PIPEDA (Personal Information Protection and Electronic Documents Act)

PIPEDA is Canada's federal private-sector privacy law, governing how organizations handle personal information in the course of commercial activity where provincial law does not apply.

PIPEDA is overseen by the Office of the Privacy Commissioner of Canada. It is built on fair information principles such as accountability, consent, limiting collection and appropriate safeguards. Since 2018, organizations subject to PIPEDA must report breaches that pose a real risk of significant harm, notify affected individuals and keep records of all breaches of security safeguards.

Because Alberta has its own substantially similar law, PIPA usually governs Alberta businesses handling information within the province. However, PIPEDA can still apply to federally regulated businesses, such as banks, airlines and telecommunications companies, and to personal information that crosses provincial or national borders in commercial activity. Some Alberta organizations therefore need to consider both laws.

Practical tip: if you sell across Canada, use cloud services hosted outside Alberta or work with federally regulated clients, ask a privacy lawyer which laws apply to you. Build one incident response process that meets the stricter of the requirements.