PIPEDA Compliance: Canada's Federal Privacy Law

PIPEDA Compliance: Canada's Federal Privacy Law for Businesses

The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's federal privacy law for private-sector organizations. In force since 2001 and applying to most commercial activity across Canada since 2004, it governs how organizations collect, use, and disclose personal information. PIPEDA is enforced by the Office of the Privacy Commissioner of Canada (OPC) and rests on 10 fair information principles drawn from the CSA Model Code. Websites that track Canadian visitors, run personalized advertising, or collect user data in the course of commercial activity are subject to PIPEDA unless a substantially similar provincial law applies instead.

What Is PIPEDA?

PIPEDA sets the rules for how private-sector organizations handle personal information in the course of commercial activity. "Personal information" covers almost any information about an identifiable individual, including names, email addresses, IP addresses, browsing behaviour, and device identifiers.

The law first applied to federally regulated industries in 2001, then expanded to all private-sector commercial activity in 2004.

Who Does PIPEDA Apply To?

PIPEDA applies to private-sector organizations that collect, use, or disclose personal information in the course of commercial activity, regardless of where the organization is based. A business outside Canada that targets Canadian consumers or operates a website tracking them can fall within scope.

Three provinces have enacted laws the federal government recognizes as "substantially similar": Alberta (Personal Information Protection Act), British Columbia (Personal Information Protection Act), and Quebec (now Law 25). Organizations operating solely within those provinces on intra-provincial matters are generally exempt from PIPEDA and governed by the provincial law instead. Federal works, undertakings, and businesses such as airlines, banks, and telecoms remain subject to PIPEDA regardless of province.

PIPEDA does not apply to:

• Government institutions (covered by the federal Privacy Act)
• Non-commercial activities of non-profit organizations
• Purely personal or domestic uses of personal information
• Journalistic, artistic, or literary purposes where the information is handled solely for that purpose

The 10 Fair Information Principles

Schedule 1 of PIPEDA incorporates the Canadian Standards Association Model Code for the Protection of Personal Information as 10 principles:

1. Accountability: Designate an individual responsible for privacy compliance and make that contact known upon request.
2. Identifying purposes: Identify the purposes for collecting personal information before or at the time of collection.
3. Consent: Obtain the knowledge and consent of the individual, except where inappropriate.
4. Limiting collection: Collect only what is necessary for the identified purposes.
5. Limiting use, disclosure, and retention: Use and disclose only for the purposes collected; retain only as long as necessary.
6. Accuracy: Keep personal information accurate, complete, and up to date.
7. Safeguards: Protect personal information with appropriate security safeguards.
8. Openness: Be transparent about policies and practices for managing personal information.
9. Individual access: Give individuals access to their personal information upon request, and correct it where appropriate.
10. Challenging compliance: Provide a process for individuals to challenge compliance with the above principles.

Consent Under PIPEDA

Consent drives most of PIPEDA. Whether express or implied depends on how sensitive the information is and what the individual would reasonably expect from the interaction.

Express consent is required for sensitive personal information, unexpected uses of data, and disclosure to third parties outside what the individual would reasonably have anticipated.

Implied consent works for less sensitive information where the purpose is obvious, such as using a customer's postal address to deliver a purchase.

The OPC's guidelines on online behavioural advertising (published 2011, last updated 2025) state that opt-out consent is acceptable for OBA involving non-sensitive information, provided the purpose is clearly disclosed at or before collection and an easy opt-out mechanism is available. For sensitive information such as health or financial data, a higher standard applies and opt-out alone is not sufficient.

Consent under PIPEDA must be:

• Given to a specific purpose, not a blanket authorization
• Based on an explanation in plain language the individual can understand
• Withdrawable at any time, with easy means to do so
• Not made a condition of service unless the data is necessary for that service

Cookie Consent and PIPEDA

PIPEDA does not mention cookies explicitly, but cookies and similar trackers that identify individuals are personal information under the Act. The OPC's guidelines on online behavioural advertising treat OBA tracking as personal information requiring meaningful consent, but under PIPEDA that consent can be opt-out rather than express opt-in, subject to conditions.

For websites with Canadian visitors:

• Strictly necessary cookies can generally proceed without consent under the legitimate use exception.
• Advertising and tracking cookies require consent, but opt-out consent is acceptable under PIPEDA for non-sensitive OBA tracking, provided the purpose is clearly disclosed and an opt-out is easy to use. If the technology makes opting out impractical, such as with fingerprinting, opt-out alone is not sufficient.
• Analytics cookies that use anonymized or aggregated data may not require consent, but those that identify users do.
• A cookie banner with a clear notice and an easy way to opt out meets the PIPEDA standard for most advertising cookies.

Quebec's Law 25 is stricter: it requires express opt-in consent for cookies and tracking tools beyond strictly necessary ones, applying to websites with Quebec visitors from September 2023.

