PIPEDA
In force Canada · In force Jan 1, 2001 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Canada's federal private-sector privacy law based on 10 fair information principles, with mandatory breach reporting to the OPC and notification of individuals for breaches creating a real risk of significant harm. It is proposed to be replaced by the Protecting Privacy and Consumer Data Act (Bill C-36, tabled June 2026).
- Who it applies to
- Private-sector organisations collecting, using or disclosing personal information in the course of commercial activities (except in provinces with substantially similar laws, e.g. Quebec, Alberta, BC for intra-provincial activity), plus federal works, undertakings and businesses' employee data.
- Penalties
- Fines up to CAD 100,000 per offence for knowingly failing to report/record breaches or obstructing the Commissioner; no administrative monetary penalties.
- Enforced by
- Office of the Privacy Commissioner of Canada (Federal Court for orders)
- Official name
- Personal Information Protection and Electronic Documents Act
- Citation
- S.C. 2000, c. 5
- Topics
- privacy, breach-notification
Verified 2026-09-22 priv.gc.ca
Research notes
Bill C-27 (CPPA/AIDA) died on the order paper in January 2025. Successor Bill C-36 is tracked separately as ca-c36-ppcda.
Related
Questions about PIPEDA
- What are the PIPEDA compliance deadlines?
- Jan 1, 2001: PIPEDA Part 1 in force (phase 1). Jan 1, 2004: PIPEDA applies to all commercial activity. Nov 1, 2018: Mandatory breach reporting.
- When does PIPEDA take effect?
- PIPEDA took effect on Jan 1, 2001.
- Who does PIPEDA apply to?
- Private-sector organisations collecting, using or disclosing personal information in the course of commercial activities (except in provinces with substantially similar laws, e.g. Quebec, Alberta, BC for intra-provincial activity), plus federal works, undertakings and businesses' employee data.
- What are the penalties under PIPEDA?
- Fines up to CAD 100,000 per offence for knowingly failing to report/record breaches or obstructing the Commissioner; no administrative monetary penalties.