PIPEDA Basics

PIPEDA — the Personal Information Protection and Electronic Documents Act — is Canada's federal private-sector privacy law. It governs how organizations collect, use, and disclose personal information in the course of commercial activities.

Who PIPEDA Applies To

PIPEDA applies to private-sector organizations that collect, use, or disclose personal information in the course of commercial activities. This includes most businesses operating in Canada, regardless of size. Federal works, undertakings, and businesses (banks, airlines, telecommunications companies) are subject to PIPEDA regardless of province.

Quebec, Alberta, and British Columbia have substantially similar provincial privacy laws that apply to provincially regulated organizations in those provinces.

The Ten Principles

PIPEDA is built on ten fair information principles derived from the CSA Model Code: accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and challenging compliance.

Individual Rights Under PIPEDA

• The right to know what personal information an organization holds about you
• The right to access that information
• The right to challenge its accuracy
• The right to withdraw consent
• The right to complain to the Privacy Commissioner

PIPEDA and Proposed Privacy Reform

Bill C-27, which proposed replacing PIPEDA with the Consumer Privacy Protection Act (CPPA), was introduced in 2022 but did not pass. It died when the 44th Parliament ended in January 2025. PIPEDA remains the current federal private-sector privacy law in Canada. In 2026, the federal government introduced Bill C-36 as a new proposed privacy and consumer-data framework. Bill C-36 has not passed and is not law. Because proposed legislation can change, learners should consult current official federal sources for the latest status.