PIPEDA is Canada’s federal privacy law for the private sector. It sets the rules for how businesses collect, use, and disclose personal information in the course of commercial activity.
It became law in 2000 and has applied in full since 2004. In 2026 it’s still the law in force. The proposed law meant to replace it, the CPPA, never passed. More on that below.
If your website collects names, emails, payment details, or analytics data from people in Canada, PIPEDA probably applies to you.
What is the Personal Information Protection and Electronic Documents Act (PIPEDA)?
PIPEDA protects personal information that businesses handle. Personal information means any information about an identifiable person, such as a name, email address, IP address, purchase history, or ID number.
The Office of the Privacy Commissioner of Canada (OPC) oversees PIPEDA. It investigates complaints, publishes guidance, and can take cases to the Federal Court.
The 10 principles of PIPEDA
PIPEDA is built on 10 fair information principles:
- Accountability: Name a person who is responsible for your privacy practices.
- Identifying purposes: Tell people why you collect their data, at or before the time you collect it.
- Consent: Get meaningful consent. People must understand what they’re agreeing to.
- Limiting collection: Collect only what you need for the purposes you named.
- Limiting use, disclosure, and retention: Use data only for those purposes, and keep it only as long as you need it.
- Accuracy: Keep personal information accurate and up to date.
- Safeguards: Protect data with security measures that match how sensitive it is.
- Openness: Make your privacy policies and practices easy to find and understand.
- Individual access: Let people see the information you hold about them and correct it.
- Challenging compliance: Give people a way to complain about how you handle their data.
What happened to the CPPA (Bill C-27)?
Bill C-27, introduced in 2022, would have replaced PIPEDA’s privacy rules with the Consumer Privacy Protection Act (CPPA). It also proposed a new privacy tribunal and fines of up to 5% of global revenue. The bill died when Parliament was prorogued in January 2025, so the CPPA never became law.
On 15 June 2026, the government introduced Bill C-36, which would replace PIPEDA with the Protecting Privacy and Consumer Data Act. It’s still going through Parliament. Until a new law passes and takes effect, PIPEDA is the law businesses must follow.
Who must comply with PIPEDA?
PIPEDA applies to:
- Private-sector organizations that collect, use, or disclose personal information in commercial activity anywhere in Canada.
- Federally regulated businesses, such as banks, airlines, telecom companies, and railways. For these, PIPEDA also covers employee information.
- Organizations outside Canada that collect personal information from people in Canada in commercial activity.
- Data that crosses borders. PIPEDA covers personal information that moves between provinces or out of Canada, even when a provincial law applies inside the province.
PIPEDA doesn’t apply to:
- Federal government institutions. They follow the Privacy Act.
- Non-commercial activity, such as a charity’s fundraising, in most cases.
- Personal use, such as a family’s address book.
- Journalistic, artistic, or literary purposes.
Provincial privacy laws
Quebec, Alberta, and British Columbia have their own private-sector privacy laws. These laws apply in place of PIPEDA for activity inside each province.
Quebec’s is the strictest in Canada. See our guide to Quebec’s Law 25.
Ontario, New Brunswick, Nova Scotia, and Newfoundland and Labrador have their own laws for personal health information.
Individual rights under PIPEDA
People in Canada can:
- Ask what information you hold about them. You must reply within 30 days. In some cases you can extend that by up to 30 more days.
- Correct inaccurate information.
- Withdraw consent, with reasonable notice, unless a legal or contract reason prevents it.
- Complain to the OPC if they think you broke the law.
For how to handle these requests, see our guide to data subject access requests.
Mandatory breach reporting
Since 1 November 2018, PIPEDA requires organizations to report some data breaches. If a breach creates a “real risk of significant harm” to a person, you must:
- Report it to the OPC.
- Notify the affected people.
- Notify any other organization that can help reduce the harm, such as a bank or the police.
Do this as soon as you can after you learn of the breach. “Significant harm” includes identity theft, financial loss, and damage to someone’s reputation.
You must also keep a record of every breach for 24 months, including breaches with no real risk of harm. The OPC can ask to see these records at any time.
How businesses can comply with PIPEDA
1. Publish a clear privacy policy
Your privacy policy is where you meet the openness principle. It should say:
- What personal information you collect
- Why you collect it
- How you get consent
- Who you share it with, including service providers outside Canada
- How long you keep it
- How you protect it
- How people can access or correct their information, or withdraw consent
- Who to contact with questions or complaints
See how to create a privacy policy for your website.
