PIPEDA
Personal Information Protection and Electronic Documents Act
Key Facts
Overview
PIPEDA is Canada's federal private-sector privacy law, based on 10 fair information principles. It requires express consent for sensitive information and allows implied consent for less sensitive data. The proposed replacement (CPPA) died in January 2025, with a new bill expected carrying penalties up to CAD $25M or 5% of global revenue.
What This Means for Your Website
- Meaningful consent is required: express for sensitive data, implied for non-sensitive data where that matches reasonable expectations
- OPC guidance specifically addresses cookies and online behavioral advertising
- A designated privacy officer must be accountable for compliance
- Breach notification is required for breaches posing real risk of significant harm
- PIPEDA does not apply in Quebec, Alberta, or BC for intra-provincial commercial activities. Quebec is covered instead by Law 25, which sets a stricter consent bar than PIPEDA and reaches any business handling the personal information of Quebec residents
Key Requirements
The OPC investigates complaints and issues findings and recommendations, but it cannot impose fines. After an OPC investigation, the complainant or the OPC can apply to the Federal Court, which can order compliance and award damages. Fines of up to CAD $100,000 apply only to specific offences, such as knowingly failing to report a breach or obstructing an investigation, and are imposed by a court. Access requests must be answered within 30 days. The expected replacement bill would increase penalties to CAD $25 million or 5% of global revenue. PIPEDA applies federally but yields to substantially similar provincial legislation.
How ConsentStack Handles This
ConsentStack detects Canadian visitors and applies PIPEDA-compliant consent with express opt-in for sensitive data categories, supporting the meaningful consent standard.
Penalties
The OPC cannot fine. Fines of up to CAD $100,000 apply to specific offences prosecuted in court, such as knowingly failing to report a breach of security safeguards or obstructing an investigation; the Federal Court can order compliance and award damages.
Key Requirements
- Obtain meaningful consent: express for sensitive information, implied for non-sensitive
- Identify purposes at or before collection
- Limit collection to what is necessary
- Safeguard personal information with appropriate security
- Provide individuals access to their personal information
- Designate a privacy officer accountable for compliance
Notable Provisions
- CPPA (Bill C-27) died January 2025
- New bill expected with CAD $25M or 5% revenue penalties
- Does not apply in Quebec, Alberta, BC for intra-provincial activities
Data Subject Rights
Withdraw consent to the collection, use or disclosure of your personal information at any time, subject to legal or contractual restrictions and reasonable notice, and be told the implications of withdrawing; the Act sets no response period.
On a written request, learn whether an organization holds your personal information, how it has been used, and get access to it at minimal or no cost; the deadline may also be extended for the time needed to convert the information into an alternative format.
As part of an access request, get an account of the third parties your personal information has been disclosed to; the Act recommends that it be as specific as possible, and where a list of actual recipients is not possible the organization must list the organizations it may have disclosed it to.
Challenge the accuracy and completeness of your personal information and have it corrected, deleted or added to as appropriate, with the amended information passed to third parties that have access to it where appropriate.
Raise a compliance challenge with the person accountable for the organization's compliance with PIPEDA's principles; it must investigate every complaint and, if the complaint is justified, take appropriate measures (amending its practices if necessary), and the Act sets no response period.
File a written complaint with the Privacy Commissioner of Canada (within six months, or longer if the Commissioner allows, for a refused or unanswered access or correction request), then, after the report or a discontinued investigation, ask the Federal Court for a hearing on the matters section 14 lists.
Related Regulations (3)
Other North America Regulations
Frequently Asked Questions
Stay compliant with PIPEDA
ConsentStack helps you implement Opt-in consent for Canada (Federal) automatically.