Canada's privacy landscape is changing faster than most businesses realize. PIPEDA (the Personal Information Protection and Electronic Documents Act) has governed how private-sector organizations handle personal information since 2001 — but enforcement has historically been weak. That's shifting.
The Office of the Privacy Commissioner (OPC) has increased its investigative capacity, Bill C-27 (the Digital Charter Implementation Act) would replace PIPEDA with substantially stronger legislation, and provincial regulators in Quebec (Law 25), Alberta, and British Columbia are actively enforcing their own privacy statutes.
If your business collects, uses, or discloses personal information in the course of commercial activity, this applies to you.
What PIPEDA Requires
PIPEDA is built around 10 fair information principles. The ones that generate the most compliance failures:
Accountability. You must designate an individual responsible for your organization's compliance with PIPEDA. This person doesn't need a dedicated privacy role — in small organizations it's often the CEO or COO — but they must exist and be identifiable.
Limiting Collection. You may only collect personal information that is necessary for your stated purpose. "We might need it someday" is not a valid purpose under PIPEDA. Audit what data you're collecting and delete what you can't justify.
Consent. Individuals must consent to the collection, use, and disclosure of their personal information. Implied consent is acceptable in limited circumstances. For sensitive information (health data, financial information, government IDs), express consent is required.
Safeguards. You must protect personal information with security safeguards appropriate to the sensitivity of the information. A spreadsheet of customer credit card numbers on an unencrypted laptop is a PIPEDA violation waiting to become a breach notification.
Breach Notification. Since 2018, PIPEDA has required organizations to report breaches of security safeguards to the OPC and notify affected individuals if there is a "real risk of significant harm." Failure to report is itself a violation.
Quebec Law 25: The Strictest in Canada
If you do business in Quebec or collect personal information from Quebec residents, Law 25 (formerly Bill 64) applies to you and it is stricter than PIPEDA in several important ways:
- Privacy Impact Assessments (PIAs) are required for any project involving personal information from inception
- Data minimization must be actively documented, not just practiced
- Automated decision-making requires disclosure and the right to human review
- Cross-border transfers require contractual protections equivalent to Quebec law
- Consent must be granular and withdrawable at any time
Law 25 is being phased in over three years (2022–2024). The final phase, which includes the strictest requirements, took effect September 2024.
The Bill C-27 Horizon
Bill C-27, if passed, would create the Consumer Privacy Protection Act (CPPA) — effectively Canada's equivalent to GDPR. Key changes from PIPEDA:
- Fines up to $25 million or 5% of global revenue (vs. PIPEDA's $100,000 cap)
- Individual right to erasure for data collected with consent
- Mandatory algorithmic transparency for decisions affecting individuals
- Privacy tribunal with independent enforcement powers
Bill C-27 passed second reading in the House of Commons in April 2023 and remains in committee review. The timeline for Royal Assent is unclear, but organizations that build CPPA compliance now will be ahead of what is likely to become the law.
What to Do Now
Immediate (This Month)
- Designate a Privacy Officer. Even informally. Document who it is.
- Create a Privacy Policy that accurately describes what you collect and why. Cookie-cutter templates from legal databases are a starting point, not a solution.
- Inventory your data. What personal information do you hold? Where does it live? Who has access?
Near-Term (This Quarter)
- Implement a breach response plan. Know who to call, what to document, and when your 72-hour reporting window starts.
- Audit your consent mechanisms. Pre-checked checkboxes and buried consent in terms of service are not valid consent.
- Review vendor contracts. If a third party processes personal information on your behalf (your CRM, your email platform, your payroll provider), you need contractual protections in place.
Ongoing
- Train employees. Privacy awareness training is required by PIPEDA and a practical defence against breach incidents.
- Conduct annual Privacy Impact Assessments for any new system or process that involves personal information.
Cleva IT offers PIPEDA compliance gap assessments and remediation support for Canadian businesses. We're not a law firm — for legal advice, retain a privacy lawyer — but we can help you implement the technical and organizational controls that compliance requires.