What Is PIPEDA?

The Personal Information Protection and Electronic Documents Act is Canada's federal private sector privacy law. It applies to organisations collecting, using or disclosing personal information in the course of commercial activity.

Its structure differs from European law: it is built on ten fair information principles rather than on lawful bases, and it is principles-based rather than prescriptive, which makes it more flexible and less specific.

Consent is the organising concept

Where European law offers six lawful bases, this Act is consent-centred. Consent must be meaningful, which means the individual understands what they are agreeing to, and the form expected — express or implied — depends on the sensitivity of the information.

Sensitive information generally requires express consent. The reasonable person standard sits behind all of it: would a reasonable person consider the purpose appropriate in the circumstances.

Provincial laws displace it

Where a province has legislation deemed substantially similar, that law applies to organisations within the province instead. Quebec, British Columbia and Alberta each have private sector legislation in this category.

Several provinces also have health-specific legislation covering custodians of personal health information. An organisation operating across Canada may face the federal Act, one or more provincial acts and a health statute simultaneously.

Quebec has moved furthest

Quebec's modernised private sector law introduced requirements closer to European standards: a designated privacy officer, privacy impact assessments for certain projects, transparency around automated decision-making, data portability, and substantially higher penalties.

For organisations with Quebec operations this is now the most demanding Canadian regime, and compliance with it generally satisfies the federal Act comfortably.

Breach reporting and the record requirement

Breaches presenting a real risk of significant harm must be reported to the federal Privacy Commissioner and to affected individuals as soon as feasible.

Separately, a record of every breach must be maintained regardless of whether it met the reporting threshold, and the Commissioner may request those records. That second obligation is widely overlooked and is straightforward to satisfy prospectively and impossible retrospectively.

Enforcement, and where it is heading

The federal Commissioner investigates complaints and issues findings and recommendations, with limited direct penalty powers compared with European authorities.

Reform proposals have repeatedly sought to add administrative monetary penalties and stronger enforcement. Quebec's regime already includes substantial penalties, which is a reasonable indication of the direction.

Cross-border transfers and the accountability model

Canadian law permits transfers outside the country and holds the transferring organisation accountable for the information throughout. There is no adequacy mechanism equivalent to the European one.

What is required is comparable protection through contractual means, and transparency: individuals should be informed that their information may be processed in another jurisdiction and may be accessible to foreign authorities. Quebec’s regime adds an assessment requirement before certain transfers.

Where to start

Establish which regime actually applies to you — federal, provincial, health-specific, or several at once. Organisations operating in more than one province frequently assume the federal Act covers them when it does not.

See the compliance guide, notification by province and Quebec Law 25. GuardsArm delivers PIPEDA compliance.