What Is PIPEDA in Canada? Quebec, Alberta & BC Scope
PIPEDA stands for the Personal Information Protection and Electronic Documents Act. It is Canada's federal private-sector privacy law, in force since January 2001, and is built around 10 fair information principles derived from the CSA Model Code. Those principles cover accountability, purpose, consent, collection, use and retention, accuracy, safeguards, openness, individual access, and challenging compliance. PIPEDA does not create a general right to delete every record; the available route depends on the organization, purpose, province, and applicable exceptions. The Office of the Privacy Commissioner of Canada (OPC) has investigative, reporting, and complaint-handling functions under the Act. Alberta (PIPA), British Columbia (PIPA BC), and Quebec (Law 25) have private-sector privacy laws that have been deemed "substantially similar" to PIPEDA. Organizations subject to those laws are generally exempt from PIPEDA for collection, use, or disclosure occurring within the province, while PIPEDA continues to apply to federally regulated businesses and commercial activities involving information that crosses provincial or national borders. Quebec's Law 25 adds distinct requirements, including privacy impact assessments, structured data portability, and significant administrative monetary penalties. Bill C-27 from the 44th Parliament was not enacted before that session ended. The current Bill C-36, the Protecting Privacy and Consumer Data Act, was introduced on June 15, 2026; Parliament's current record lists it at second reading in the House of Commons, while showing the latest activity as first reading and no second-reading activity. No replacement law is shown as enacted. Until replacement legislation receives Royal Assent and comes into force, PIPEDA remains the operative federal private-sector privacy law.
At a glance
- Full name
- Personal Information Protection and Electronic Documents Act
- Short code
- PIPEDA
- Jurisdiction
- Canada
- Enacted
- 2000
- Last major update
- Digital Privacy Act 2015 (mandatory breach-notification regime in force since November 1, 2018); Bill C-36 introduced June 15, 2026 and is listed at second reading without second-reading activity
- Regulator
- Office of the Privacy Commissioner of Canada (OPC)
- Private right of action
- Limited
- Statutory citation
- S.C. 2000, c. 5
Scope, who PIPEDA covers
Protected data
Data subject rights
Right to know what personal information an organization holds and how it is being used
Right of access, review your personal information and receive copies
Right to correction, challenge accuracy and completeness, and amend information
Right to withdraw consent (subject to legal or contractual restrictions)
Right to receive an explanation of refused access requests
Right to file a complaint with the Office of the Privacy Commissioner
Right to know how and why information will be shared with third parties
Notable features
PIPEDA's 10 fair information principles (Schedule 1) are its defining feature, principles-based rather than rules-based, giving organizations flexibility but also creating uncertainty. Consent is central: PIPEDA distinguishes between express and implied consent, with the OPC's Guidelines for meaningful consent providing an interpretive framework. Quebec's Law 25 creates separate provincial requirements that organizations operating across jurisdictions should compare with PIPEDA.
Enforcement & penalties
Regulator: Office of the Privacy Commissioner of Canada (OPC)
Penalties: PIPEDA does not give the OPC direct administrative-fine authority. Section 28 makes an organization liable for an offence when it knowingly contravenes section 8(8), section 10.1, section 10.3(1), or section 27.1(1), or obstructs the OPC; the maximum fine is CAD $10,000 on summary conviction or CAD $100,000 if indictable. Bill C-27, which proposed a replacement federal penalty regime, was not enacted after the January 2025 prorogation, so no replacement federal regime is in force. Quebec's Law 25 provides an administrative-penalty maximum of CAD $10M or 2% of worldwide turnover for organizations where its statutory conditions apply.
Private right of action: After receiving an OPC report, or notice that an investigation was discontinued, a complainant may apply to the Federal Court under section 14 for a hearing on specified matters. The Court may order practice changes, require publication of corrective action, and award damages, including for humiliation. This is a defined post-OPC route, not a general direct action for every privacy dispute.
Relevance to data brokers
PIPEDA may apply to a data broker's commercial activities in Canada, subject to the substantially similar provincial-law, federally regulated-business, and cross-border boundaries above. A Canadian resident can first raise a concern with the organization and may then use the OPC complaint process; the Federal Court route is the defined post-OPC process under section 14. Whether a specific broker or activity is covered depends on the facts and applicable provincial law.
Generate requests in under 60 seconds
Generate removal requests for 1,034 US/global profiles, $9
FAQ
Does PIPEDA apply in Quebec, Alberta, or British Columbia?+
Organizations subject to a substantially similar provincial private-sector law are generally exempt from PIPEDA for collection, use, or disclosure occurring within that province. Alberta, British Columbia, and Quebec have those laws. PIPEDA continues to apply to federally regulated businesses and to commercial activities involving information that crosses provincial or national borders.
How do I file a PIPEDA complaint?+
First raise the concern with the organization. If it has not responded or you are not satisfied, the OPC's current report-a-concern process can help you decide whether to ask for information, file a formal complaint, or consider the Federal Court route. Do not treat a 30-day wait as a universal legal precondition; the OPC says it may be unable to accept a complaint if you do not first try to resolve the issue with the organization.
What is Quebec Law 25?+
Law 25 (formerly Bill 64) is Quebec's private-sector privacy law, substantially amended in September 2022, September 2023, and September 2024. It adds distinct Quebec requirements, including consent rules for some secondary uses, data portability provisions, privacy-officer duties, and administrative monetary penalties up to CAD $10M or 2% of worldwide turnover where the statutory conditions apply.
How does PIPEDA overlap with Quebec's Law 25?+
For intraprovincial private-sector activities in Quebec, Quebec's Law 25 applies instead of PIPEDA because it is deemed 'substantially similar.' However, PIPEDA still governs interprovincial or international transfers of personal information (such as sending data across provincial borders or to the US) and federally regulated businesses (like banks, airlines, and telecoms) operating inside Quebec.
What does PIPEDA require for small businesses in Canada?+
PIPEDA requires an organization to remain accountable for personal information under its control and to identify someone responsible for compliance. Access requests generally require a response within 30 days, subject to the Act's extension and exception rules. PIPEDA supports correction challenges, but it does not create a general right to delete every record; retention and destruction depend on the applicable principle, purpose, contract, law, and provincial regime.
Is Bill C-27 in force?+
No. Bill C-27 belonged to the 44th Parliament session that ended on January 6, 2025 and was not enacted. Bill C-36 was introduced on June 15, 2026; the current parliamentary record lists it at second reading in the House but shows no second-reading activity or enactment. PIPEDA remains Canada's operative federal private-sector privacy law until replacement legislation receives Royal Assent and comes into force.
Official sources & citations
- PIPEDA. Full Statutory Text
- OPC. PIPEDA requirements in brief
- OPC. Responding to access requests under PIPEDA
- Office of the Privacy Commissioner. Know your rights
- OPC. File a complaint
- PIPEDA Breach of Security Safeguards Regulations
- OPC. PIPEDA's 10 Fair Information Principles
- Bill C-27 status (LEGISinfo, 44th Parliament)
- Bill C-36 status (LEGISinfo, Parliament of Canada)
- Quebec Act respecting the protection of personal information in the private sector
Other international privacy regimes
PIPEDA sits in a global ecosystem of data-protection laws. Compare with other jurisdictions that shape cross-border data flows: