PIPEDA Compliance
Canada's private-sector privacy law
PIPEDA is Canada's federal private-sector privacy law, governing how organisations collect, use, and disclose personal information during commercial activity. Quebec, British Columbia, and Alberta have their own substantially similar laws instead. Breach-reporting failures can bring fines of up to CAD $100,000 per violation.
What is PIPEDA?
governs how private-sector organisations collect, use,
and disclose personal information in the course of commercial
activity, based on ten fair information principles. Quebec, British
Columbia, and Alberta have their own 'substantially similar'
provincial laws that apply instead within those provinces.
Who needs to comply with PIPEDA?
Canada, subject to the provincial carve-outs noted above.
What are the key requirements
of PIPEDA?
Meaningful consent before collecting, using, or disclosing personal information
Limiting collection and use to the identified purpose
Reasonable safeguards proportionate to the sensitivity of the information
Providing individuals access to their own personal information on request
Reporting breaches of security safeguards to the Privacy Commissioner and affected individuals where there is a real risk of significant harm
What are the penalties for PIPEDA non-compliance?
Fines of up to CAD $100,000 per violation for certain offences, such as failing to report a breach, with reform proposals aiming to introduce stronger enforcement powers.
Teagmháil Linn$100,000
Fine per violation (CAD)How does GDPRLocal help with PIPEDA?
GDPRLocal supports you with everything PIPEDA requires: a compliant privacy framework, required documentation, breach-response processes, and privacy management tools, including support for provincial laws where they add extra requirements.
Tosaigh saor in aisce