What Is PIPEDA in Canada? Quebec, Alberta & BC Scope
For Canadians dealing with a commercial data broker, PIPEDA sets ground rules for how an organization collects, uses, and discloses personal information; whether it applies to a specific broker or activity depends on the organization, purpose, province, cross-border setting, and applicable exceptions. PIPEDA stands for the Personal Information Protection and Electronic Documents Act. It is Canada's federal private-sector privacy law, in force since January 2001, and is built around 10 fair information principles derived from the CSA Model Code. Those principles cover accountability, purpose, consent, collection, use and retention, accuracy, safeguards, openness, individual access, and challenging compliance. PIPEDA does not create a general right to delete every record; the available route depends on the organization, purpose, province, and applicable exceptions. The Office of the Privacy Commissioner of Canada (OPC) has investigative, reporting, and complaint-handling functions under the Act. Alberta (PIPA), British Columbia (PIPA BC), and Quebec (Law 25) have private-sector privacy laws that have been deemed "substantially similar" to PIPEDA. Organizations subject to those laws are generally exempt from PIPEDA for collection, use, or disclosure occurring within the province, while PIPEDA continues to apply to federally regulated businesses and commercial activities involving information that crosses provincial or national borders. Quebec's Law 25 adds distinct requirements, including privacy impact assessments, structured data portability, and significant administrative monetary penalties. Bill C-27 from the 44th Parliament was not enacted before that session ended. The current Bill C-36, the Protecting Privacy and Consumer Data Act, was introduced on June 15, 2026; Parliament's current record lists it at second reading in the House of Commons, while showing the latest activity as first reading and no second-reading activity. No replacement law is shown as enacted. Until replacement legislation receives Royal Assent and comes into force, PIPEDA remains the operative federal private-sector privacy law. For a provider-specific workflow example, see the data-broker removal guide.
At a glance
- Full name
- Personal Information Protection and Electronic Documents Act
- Short code
- PIPEDA
- Jurisdiction
- Canada
- Enacted
- 2000
- Last major update
- Digital Privacy Act 2015 (mandatory breach-notification regime in force since November 1, 2018); Bill C-36 introduced June 15, 2026 and is listed at second reading without second-reading activity
- Regulator
- Office of the Privacy Commissioner of Canada (OPC)
- Private right of action
- Limited
- Statutory citation
- S.C. 2000, c. 5
International privacy-law explainer timeline
Enacted years are counted by decade from the published explainer dataset; the table lists the laws in each decade.
- Decade containing a highlighted explainer
- Other decades
195
Planning jurisdictions
167
Published law explainers
92
Partial official reviews
The ledger coverage split is 195 planning jurisdictions, 167 published law explainers, and 92 partial official reviews. 4 of 167 explainers lack an enacted year, so they are omitted from the decade counts.
Show the data as a table
| Decade | Explainers with an enacted year | Laws (short codes) |
|---|---|---|
| 1970s | 1 | Loi Informatique et Libertés |
| 1980s | 2 | Privacy Act 1988, Privacy Law 5741-1981 |
| 1990s | 2 | DSG, Constitution Article 28 |
| 2000s | 15 | PIPEDA (highlighted), APPI, Law 25.326, Law on Personal Data Protection, Law 09-08, 152-FZ, Law No. 2008-12, Organic Law No. 2004-63, PDPA, DPA 2003, Art. 21(2), 25, 130–131 + Law 254, Lei n.º 133/V/2001, Uruguay Ley 18.331, Iran Electronic Commerce Act 2003, Saint Vincent and the Grenadines Privacy Act No. 18 of 2003 |
