PIPEDA

Who it applies to

Private-sector organisations that collect, use or disclose personal information in commercial activity, except within provinces with substantially similar laws (such as Quebec, Alberta and British Columbia) for intra-provincial activity; also federally regulated businesses.

Key requirements

• Accountability, including a designated person responsible for compliance.
• Identify purposes and obtain meaningful consent.
• Limit collection, use, disclosure and retention.
• Safeguards appropriate to the sensitivity of the information.
• Openness, individual access and the ability to challenge compliance.
• Keep records of every breach of security safeguards.

Breach and incident notification

Breaches of security safeguards that create a real risk of significant harm are reported to the Privacy Commissioner and notified to affected individuals as soon as feasible. Records of all breaches are kept for 24 months.

Penalties

Fines of up to CAD 100,000 per violation for knowingly failing to report breaches, notify individuals or keep breach records.

Go deeper