Individual Rights Under PIPEDA

PIPEDA gives individuals the right to:

• Know that an organization collects, uses, or discloses their personal information
• Access their personal information and receive a copy (Principle 9)
• Challenge the accuracy of their personal information and have it corrected
• Withdraw consent at any time
• File a complaint with the OPC if their rights are not met

There is no statutory right to erasure comparable to the GDPR's right to be forgotten, though individuals can challenge unnecessary retention and request correction or deletion in some circumstances.

Organizations must respond to access requests within 30 days. Extensions of up to 30 additional days are permitted but require notice to the individual.

Breach Notification

The Breach of Security Safeguards Regulations (SOR/2018-64), in force since November 1, 2018, added breach reporting obligations to PIPEDA:

• Organizations must notify the OPC and affected individuals of any breach involving personal information that creates a "real risk of significant harm" (RRSH).
• RRSH factors include the sensitivity of the information, the probability it has been or will be misused, and the number of individuals affected.
• Notification must happen "as soon as feasible" after the organization determines a reportable breach has occurred; the regulation sets no fixed number of days.
• All breaches, including those below the RRSH threshold, must be recorded and kept for at least 24 months.
• Knowingly failing to notify the OPC of a reportable breach is an offence punishable by a fine of up to CAD $100,000.

PIPEDA vs GDPR: Key Differences

GDPR compliance gets you most of the way to PIPEDA. The main gaps are the implied consent model, no right to erasure, and a more flexible breach notification window. Quebec's Law 25 aligns more closely with the GDPR's opt-in standard.

Bill C-27 and the Future of PIPEDA

The Canadian government introduced Bill C-27 in June 2022 to replace PIPEDA with the Consumer Privacy Protection Act (CPPA) and introduce the Artificial Intelligence and Data Act (AIDA). The CPPA would shift to opt-in consent for non-essential data collection, add data portability and a right of disposal, create a tribunal with binding decision-making power, and raise penalties considerably: administrative penalties up to the higher of 3% of gross global revenue or CAD $10 million, and criminal fines up to the higher of 5% of gross global revenue or CAD $25 million for the most serious violations. Until Bill C-27 receives Royal Assent and the CPPA comes into force, PIPEDA remains the applicable federal law.

PIPEDA Compliance Checklist for Websites

1. Appoint a privacy officer. Designate someone responsible for compliance (Principle 1) and make their contact information available.
2. Document your data collection. Map every category of personal data your site collects, with the purpose and consent basis for each.
3. Scan and categorize cookies. Identify which cookies identify individuals and which are strictly necessary.
4. Deploy a consent banner. For PIPEDA, a clear notice with an easy opt-out meets the standard for non-sensitive OBA cookies. For Quebec visitors, block non-essential cookies until opt-in consent is given under Law 25.
5. Update your privacy policy. Explain what you collect, why, how long you retain it, who you share it with, and how individuals can exercise their rights.
6. Add a consent withdrawal mechanism. A preference centre or persistent opt-out link lets visitors change their choices at any time.
7. Create an access request process. Respond within 30 days and log every request.
8. Prepare a breach response plan. Know how to assess real risk of significant harm, notify the OPC and individuals, and keep breach records for 24 months.
9. Review vendor contracts. Ensure third parties handling personal data on your behalf are contractually bound to protect it.
10. Apply stricter rules for Quebec visitors. Show an opt-in consent banner to visitors in Quebec under Law 25.

How UniConsent Helps With PIPEDA Compliance

UniConsent covers PIPEDA and Quebec Law 25 consent requirements out of the box:

• Cookie banner with geo-targeting that applies the correct consent rules to Canadian visitors and stricter opt-in rules to Quebec visitors automatically.
• Prior blocking of non-essential scripts and cookies for Quebec visitors; opt-out banner for other Canadian visitors.
• Accept all and Reject all in the first layer.
• Consent logs that record each visitor's choices with a timestamp and banner version.
• Preference centre where visitors can review and withdraw consent at any time.
• Google Consent Mode v2 and IAB TCF support for programmatic advertising.
• Privacy portal and DSAR management to receive and respond to access requests within PIPEDA deadlines.

One tag covers PIPEDA, Quebec Law 25, the GDPR, US state privacy laws, and 40-plus other regulations. Get started and launch a compliant consent banner in minutes.

Related Privacy Laws

• GDPR: EU General Data Protection Regulation, learn more at GDPR
• LGPD: Brazil's General Data Protection Law, learn more at LGPD
• PDPA: Thailand Personal Data Protection Act, learn more at PDPA
• CCPA: California Consumer Privacy Act, learn more at CCPA
• CPRA: California Privacy Rights Act, learn more at CPRA

Learn more at Global Privacy Laws