Home › Law library › PIPEDA
PIPEDA
Personal Information Protection and Electronic Documents Act (PIPEDA)
Sourced · 10/14 facts confirmed by two sources. Last verified 10 October 2026
Next full re-check due: . Regulator news is checked monthly; changes are logged in the change log.
Cite this page: GlanceDesk Jurisdiction, “PIPEDA (Canada (federal))”, glancedeskjurisdiction.com/laws/ca-pipeda, last verified 10 October 2026.
Canada (federal) Privacy
- Status
- In force. Replacement Bill C-36 (Protecting Privacy and Consumer Data Act) tabled 15 Jun 2026; before Parliament, not yet law.✓
- Who it applies to
- Private-sector organizations handling personal info in commercial activity, plus federally regulated firms (banks, airlines, telecoms) incl. employee data. Applies to data crossing provincial or national borders, even in Alberta, BC and Quebec, which have their own similar laws.✓
- Size thresholds
- No size, revenue or volume thresholds; applies to any organization collecting, using or disclosing personal info in the course of commercial activity.✓
- Regulator
- Office of the Privacy Commissioner of Canada (OPC)✓
- Breach or incident reporting
- Report to the OPC and notify affected individuals as soon as feasible for any breach of security safeguards creating a real risk of significant harm (e.g., financial loss, identity theft, humiliation). Keep a record of every breach and provide it to the OPC on request.✓
- Deadline to answer personal data requests
- Access requests: respond within 30 days of receipt; may extend by up to 30 more days (or longer for format conversion) with written notice to the individual within the first 30 days.
- Data protection officer
- Must designate one or more individuals accountable for PIPEDA compliance and make their name or title known internally and externally (e.g., on the website).
- Local representative
- Being verified
- Sending data abroad
- Transfers for processing are allowed without extra consent if used for the original purpose. The organization stays accountable, must use contracts to ensure comparable protection, and must tell individuals their data may be processed abroad and accessed by foreign authorities.✓
- Cookies and consent
- Meaningful consent required. Opt-out consent for online behavioural advertising is acceptable only with clear, timely notice, easy and immediate opt-out, non-sensitive data and limited retention; avoid tracking children and uncontrollable trackers (fingerprinting, supercookies).✓
- Maximum penalty
- Fines up to C$100,000 per indictable offence (C$10,000 on summary conviction) for knowingly breaching breach-reporting, notification or record-keeping duties, not keeping information under an access request, retaliating against whistleblowers, or obstructing the Commissioner. Bill C-36 would allow penalties up to C$10M or 3% of gross global revenue, and fines up to C$25M or 5%.✓
Facts marked “Being verified” are still being confirmed and are not given as answers.
What you must do
- Appoint a privacy officer accountable for compliance and publish their name or title.
- Obtain meaningful consent and limit collection, use and disclosure to identified purposes.
- Answer access requests within 30 days (one extension of up to 30 days with notice).
- Report real-risk-of-significant-harm breaches to the OPC and notify affected people as soon as feasible.
- Keep a record of every security breach and provide it to the OPC on request.
- Use contracts to ensure comparable protection for data sent to processors, including abroad, and disclose foreign processing.
Recent changes
Bill C-27 (CPPA/AIDA) died on the order paper. Bill C-36, the Protecting Privacy and Consumer Data Act, was tabled 15 Jun 2026; it would replace PIPEDA's privacy part, move oversight to a new Digital Safety and Data Protection Commission, and add data-mobility and automated-decision explanation and human-review rights. Before Parliament; not yet law.✓
Termly
Create and maintain a privacy policy, cookie banner and request forms.
Create your privacy policy with TermlyPartner link: we may earn a commission if you buy, at no extra cost to you. It never affects our legal content. Affiliate disclosure
Sources
- Primary source: https://laws-lois.justice.gc.ca/eng/acts/P-8.6/
- Second source: https://gowlingwlg.com/en/insights-resources/articles/2026/ottawa-tables-long-awaited-federal-privacy-reform-legislation
- Regulator: Office of the Privacy Commissioner of Canada (OPC)
Sources used for the independent check (14)
- https://www.parl.ca/LegisInfo/en/bill/45-1/C-36
- https://gowlingwlg.com/en/insights-resources/articles/2026/bill-c36-timeline-of-developments
- https://www.smartbiggar.ca/insights/publication/bill-c-36--third-attempt-at-revamping-canada-s-privacy-law
- https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief/
- https://laws-lois.justice.gc.ca/eng/acts/P-8.6/page-1.html
- https://www.priv.gc.ca/en/privacy-topics/privacy-breaches/respond-to-a-privacy-breach-at-your-business/gd_pb_201810/
- https://priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/p_principle/principles/p_accountability/
- https://laws-lois.justice.gc.ca/eng/acts/P-8.6/page-3.html
- https://www.torys.com/insights/publications/2019/09/opc-not-changing-guidelines-on-transfers-for-processing
- https://priv.gc.ca/en/privacy-topics/technology/online-privacy-tracking-cookies/tracking-and-ads/gl_ba_1112/
- https://loeb.com/en/insights/publications/2011/12/canadian-privacy-commissioner-issues-guidelines-__
- https://laws-lois.justice.gc.ca/eng/acts/P-8.6/page-5.html
- https://priv.gc.ca/en/opc-actions-and-decisions/advice-to-parliament/2018/parl_sub_180529
- https://gowlingwlg.com/en/insights-resources/articles/2026/understanding-bill-c36
= confirmed by two independent sources, at least one official. How we verify
Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@