Definition and purpose

PIPEDA is designed to protect individuals' personal information and ensure that organizations are accountable for the handling of such information. It sets out principles for the fair and transparent collection, use, and disclosure of personal information and gives individuals the right to access their own information.

Governing Body

The Office of the Privacy Commissioner of Canada (OPC) oversees and enforces PIPEDA. The OPC is responsible for investigating complaints, conducting audits, and promoting compliance with the legislation.

Last updated

PIPEDA was last updated when the Digital Privacy Act received Royal Assent in 2015. The Act introduced a number of amendments to the PIPEDA, including new provisions related to breach reporting.

Since then, there have been several bills that proposed amendments to PIPEDA that have not taken effect. The latest, Bill C-27, would repeal Part 1 of the PIPEDA and enact the Consumer Privacy Protection Act (CPPA), the Personal Information and Data Protection Tribunal Act (PIDPTA), and the Artificial Intelligence and Data Act (AIDA). Most recently in April 2023, this bull has been referred to the Standing Committee on Industry and Technology (the “Committee”) for further study.

Applies to

PIPEDA applies to private sector organizations operating in Canada that collect, use, or disclose personal information during commercial activities. This includes a wide range of industries such as banking, healthcare, retail, and technology. 

Controls and requirements

PIPEDA outlines several key requirements for organizations covered by PIPEDA, including obtaining consent for data collection and use, providing individuals with access to their personal information, protecting this information with appropriate safeguards, and only using it for intended purposes. 

Please refer to the official legislation for a detailed list of requirements. 

Audit type, frequency, and duration

The Office of the Privacy Commissioner of Canada (OPC) may conduct audits to assess an organization's compliance with PIPEDA.

The law does not prescribe a frequency — only that these audits can occur “on reasonable notice and at any reasonable time.” So audit frequency is determined by the OPC based on factors such as the organization's size, the nature of its activities, and any specific privacy concerns or complaints.

The duration of an audit can range from several weeks to several months, depending on the complexity of the assessment and the organization's cooperation.