Home › Compare laws side by side › PIPEDA vs EU GDPR

PIPEDA vs EU GDPR

Personal Information Protection and Electronic Documents Act (PIPEDA) (Canada (federal)) compared with Regulation (EU) 2016/679 (General Data Protection Regulation) (European Union (EEA)) on the same topics. Every value comes from the law pages, which link to the official sources.

Topic	PIPEDA Canada (federal) 10/14 facts confirmed by two sources	EU GDPR European Union (EEA) ✓ Confirmed by two sources
Status	In force. Replacement Bill C-36 (Protecting Privacy and Consumer Data Act) tabled 15 Jun 2026; before Parliament, not yet law.✓	In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓
Who it applies to	Private-sector organizations handling personal info in commercial activity, plus federally regulated firms (banks, airlines, telecoms) incl. employee data. Applies to data crossing provincial or national borders, even in Alberta, BC and Quebec, which have their own similar laws.✓	Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓
Size thresholds	No size, revenue or volume thresholds; applies to any organization collecting, using or disclosing personal info in the course of commercial activity.✓	None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓
Regulator	Office of the Privacy Commissioner of Canada (OPC)✓	National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓
Breach or incident reporting	Report to the OPC and notify affected individuals as soon as feasible for any breach of security safeguards creating a real risk of significant harm (e.g., financial loss, identity theft, humiliation). Keep a record of every breach and provide it to the OPC on request.✓	Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓
Deadline to answer personal data requests	Access requests: respond within 30 days of receipt; may extend by up to 30 more days (or longer for format conversion) with written notice to the individual within the first 30 days.	1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓
Data protection officer	Must designate one or more individuals accountable for PIPEDA compliance and make their name or title known internally and externally (e.g., on the website).	DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓
Local representative	Being verified	Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓
Sending data abroad	Transfers for processing are allowed without extra consent if used for the original purpose. The organization stays accountable, must use contracts to ensure comparable protection, and must tell individuals their data may be processed abroad and accessed by foreign authorities.✓	Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓
Cookies and consent	Meaningful consent required. Opt-out consent for online behavioural advertising is acceptable only with clear, timely notice, easy and immediate opt-out, non-sensitive data and limited retention; avoid tracking children and uncontrollable trackers (fingerprinting, supercookies).✓	Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓
Maximum penalty	Fines up to C$100,000 per indictable offence (C$10,000 on summary conviction) for knowingly breaching breach-reporting, notification or record-keeping duties, not keeping information under an access request, retaliating against whistleblowers, or obstructing the Commissioner. Bill C-36 would allow penalties up to C$10M or 3% of gross global revenue, and fines up to C$25M or 5%.✓	Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓

= confirmed by two independent sources, at least one official.

Facts marked “Being verified” are still being confirmed and are not given as answers.

Who each law applies to

PIPEDA: Private-sector organizations handling personal info in commercial activity, plus federally regulated firms (banks, airlines, telecoms) incl. employee data. Applies to data crossing provincial or national borders, even in Alberta, BC and Quebec, which have their own similar laws.
EU GDPR: Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.

What you must do under PIPEDA

Appoint a privacy officer accountable for compliance and publish their name or title.
Obtain meaningful consent and limit collection, use and disclosure to identified purposes.
Answer access requests within 30 days (one extension of up to 30 days with notice).
Report real-risk-of-significant-harm breaches to the OPC and notify affected people as soon as feasible.
Keep a record of every security breach and provide it to the OPC on request.
Use contracts to ensure comparable protection for data sent to processors, including abroad, and disclose foreign processing.

Full PIPEDA page, sources and checklist

What you must do under EU GDPR

Identify a lawful basis for every processing purpose and record it.
Publish a clear privacy notice covering purposes, recipients, retention and rights.
Keep a record of processing activities and sign Art 28 contracts with processors.
Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
Answer access, erasure and other rights requests within one month.

Full EU GDPR page, sources and checklist

Partner

Termly

Create and maintain a privacy policy, cookie banner and request forms.

Create your privacy policy with Termly

Partner link: we may earn a commission if you buy, at no extra cost to you. It never affects our legal content. Affiliate disclosure

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.