How to Respond to a Privacy Complaint in Canada: Step-by-Step Guide

A privacy complaint — whether filed directly with your Privacy Officer or submitted to the OPC — is a serious matter that requires a structured, professional response. How you handle the early stages of a complaint significantly affects the outcome. Here's the complete guide to responding effectively.

Last updated: April 2026

The Two Paths for Privacy Complaints

Privacy complaints in Canada can come through two channels:

1. Direct Complaint to Your Privacy Officer

PIPEDA Principle 10 (Challenging Compliance) requires organizations to put procedures in place to receive and respond to complaints, to investigate all complaints, and to take appropriate measures if a complaint is justified (Schedule 1, clauses 4.10.2–4.10.4). The OPC may also decline to investigate if it considers the complainant ought first to exhaust grievance procedures reasonably available (s. 12(1)(a)). A well-handled internal complaint often resolves the matter before OPC involvement.

2. Complaint Filed Directly With the OPC

Individuals don't have to come to you first — they can file directly with the OPC. In practice, the OPC will notify you of a complaint and ask for your response before proceeding with investigation.

Step 1: Receive and Acknowledge the Complaint

When a complaint reaches your Privacy Officer:

1. Send an acknowledgment within 24-48 hours confirming receipt
2. Assign a file number or tracking reference
3. Confirm who will handle the investigation
4. Provide a timeline for initial response

Template acknowledgment:

"Dear [Complainant], Thank you for bringing this concern to our attention. We have received your complaint regarding [brief description] and are investigating. Our Privacy Officer will respond by [date — within 30 days]. If you have additional information relevant to your complaint, please forward it to [email]."

If an OPC notification arrives:

1. Treat it as urgent — review the OPC's complaint summary immediately
2. Identify your external legal counsel if the matter is complex or potentially significant
3. Preserve all relevant records (don't delete or modify any potentially relevant data or communications)
4. Acknowledge receipt to the OPC within the requested timeframe

Step 2: Understand the Complaint

Read the complaint carefully and identify:

• What specific PIPEDA obligation the complainant alleges you've violated
• What conduct or omission is at issue
• What outcome the complainant is seeking (information, correction, deletion, apology, compensation)
• What documentation exists on your side

Common complaint categories:

1. Failure to provide access to personal information (Principle 9)
2. Improper collection without consent (Principle 3)
3. Secondary use of information without consent (Principle 5)
4. Inadequate security leading to unauthorized disclosure (Principle 7)
5. Failure to correct inaccurate information (Principle 6)
6. Sharing information with third parties without consent (Principle 5)
7. Inadequate retention/destruction practices (Principle 5)

Step 3: Gather the Evidence

Conduct an internal investigation:

1. Pull all records related to the complainant's personal information
2. Review your data practices at the time of the alleged violation
3. Identify what consent was obtained and how (check your consent records)
4. Review your privacy policy as it stood at the relevant time
5. Check your access/disclosure logs if available
6. Interview relevant staff who dealt with the complainant (document these interviews)

Document everything. Your internal investigation records demonstrate good faith and due diligence.

Step 4: Assess the Merits of the Complaint

With your evidence in hand, honestly assess whether:

• The complaint has merit (was there a PIPEDA violation?)
• The complaint is partially valid
• The complaint is without merit

Be honest in your assessment. Defending an indefensible position with the OPC damages your credibility and typically results in worse outcomes than acknowledging an issue early.

Step 5: Respond to the Complainant

If the complaint has merit — remediate and acknowledge:

Write a substantive response that:

• Acknowledges the specific issue (without unnecessary legal hedging)
• Describes what corrective action you've taken or will take
• Provides any requested information or correction
• Explains any steps taken to prevent recurrence
• Apologises where appropriate

A genuine, timely response often resolves complaints at this stage without OPC involvement.

If the complaint is partially valid: Acknowledge the valid aspects, explain why other aspects are not violations, and remediate what you can.

If the complaint has no merit: Provide a clear, evidence-based explanation of why your conduct was compliant with PIPEDA. Avoid dismissive language — treat the complainant's concern seriously even if you believe the complaint is unfounded.

Response timeline: Set and communicate a target date for your response. For complex matters, communicate proactively if you need more time.

