PIPEDA

What it is

PIPEDA is Canada's federal privacy law governing personal information handling by private-sector organizations engaged in commercial activity. Enforced by the Office of the Privacy Commissioner of Canada (OPC), it applies across Canada except in provinces with substantially similar legislation (currently Quebec, British Columbia, and Alberta for private-sector information; Ontario, New Brunswick, Newfoundland and Labrador, and Nova Scotia for health information).

Who it applies to

Any organization collecting, using, or disclosing personal information in the course of commercial activity in a federally regulated jurisdiction. Federally regulated sectors (banking, telecommunications, interprovincial transportation, airlines) are covered nationwide regardless of provincial law. Cross-border data flows involving Canadians typically bring foreign organizations into PIPEDA's scope.

Key provisions

Key data protection requirements

PIPEDA is built on 10 Fair Information Principles: accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and challenging compliance. Organizations must appoint a designated privacy officer, obtain meaningful consent, and safeguard personal information with security measures appropriate to sensitivity.

Breach reporting

Since November 1, 2018, PIPEDA has required organizations to:

• Report to the OPC any breach of security safeguards involving personal information under the organization's control where a real risk of significant harm (RROSH) to an individual has occurred
• Notify affected individuals as soon as feasible when RROSH exists
• Notify other organizations (e.g., other service providers) that could reduce or mitigate the risk
• Maintain records of every breach of security safeguards for 24 months, regardless of whether RROSH threshold is met, OPC can request the record at any time

Reports must be made "as soon as feasible" after determining a breach has occurred; there is no fixed hour deadline, but delay itself can be evidence of failure to safeguard.

Enforcement

Under section 28, knowingly failing to report a breach, notify individuals or keep the breach record is an offence, prosecuted by the federal Crown. The Privacy Commissioner says it does not prosecute offences or issue fines; it can refer information about a possible offence to the Attorney General of Canada. The duty to keep the record applies to owner-run firms as well as large ones.

Recent amendments

• Nov 2018Mandatory breach reporting provisions came into force via the Digital Privacy Act (SC 2015, c. 32).
• Jun 2022Bill C-27 (Digital Charter Implementation Act, 2022) introduced, proposes replacing PIPEDA with the Consumer Privacy Protection Act (CPPA). The bill died on the Order Paper when Parliament was prorogued in January 2025.

How LeakTrace maps to it

An External Cybersecurity Assessment reads what a firm exposes from outside: email settings, the firm’s addresses in monitored breach databases, lookalike domains, exposed services and keys left in the firm's own website code. The Rules and Insurance Briefing that comes with it maps each finding to PIPEDA, with the proof behind it, so the firm can see which obligation a finding touches. The assessment is human-verified before it is released.