PIPEDA coverage
Personal Information Protection and Electronic Documents Act
Canada's federal private-sector privacy law: the 10 fair information principles in Schedule 1, individual access, and breach reporting and record-keeping.
General information, not legal advice. Coverage reflects the product as of the last-updated date (September 12, 2026). These lists are not exhaustive — they cover the obligations most relevant to small and medium businesses, including ones the product does not cover.
Pending reform: Bill C-27 died on the Order Paper in January 2025. Bill C-36, which would enact the Protecting Privacy and Consumer Data Act and amend PIPEDA, was introduced on June 15, 2026 and is at second reading in the House of Commons.
- Live
- 1
- Guidance
- 11
- Planned
- 2
- Not covered
- 2
16 obligations listed · 6 self-assessment questions feed the PIPEDA score
How to read the status
- Live
- A shipped product feature does part of the work today.
- Guidance
- We explain it in our guides, articles or in-app knowledge centres. No tool does the work.
- Planned
- On the dated product roadmap. Not available today.
- Not covered
- No product feature and no dedicated explanation from us today. It may be mentioned in passing elsewhere.
Separately, each row shows which self-assessment questions ask about it. A question records your answer — it does not verify your practices.
Obligations
- Guidance
Designate an individual (or individuals) accountable for the organization's compliance with the principles, and make their identity known on request.
Coverage
Explained in: PIPEDA guide
The in-app PIPEDA & Law 25 knowledge centre includes a Privacy Officer starter kit (copyable templates).
Self-assessment
- Q2 — Have you designated a Privacy Officer for your organization? (counts toward the PIPEDA score)
Source
Sch. 1, cl. 4.1, 4.1.2
PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab)
- Planned
Stay responsible for personal information transferred to a third party for processing, and use contracts or other means to provide a comparable level of protection.
Coverage
Roadmap: AODA accessibility scanner & vendor tracking — Fall 2026
Explained in: Data processing agreements in Canada
Vendor tracking is not available today; this is explained in guidance only.
Self-assessment
- Q7 — Do the vendors that handle your customers' personal information have signed privacy commitments (DPAs), and is the sharing disclosed? (counts toward the PIPEDA score)
Source
Sch. 1, cl. 4.1.3
PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab)
- Guidance
Identify the purposes for collecting personal information at or before the time it is collected, and document them.
Coverage
Explained in: PIPEDA guide
Self-assessment
- Q10 — Have you documented what personal information you collect and why? (counts toward the PIPEDA score)
Source
Sch. 1, cl. 4.2, 4.2.1
PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab)
- Guidance
Obtain the knowledge and consent of the individual to collect, use or disclose personal information, except where the law says it is inappropriate.
Coverage
Explained in: PIPEDA guide · PIPEDA consent requirements
Self-assessment
Not asked
Source
Sch. 1, cl. 4.3
PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab)
- Not covered
Collect, use or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances.
Coverage
—
Self-assessment
Not asked
- Guidance
Limit collection to what is necessary for the identified purposes, and collect it by fair and lawful means.
Coverage
Explained in: PIPEDA guide · PIPEDA's 10 principles
Self-assessment
Not asked
Source
Sch. 1, cl. 4.4
PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab)
- Guidance
Use or disclose personal information only for the purposes it was collected for, keep it only as long as needed, and have procedures for destroying it.
Coverage
Explained in: Data retention policies in Canada
Self-assessment
Not asked
Source
Sch. 1, cl. 4.5, 4.5.3
PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab)
- Guidance
Keep personal information as accurate, complete and up to date as necessary for the purposes it is used for.
Coverage
Explained in: PIPEDA guide · PIPEDA's 10 principles
Self-assessment
Not asked
Source
Sch. 1, cl. 4.6
PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab)
- Guidance
Protect personal information with security safeguards appropriate to its sensitivity.
Coverage
Explained in: PIPEDA guide · PIPEDA's 10 principles
Self-assessment
Not asked
Source
Sch. 1, cl. 4.7
PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab)
- Planned
Make specific information about your policies and practices for managing personal information readily available.
Coverage
Roadmap: PIPEDA privacy policy generator — Fall 2026
Explained in: PIPEDA guide
The privacy policy generator is not available today; this is explained in guidance only.
Self-assessment
- Q4 — Do you have a privacy policy published on your website? (counts toward the PIPEDA score)
Source
Sch. 1, cl. 4.8
PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab)
- Guidance
On written request, tell individuals whether you hold their personal information, give them access to it, and respond no later than 30 days after receiving the request. Let them challenge its accuracy and have it amended.
Coverage
Explained in: Responding to PIPEDA access requests
The product's account data export covers your own account with us — it is not a tool for handling your customers' requests.
Self-assessment
- Q11 — Do you have a process for customers to access, correct, or delete their personal information? (counts toward the PIPEDA score)
Source
s. 8(1), 8(3); Sch. 1, cl. 4.9, 4.9.5
PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab)
- Not covered
Help any individual who tells you they need assistance preparing an access request.
Coverage
—
Self-assessment
Not asked
- Guidance
Put procedures in place to receive and respond to complaints or inquiries about how you handle personal information.
Coverage
Explained in: Responding to privacy complaints
Self-assessment
Not asked
Source
Sch. 1, cl. 4.10.2
PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab)
- Guidance
Report to the Privacy Commissioner, as soon as feasible, any breach of security safeguards that creates a real risk of significant harm, and notify the affected individuals.
Coverage
Explained in: PIPEDA guide
The breach register lets you record your risk assessment and whether the Commissioner and individuals were notified, but it does not file reports or send notifications. The in-app knowledge centre includes a breach response playbook.
Self-assessment
- Q9 — Do you have a documented data breach response plan? (counts toward the PIPEDA score)
Source
s. 10.1(1)–(3), (6)
PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab)
- Guidance
When you notify individuals of a breach, also notify any organization or government institution that may be able to reduce the risk of harm.
- Live
Keep a record of every breach of security safeguards involving personal information — including breaches below the reporting threshold — for 24 months, and give the Commissioner access on request.
Coverage
Feature: PIPEDA breach register: logs each incident with discovery date, incident type, data involved, risk assessment, containment steps and notification status, and shows a retention date 24 months after the discovery date.
Explained in: PIPEDA breach record-keeping
Self-assessment
Not asked
Source
| Obligation | Status | Coverage | Self-assessment | Source |
|---|---|---|---|---|
| Designate an individual (or individuals) accountable for the organization's compliance with the principles, and make their identity known on request. | Guidance | Explained in: PIPEDA guide The in-app PIPEDA & Law 25 knowledge centre includes a Privacy Officer starter kit (copyable templates). |
| Sch. 1, cl. 4.1, 4.1.2 PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab) |
| Stay responsible for personal information transferred to a third party for processing, and use contracts or other means to provide a comparable level of protection. | Planned | Roadmap: AODA accessibility scanner & vendor tracking — Fall 2026 Explained in: Data processing agreements in Canada Vendor tracking is not available today; this is explained in guidance only. |
| Sch. 1, cl. 4.1.3 PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab) |
| Identify the purposes for collecting personal information at or before the time it is collected, and document them. | Guidance | Explained in: PIPEDA guide |
| Sch. 1, cl. 4.2, 4.2.1 PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab) |
| Obtain the knowledge and consent of the individual to collect, use or disclose personal information, except where the law says it is inappropriate. | Guidance | Explained in: PIPEDA guide · PIPEDA consent requirements | Not asked | Sch. 1, cl. 4.3 PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab) |
| Collect, use or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances. | Not covered | — | Not asked | |
| Limit collection to what is necessary for the identified purposes, and collect it by fair and lawful means. | Guidance | Explained in: PIPEDA guide · PIPEDA's 10 principles | Not asked | Sch. 1, cl. 4.4 PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab) |
| Use or disclose personal information only for the purposes it was collected for, keep it only as long as needed, and have procedures for destroying it. | Guidance | Explained in: Data retention policies in Canada | Not asked | Sch. 1, cl. 4.5, 4.5.3 PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab) |
| Keep personal information as accurate, complete and up to date as necessary for the purposes it is used for. | Guidance | Explained in: PIPEDA guide · PIPEDA's 10 principles | Not asked | Sch. 1, cl. 4.6 PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab) |
| Protect personal information with security safeguards appropriate to its sensitivity. | Guidance | Explained in: PIPEDA guide · PIPEDA's 10 principles | Not asked | Sch. 1, cl. 4.7 PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab) |
| Make specific information about your policies and practices for managing personal information readily available. | Planned | Roadmap: PIPEDA privacy policy generator — Fall 2026 Explained in: PIPEDA guide The privacy policy generator is not available today; this is explained in guidance only. |
| Sch. 1, cl. 4.8 PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab) |
| On written request, tell individuals whether you hold their personal information, give them access to it, and respond no later than 30 days after receiving the request. Let them challenge its accuracy and have it amended. | Guidance | Explained in: Responding to PIPEDA access requests The product's account data export covers your own account with us — it is not a tool for handling your customers' requests. |
| s. 8(1), 8(3); Sch. 1, cl. 4.9, 4.9.5 PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab) |
| Help any individual who tells you they need assistance preparing an access request. | Not covered | — | Not asked | |
| Put procedures in place to receive and respond to complaints or inquiries about how you handle personal information. | Guidance | Explained in: Responding to privacy complaints | Not asked | Sch. 1, cl. 4.10.2 PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab) |
| Report to the Privacy Commissioner, as soon as feasible, any breach of security safeguards that creates a real risk of significant harm, and notify the affected individuals. | Guidance | Explained in: PIPEDA guide The breach register lets you record your risk assessment and whether the Commissioner and individuals were notified, but it does not file reports or send notifications. The in-app knowledge centre includes a breach response playbook. |
| s. 10.1(1)–(3), (6) PIPEDA (S.C. 2000, c. 5) — Justice Laws (opens in a new tab) |
| When you notify individuals of a breach, also notify any organization or government institution that may be able to reduce the risk of harm. | Guidance | Explained in: PIPEDA guide | Not asked | |
| Keep a record of every breach of security safeguards involving personal information — including breaches below the reporting threshold — for 24 months, and give the Commissioner access on request. | Live | Feature: PIPEDA breach register: logs each incident with discovery date, incident type, data involved, risk assessment, containment steps and notification status, and shows a retention date 24 months after the discovery date. Explained in: PIPEDA breach record-keeping | Not asked |
Guides to PIPEDA
Plain-language explainers on PIPEDA, each citing the statute or regulator guidance it draws on.
- What is PIPEDA? Meaning, Principles and Who Must ComplyWhat PIPEDA is, who it applies to, and the 10 fair information principles Canadian businesses must follow — in plain language, with official sources.
- PIPEDA's 10 Principles Explained, With ExamplesPIPEDA's 10 fair information principles explained one by one, with what each asks of a small business and how to show you have met it.
- PIPEDA Consent Requirements: Express vs Implied for Canadian BusinessesHow PIPEDA consent works: when express consent is required, when implied consent is enough, and how to document that consent was meaningful.
- PIPEDA Access Requests: How to Respond Within 30 DaysHow to handle a PIPEDA access request: the 30-day clock, what you must provide, the limited exceptions, and how to document your response.
- PIPEDA Compliance Checklist 2026: 10 Requirements Every Canadian SMB Must MeetPIPEDA compliance checklist for Canadian small businesses: the 10 requirements explained, plus a 30-item action checklist to audit your own practices.
- PIPEDA Penalties and Fines 2026: What Canadian Businesses Actually RiskWhat PIPEDA non-compliance actually costs in 2026: the offence provisions, how the Privacy Commissioner handles complaints, and the real exposure.
- PIPEDA Breach Recordkeeping: What to Document After a Data BreachPIPEDA requires a record of every breach of security safeguards for 24 months — what each record must contain and when you must report to the OPC.
- Data Breach Notification Canada: Step-by-Step Response Guide for the First 72 HoursWhat to do in the first 72 hours of a privacy breach in Canada: contain, assess real risk of significant harm, notify, and record what you did.
- Building a Privacy Management Programme for Canadian BusinessesA privacy management programme (PMP) formalises your PIPEDA compliance: the eight components, the documentation package and how to keep it a living programme.