Step 6: If the Matter Escalates to the OPC

If the complainant has gone to the OPC, or escalates after your internal response:

OPC Initial Contact

The OPC will typically:

1. Send you a copy of the complaint (or summary)
2. Request your response and any relevant documentation
3. Set a timeline for your response

Preparing Your OPC Response

Your response to the OPC should:

• Address each specific allegation in the complaint
• Provide relevant evidence and documentation
• Reference applicable PIPEDA provisions that support your position
• Describe any corrective actions already taken
• Be factually accurate and complete — do not misrepresent facts to the OPC

Tone: Professional, cooperative, and factual. The OPC is not an adversary — they are conducting an investigation to determine whether there was a PIPEDA violation.

OPC Investigation Process

The OPC investigation typically proceeds:

1. Intake and assessment — OPC determines whether to investigate
2. Information gathering — OPC requests documents and responses from both parties
3. Mediation attempt — OPC may facilitate resolution between parties
4. Investigation — if not resolved, OPC investigates and may interview witnesses
5. Preliminary findings — OPC shares draft findings and gives you opportunity to respond
6. Final report — OPC issues findings and recommendations

OPC Outcomes

OPC findings are not legally binding orders (under current PIPEDA). Dispositions the OPC uses include (OPC: Types of dispositions):

• Well-founded — the organization contravened PIPEDA
• Well-founded and resolved — contravention found, corrective measures taken to the OPC's satisfaction
• Well-founded and conditionally resolved — contravention found, organization committed to agreed corrective actions
• Not well-founded — no or insufficient evidence of a contravention
• Settled — the OPC helped negotiate a solution during the investigation and did not issue a finding
• Discontinued — investigation discontinued without a finding (s. 12.2(1))
• Withdrawn — the complainant withdrew or could no longer be reached

After receiving the Commissioner's report, the complainant (s. 14) or the Commissioner (s. 15) may apply to the Federal Court, which can order an organization to correct its practices and award damages (s. 16).

Published findings: The OPC publishes investigation findings on its website (OPC investigations), which can create reputational impact.

Step 7: OPC Recommendations and Compliance Orders

If the OPC finds a violation and makes recommendations:

• Take them seriously — while not legally binding under PIPEDA, the matter can proceed to a Federal Court application (ss. 14–15)
• Implement recommended changes promptly
• Notify the OPC of corrective actions taken
• Document all changes made in response to OPC recommendations

Proactive Steps After Any Complaint

Regardless of outcome, use every complaint as an opportunity to improve:

1. Root cause analysis — what caused the underlying issue?
2. Policy review — does your privacy policy need updating?
3. Process review — what processes failed or were absent?
4. Training update — do staff need additional privacy training?
5. Breach/incident register — record the complaint and outcome in your privacy incident register

Special Considerations for Quebec Complaints (CAI)

Complaints under Quebec Law 25 go to the Commission d'accès à l'information (CAI). Key differences from OPC process:

• CAI can issue binding orders — OPC recommendations are advisory
• CAI can impose direct financial penalties — OPC currently cannot
• Enterprises must notify the CAI promptly of confidentiality incidents presenting a risk of serious injury
• Respond in French (or bilingual) when corresponding with the CAI

Frequently Asked Questions

Q: Can we refuse to respond to a frivolous or vexatious OPC complaint? A: No — you must respond to all OPC complaints. If you believe a complaint is without merit, explain why factually in your response. The OPC will determine whether to investigate.

Q: Should we involve lawyers in an OPC complaint? A: For complex complaints involving potential serious violations, yes — engage legal counsel early. For straightforward access request failures or minor consent issues, an internal response may be sufficient.

Q: Can we contact the complainant directly to resolve the matter after it's been filed with the OPC? A: Yes — the OPC encourages direct resolution between parties. Reaching out to resolve a complaint directly (while also cooperating with the OPC) is generally viewed favorably.

Q: How long does an OPC investigation take? A: PIPEDA s. 13(1) requires the Commissioner to prepare a report within one year after the day the complaint is filed; timing varies with complexity.

---

Prepare Before a Complaint Arrives

Canada Compliance AI helps Canadian SMEs work through CASL, PIPEDA and Quebec Law 25: a free two-minute compliance check, readiness scores, a prioritized task plan, a 24-month breach register and an exportable audit log. See what's live and what's planned.

Start your free trial today — compliance that protects you when it matters most.

Related reading: PIPEDA Compliance Guide | Data Breach Response Canada | Privacy Audit Checklist Canada