Any information about an identifiable individual — including name, address, email, date of birth, or any combination of data that, alone or together, identifies a specific person.
In Canada, the definition of personal information is broad. Under PIPEDA (the Personal Information Protection and Electronic Documents Act), personal information includes any factual or subjective information, recorded or not, about an identifiable individual. This covers obvious identifiers like names and SINs, but also less obvious ones like IP addresses, location data, or combinations of attributes that together identify someone.
The key test is identifiability: if information can be used — alone or combined with other available information — to identify a specific person, it is personal information and subject to privacy protections.
Example: A dataset containing postal code, age, and gender may seem anonymous. But research has shown that these three attributes together can uniquely identify a large percentage of Canadians. This combination is personal information even though no name is included.
Organizations that collect, use, or disclose personal information in Canada must comply with applicable privacy legislation. This is not legal advice — consult a qualified privacy professional for specific guidance.