2. Get meaningful consent
Explain your purposes in plain language before you collect data. Under OPC guidance, sensitive information needs express consent. Less sensitive information can sometimes rely on implied consent. See implied vs explicit consent.
3. Keep a record of consent
PIPEDA asks for meaningful consent, and proof of it helps you show accountability. WPLP Cookie Consent logs each visitor’s choice in your own WordPress database, and you can export the log as a CSV. PIPEDA banner settings are on WPLP paid plans.
4. Set up breach and access request processes
Decide who handles data requests and breaches before one happens. Keep the 24-month breach log.
5. Get legal advice for complex cases
If you handle sensitive data, such as health or financial information, or move data out of Canada, talk to a privacy lawyer.
Create your privacy policy with WPLP Legal Pages
A copied or generic privacy policy often doesn’t describe what your site actually collects. Under PIPEDA’s openness principle, that’s a problem. Your policy has to explain your real practices.
WPLP Legal Pages is a WordPress plugin that builds the policy from your own setup:
- Privacy policy generator: WPLP Legal Pages builds your privacy policy from your answers about what your site collects and why, so the policy describes your real practices. It publishes the policy as a page on your own domain in one click. The Privacy Policy template is on the free plan.
- Footer links to legal pages: Adds your privacy policy to the site footer automatically, so visitors can find it from every page. This supports PIPEDA’s openness principle.
- Policy update banner: When you change your policy, a banner tells returning visitors what changed and when.
- Auto-updates on law change: Detects relevant law changes and drafts updated policy text. Nothing goes live until you approve it. Available on paid plans.
- Cookie consent banner: WPLP Cookie Consent asks visitors for consent before tracking starts. PIPEDA banner settings are on paid plans.
- Script blocker: Holds analytics and ad scripts back until a visitor agrees, so no data is collected before consent.
- Cookie scanner: Lists the cookies and scripts on your site, so you know what you collect and can list it in your policy.
- Consent log: Saves each visitor’s choice in your own WordPress database, with a CSV export. This gives you a record of consent if the OPC asks.
- Data request form: Lets visitors send access and correction requests through your site, so you can answer within PIPEDA’s 30-day deadline.
Pair it with WP Cookie Consent to get a banner and a consent log from the same team.
PIPEDA penalties and fines
PIPEDA has no general fine for every breach of the law. Fines of up to CAD 100,000 per offence apply to specific offences:
- Knowingly failing to report a breach or keep breach records
- Obstructing an OPC investigation
- Punishing an employee who reports a violation
For other problems, the OPC investigates and makes recommendations. It can also enter into compliance agreements with organizations. The OPC or the affected person can take the case to the Federal Court, which can order changes and award damages.
Beyond legal penalties, a published OPC finding can hurt your reputation and customer trust. See the biggest data breaches for examples.
Frequently Asked Questions About PIPEDA
No. The Consumer Privacy Protection Act was part of Bill C-27, which died in January 2025. A new bill, Bill C-36, was introduced in June 2026 and is not law yet. PIPEDA still applies.
Yes. PIPEDA doesn’t ban transfers out of Canada. You stay responsible for the data, so use contracts that require the same level of protection. Tell people their data may be processed in another country, where local authorities may be able to access it.
Only a minimal fee, or none. You must answer within 30 days, and you can extend that by up to 30 more days in some cases. If you plan to charge, tell the person the approximate cost first. They can withdraw the request.
Both require purpose limits, security, and individual rights. The GDPR gives 6 legal bases for processing and allows fines of up to 4% of global turnover. PIPEDA relies mainly on consent, and its fines (up to CAD 100,000) apply only to specific offences, such as failing to report a breach.
Conclusion
PIPEDA is still Canada’s federal privacy law in 2026. The CPPA never passed, and Bill C-36 is still in Parliament.
Start with the basics: a clear privacy policy, meaningful consent, a record of that consent, and a plan for breaches and access requests. Then watch Bill C-36, since its rules may replace PIPEDA’s once it passes.
If you liked this article, you might also like:
- Data Privacy Laws and Regulations by Country
- General Data Protection Regulation (GDPR)
- The California Privacy Rights Act (CPRA)
Need a privacy policy for your Canadian visitors? Try WPLP Legal Pages.
