PIPEDA
Personal Information Protection and Electronic Documents Act
PIPEDA is Canada's federal private-sector privacy law that governs how commercial organizations collect, use, and disclose personal information in the course of commercial activities.
Source: IQWorks — iqworks.ai | Last updated: 2026-03-20
Effective
Jan 1, 2004
Jurisdiction
Canada
Max Penalty
CAD 100,000 per violation
Enforced By
Office of the Privacy Commissioner of Canada (OPC)
Who Does PIPEDA Apply To?
Private-sector organizations collecting, using, or disclosing personal information in the course of commercial activities across Canada.
Key Requirements
Ten Fair Information Principles
Accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and challenging compliance.
Meaningful Consent
Organizations must obtain meaningful consent for collection, use, and disclosure. Form of consent depends on sensitivity of information and reasonable expectations.
Breach Notification
Organizations must report breaches that pose a real risk of significant harm to the OPC and notify affected individuals.
Transparency
Organizations must make their privacy policies and practices readily available and understandable.
Retention Limits
Personal information must only be retained as long as necessary for the identified purposes.
Cross-Border Transfers
Organizations may transfer personal information to third-party processors in other countries but remain accountable through contractual arrangements.
Individual Rights Under PIPEDA
Frequently Asked Questions
What is PIPEDA?
PIPEDA is Canada's federal private-sector privacy law that governs how commercial organizations collect, use, and disclose personal information in the course of commercial activities.
What are the penalties for PIPEDA non-compliance?
The maximum penalty under PIPEDA is CAD 100,000 per violation. Enforcement is handled by Office of the Privacy Commissioner of Canada (OPC).
Who does PIPEDA apply to?
Private-sector organizations collecting, using, or disclosing personal information in the course of commercial activities across Canada.
When did PIPEDA take effect?
Personal Information Protection and Electronic Documents Act was enacted in 2000 and became effective on January 1, 2004.
Compare PIPEDA
Related Regulations
Automate PIPEDA Compliance
IQWorks helps organizations achieve and maintain PIPEDA compliance with AI-powered automation.
Request Demo