| 2010s | 81 | UK GDPR, LGPD, BDSG, RA 10173, POPIA, Malaysia PDPA, Korea PIPA, UAVG, PECA + Art. 14, Law 29733, Thai PDPA, KVKK, Poland GDPR + UODO Act, Portugal GDPR + Lei 58/2019, Romania GDPR + Law 190/2018, Law 1581, Law No. 94-V, HO-49-N, Law 998-IIIQ, Info tv. + GDPR, Act No. 90/2018 + GDPR, Data Protection Act 2019, PDL, Law of 1 August 2018, Chapter 586, IKS, Act 843, Law 4624/2019, Law 87/2018, Act No. 18/2018 Coll., Law No. 2297-VI, Act on the Implementation of the GDPR, Law 125(I)/2018, Act No. 110/2019 Coll., Belgian Data Protection Act, Databeskyttelsesloven, Data Protection Act 1050/2018, Personal Data Act, Sectoral Privacy Protections, Law No. 18-07 + Law No. 25-11, Law No. 22/11, Data Protection Act 2013, Law No. 30 of 2018, Data Protection Act 2019-29, Code du numérique, Book V, ICM Act 2018 + NDGF 2025, Fragmented privacy framework, Ley 8968, Ley 172-13, GDPR + Data Protection Act, Mali Law 2013-015, Mauritania Law 2017-020, Mauritius DPA 2017, Nepal Privacy Act 2075, Panama Ley 81/2019, Qatar Law No. 13 of 2016, Saint Lucia DPA 2011, Togo Law 2019-014, Turkmenistan Law 519-V, Chad Law 007/PR/2015, Congo Law 29-2019, Côte d'Ivoire Law 2013-450, Equatorial Guinea Law 1/2016, Fiji Privacy Framework, Guinea Law L/2016/037/AN, Haiti 2018 Data Privacy Order, Lao Law 25/NA, Lebanon Law 81/2018, Lesotho Data Protection Act 2011, Madagascar Law 2014-038, Myanmar Privacy and Security Law, Nicaragua Law No. 787, Saint Kitts and Nevis DPA No. 5 of 2018, San Marino Law No. 171/2018, Lei n.º 03/2016, Law No. 1537, Trinidad and Tobago DPA 2011, Uganda DPA 2019, U.S. Privacy Law, Law No. O‘RQ-547, Law No. 13 of 2012 |
| 2020s | 62 | DPDP Act, PIPL, UAE PDPL, NDPA, PDPL, Law No. 91/2025, Act No. 63 of 2026, Law 21.719, Law No. 151 of 2020, UU PDP, LFPDPPP (2025), Law 124/2024, Law 12/25, Data Protection Act 2020, Digital Code, Law no. 195/2024, Law on Personal Data Protection, Law No. 3144, Law 42/2020, ZVOP-2, PDPA, LQPD, Law No. 99-Z, Data Protection Act 2021, Data Protection Act 2024, PDPO 2025, Loi n°001-2021/AN, Law No. 1/03 of 2026, Law No. 2024/017, Law No. 24.001, LOPDP, LPDP, Malawi DPA 2024, Monaco Law 1.565, Oman PDPL, Paraguay Law 7593/2025, Rwanda Law 058/2021, Tanzania PDPA 2022, Vanuatu DPPA 2024, Zimbabwe Cyber and Data Protection Act, Cuba Law 149/2022, DPRK Information Law materials, DRC Digital Code 2023, Djibouti Digital Code 2025, Eswatini Data Protection Act 2022, Ethiopia Proclamation No. 1321/2024, Gabon Law 025/2023, Grenada Data Protection Act 2023, Guyana Data Protection Act 2023, Jordan Personal Data Protection Law No. 24 of 2023, Kiribati Data Protection Act 2025, Kuwait CITRA Decision 2024/26, Libya Law No. 6 of 2022, Liechtenstein DSG 2026, Marshall Islands PDPA 2025, Niger Law No. 2022-59, Seychelles Data Protection Act 2023, Somalia Data Protection Act 2023, Law No. 12 of 2024, Privacy Act 2025, Zambia Data Protection Act 2021, Decree DCLVII |
Sources: PIPEDA statutory citation · OfflistMe jurisdiction research ledger · Checked international explainers 2026-10-12; coverage ledger 2026-10-12
Scope, who PIPEDA covers
Continue with related privacy resources
Follow the route that matches your next question. Each link stays within a documented topic cluster and points to a canonical content page.
Protected data
Data subject rights
Right to know what personal information an organization holds and how it is being used
Right of access, review your personal information and receive copies
Right to correction, challenge accuracy and completeness, and amend information
Right to withdraw consent (subject to legal or contractual restrictions)
Right to receive an explanation of refused access requests
Right to file a complaint with the Office of the Privacy Commissioner
Right to know how and why information will be shared with third parties
Notable features
PIPEDA's 10 fair information principles (Schedule 1) are its defining feature, principles-based rather than rules-based, giving organizations flexibility but also creating uncertainty. Consent is central: PIPEDA distinguishes between express and implied consent, with the OPC's Guidelines for meaningful consent providing an interpretive framework. Quebec's Law 25 creates separate provincial requirements that organizations operating across jurisdictions should compare with PIPEDA.
Enforcement & penalties
Regulator: Office of the Privacy Commissioner of Canada (OPC)
Penalties: PIPEDA does not give the OPC direct administrative-fine authority. Section 28 makes an organization liable for an offence when it knowingly contravenes section 8(8), section 10.1, section 10.3(1), or section 27.1(1), or obstructs the OPC; the maximum fine is CAD $10,000 on summary conviction or CAD $100,000 if indictable. Bill C-27, which proposed a replacement federal penalty regime, was not enacted after the January 2025 prorogation, so no replacement federal regime is in force. Quebec's Law 25 provides an administrative-penalty maximum of CAD $10M or 2% of worldwide turnover for organizations where its statutory conditions apply.
Private right of action: After receiving an OPC report, or notice that an investigation was discontinued, a complainant may apply to the Federal Court under section 14 for a hearing on specified matters. The Court may order practice changes, require publication of corrective action, and award damages, including for humiliation. This is a defined post-OPC route, not a general direct action for every privacy dispute.
Relevance to data brokers
PIPEDA may apply to a data broker's commercial activities in Canada, subject to the substantially similar provincial-law, federally regulated-business, and cross-border boundaries above. A Canadian resident can first raise a concern with the organization and may then use the OPC complaint process; the Federal Court route is the defined post-OPC process under section 14. Whether a specific broker or activity is covered depends on the facts and applicable provincial law.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Does PIPEDA apply in Quebec, Alberta, or British Columbia?+
Organizations subject to a substantially similar provincial private-sector law are generally exempt from PIPEDA for collection, use, or disclosure occurring within that province. Alberta, British Columbia, and Quebec have those laws. PIPEDA continues to apply to federally regulated businesses and to commercial activities involving information that crosses provincial or national borders.
How do I file a PIPEDA complaint?+
First raise the concern with the organization. If it has not responded or you are not satisfied, the OPC's current report-a-concern process can help you decide whether to ask for information, file a formal complaint, or consider the Federal Court route. Do not treat a 30-day wait as a universal legal precondition; the OPC says it may be unable to accept a complaint if you do not first try to resolve the issue with the organization.
What is Quebec Law 25?+
Law 25 (formerly Bill 64) is Quebec's private-sector privacy law, substantially amended in September 2022, September 2023, and September 2024. It adds distinct Quebec requirements, including consent rules for some secondary uses, data portability provisions, privacy-officer duties, and administrative monetary penalties up to CAD $10M or 2% of worldwide turnover where the statutory conditions apply.
How does PIPEDA overlap with Quebec's Law 25?+
For intraprovincial private-sector activities in Quebec, Quebec's Law 25 applies instead of PIPEDA because it is deemed 'substantially similar.' However, PIPEDA still governs interprovincial or international transfers of personal information (such as sending data across provincial borders or to the US) and federally regulated businesses (like banks, airlines, and telecoms) operating inside Quebec.
What does PIPEDA require for small businesses in Canada?+
PIPEDA requires an organization to remain accountable for personal information under its control and to identify someone responsible for compliance. Access requests generally require a response within 30 days, subject to the Act's extension and exception rules. PIPEDA supports correction challenges, but it does not create a general right to delete every record; retention and destruction depend on the applicable principle, purpose, contract, law, and provincial regime.
Is Bill C-27 in force?+
No. Bill C-27 belonged to the 44th Parliament session that ended on January 6, 2025 and was not enacted. Bill C-36 was introduced on June 15, 2026; the current parliamentary record lists it at second reading in the House but shows no second-reading activity or enactment. PIPEDA remains Canada's operative federal private-sector privacy law until replacement legislation receives Royal Assent and comes into force.
Official sources & citations
- PIPEDA. Full Statutory Text
- OPC. PIPEDA requirements in brief
- OPC. Provincial laws that may apply instead of PIPEDA
- OPC. Responding to access requests under PIPEDA
- Office of the Privacy Commissioner. Know your rights
- OPC. File a complaint
- PIPEDA Breach of Security Safeguards Regulations
- OPC. PIPEDA's 10 Fair Information Principles
- Bill C-27 status (LEGISinfo, 44th Parliament)
- Bill C-36 status (LEGISinfo, Parliament of Canada)
- Quebec Act respecting the protection of personal information in the private sector
Other international privacy regimes
PIPEDA sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: