PIPEDA

PIPEDA, the Personal Information Protection and Electronic Documents Act, is Canada’s federal privacy law for private-sector organizations that collect, use or disclose personal information in the course of commercial activity.

Who it covers. According to the Office of the Privacy Commissioner of Canada (OPC), which oversees it, PIPEDA applies to businesses across Canada handling personal information in commercial activity. Federally regulated organizations, such as banks, airlines, telecommunications companies and broadcasters, are always covered, including for their employees’ information. Alberta, British Columbia and Quebec have private-sector laws deemed substantially similar, which apply instead within those provinces. Personal information that crosses provincial or national borders in commercial activity stays subject to PIPEDA wherever the business is based.

What it requires. PIPEDA defines personal information as any factual or subjective information, recorded or not, about an identifiable individual. Its obligations are organized as ten fair information principles: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance. Under the retention principle, organizations keep personal information only as long as its purposes need and set minimum and maximum retention periods. Breaches that create a real risk of significant harm must be reported to the OPC and to the affected individuals, and every breach of security safeguards must be recorded and the record kept for two years.

Reform status (as of 26 September 2026). Bill C-27, which would have replaced PIPEDA’s privacy rules with a Consumer Privacy Protection Act, was still in committee when that session of Parliament ended on 6 January 2025, and it did not become law. On 15 June 2026 the government introduced Bill C-36. It would enact the Protecting Privacy and Consumer Data Act, repeal Part 1 of PIPEDA, and rename what remains the Electronic Documents Act. LEGISinfo lists the bill at second reading in the House of Commons. Until a replacement passes and takes effect, PIPEDA applies.

For agent exchanges. The principles are framed around the collection, use, disclosure and retention of personal information, and they name no particular channel. Customer details that reach a business from an AI agent acting for the customer are still information about an identifiable individual.

Neighbouring terms. The GDPR is the EU counterpart. Data retention covers the scheduling side of the fifth principle.