protection. Act

PIPEDAPersonal Information Protection and Electronic Documents Act (PIPEDA)

In force

§1Summary

Synopsis

Federal private-sector privacy law built around ten fair information principles (accountability, consent, limiting collection, etc.). It covers personal information handled in the course of commercial activity across Canada, plus employee data of federally regulated businesses, except where a provincial law has been declared substantially similar.

Key themes
  • fair information principles
  • meaningful consent
  • accountability
  • access and correction
  • safeguards
  • breach reporting
  • OPC complaints and Federal Court
Unique features

Principles-based and consent-centric rather than lawful-basis driven; the OPC is an ombudsman without order-making or fining powers, with enforcement via Federal Court applications. Transfers to service providers abroad are treated as a 'use' requiring accountability and transparency, not consent.

SaaS relevance

Any SaaS provider collecting Canadians' personal information in commercial activity with a real and substantial connection to Canada is covered, including foreign providers.

§2Obligations

Extraterritorial
Yes
Breach notification
OPC and individuals as soon as feasible where real risk of significant harm (RROSH); record all breaches 24 months
DPO
Yes
Cross-border transfers
No restriction; accountability via contracts and notice to individuals
Maximum penalty
CAD 100,000 per offence (breach reporting/record-keeping, obstruction)

§3Dates

Key dates
  • Adopted
  • In force
  • Phased: federal works 2001; all commercial activity in provinces without substantially similar law from 2004-01-01; Digital Privacy Act 2015 amendments; mandatory breach reporting from 2018-11-01. Bill C-36 (tabled 2026-06-15) would repeal Part 1.

§4Text and authority

Text
Authority
Office of the Privacy Commissioner of Canada (OPC)

§5Where it applies

Domestic law of
Canada
Also applies in

§6Sources and verification

Sources consulted
Verification

High confidence.

DPO = 'designated individual accountable' under Principle 4.1. EU adequacy (2001 decision) covers PIPEDA commercial organisations only; reaffirmed in Commission's January 2024 review. Bill C-36 pending.