Canada’s federal privacy law, PIPEDA (Personal Information Protection and Electronic Documents Act), has governed the private sector’s handling of personal information since 2004. Yet many Canadian businesses remain unclear about its requirements. This guide explains what PIPEDA actually asks of you, in plain language, with a practical action plan you can finish in a week.
PIPEDA Basics: Who It Covers
PIPEDA applies to private-sector organizations that collect, use, or disclose personal information in the course of commercial activity. A few things make it more complicated than it sounds:
- It covers any organization doing business in Canada, even if you are not Canadian yourself, as long as the activity is commercial.
- It applies to federally regulated industries everywhere in Canada.
- In provinces with their own substantially similar private-sector privacy laws, those provincial laws usually apply instead for provincially regulated businesses. Alberta (PIPA), British Columbia (PIPA), and Quebec (Law 25) are the main examples.
- When personal information crosses provincial or national borders, PIPEDA still applies to the transfer itself.
If you run a Shopify or WooCommerce store selling to Canadians, or a SaaS collecting Canadian customer data, PIPEDA (or the equivalent provincial law) is your starting point.
The 10 Fair Information Principles
Everything PIPEDA requires flows from ten principles. If you understand these, you understand the law:
- Accountability: someone in your organization is responsible for compliance, and you are accountable for data even when a third party processes it.
- Identifying purposes: tell people why you collect their data, before or at the time you collect it.
- Consent: get meaningful consent for collection, use, and disclosure. This is the principle most businesses stumble on.
- Limiting collection: collect only what is needed for the purposes you identified. No data hoarding.
- Limiting use, disclosure, and retention: use data only for the stated purpose, and do not keep it longer than needed.
- Accuracy: keep personal information accurate, complete, and up to date.
- Safeguards: protect data with security measures appropriate to how sensitive it is.
- Openness: publish clear policies about how you handle personal information. This is your privacy policy.
- Individual access: on request, tell people what data you hold about them and how it is used, and let them correct it.
- Challenging compliance: give people a way to raise concerns about your practices, and respond to them.
Read that list again with your own business in mind. Most compliance work is principle 4 (collect less) and principle 7 (protect what you keep).
Meaningful Consent: The Part Everyone Gets Wrong
The Office of the Privacy Commissioner of Canada (OPC) has published detailed guidance on what “meaningful consent” means. The short version:
- Consent must be obtained before or at the time of collection, not buried in a terms page nobody reads.
- It must be understandable. Plain language, not legal walls of text.
- It must be genuine. Pre-checked boxes and take-it-or-leave-it demands for unrelated data are not meaningful consent.
- People can withdraw consent, and withdrawing must be as easy as giving it. After withdrawal, stop collecting and stop using their data, and delete what you no longer have a legal reason to keep.
- Consent is not a one-time event. If you start using data for a new purpose, you need new consent.
If a customer asks “why do you need this?” and the honest answer is “we have always collected it,” that field should probably go.
Safeguards and Retention
Principle 7 requires safeguards appropriate to the sensitivity of the data. Think in three layers:
- Administrative: policies, staff training, least-privilege access to customer data.
- Technical: encryption in transit and at rest, strong authentication, logging, backups that are themselves protected.
- Physical: locked offices and server rooms, controlled access to devices.
Retention ties back to principle 5: keep data only as long as needed for the identified purpose, then delete or anonymize it. Set actual retention periods instead of keeping everything forever, because data you no longer hold cannot be breached or requested.
Breach Notification: When and How
Since the Digital Privacy Act amendments came into force in November 2018, breach rules are mandatory:
- Report to the OPC when a breach of security safeguards creates a real risk of significant harm to affected individuals. Real risk means real likelihood, not a remote possibility. Significant harm includes financial loss, identity theft, damage to reputation, and humiliation.
- Notify affected individuals in the same situation, with enough detail to protect themselves.
- Notify other organizations when they may be able to reduce the harm, such as a bank freezing a compromised account.
- Timing: notification must happen as soon as feasible after you determine the breach occurred. There is no grace period to quietly fix things first.
- Records: you must keep records of every breach of security safeguards, whether or not it poses a real risk of significant harm. The OPC can request these records.
The practical takeaway: you need a breach response plan before a breach, not after. Who decides if there is a real risk? Who contacts the OPC? How do you reach affected customers fast?
Provincial Laws and Quebec’s Law 25
Canadian privacy is not one law, and the map is shifting. British Columbia and Alberta have their own private-sector laws, and Quebec overhauled its regime with Law 25, which has been rolling out in phases and is widely considered the strictest private-sector privacy law in Canada. It adds requirements like privacy officers, privacy impact assessments for certain projects, and tougher consent rules.
If your business operates in Quebec or serves Quebec residents at scale, plan for Law 25 compliance on top of PIPEDA thinking. For most other small businesses, building to PIPEDA’s ten principles is the right foundation.
A 7-Step Action Plan for a Small Business
- Name a privacy lead. Even if it is you. Principle 1 wants a human who owns this.
- Map your data. Write down what personal information you collect, where it lives (email tool, store platform, spreadsheets, support inbox), and who has access.
- Cut what you do not need. Kill unused fields, old lists, and abandoned accounts. This is the highest-leverage step.
- Write a plain-language privacy policy. Publish it where customers can actually find it.
- Fix consent points. Check every form, checkbox, and analytics tool against the meaningful-consent guidance.
- Set retention periods. Decide how long each data type is kept, and schedule deletion or anonymization.
- Write a one-page breach plan. Who decides risk, who calls the OPC, how you notify customers, and where breach records are logged.
Do these seven steps and you will be ahead of most Canadian businesses, most of which are doing none of them.
Selling to customers outside Canada too?
PIPEDA is one of several laws that can apply to the same business. The Global Privacy Law Hub compares GDPR, CCPA, PIPEDA, LGPD, Australia, and UK-GDPR side by side so you can see the full picture at once.
About The Author
