Digital Trust PractitionersAssociation of Digital Trust Practitioners · TrustPractitioners.org
JoinJoin
Regulations › Rest of world › Canada

PIPEDA

Personal Information Protection and Electronic Documents Act (Canada)

In force privacy
WhenIn effect since 1 January 2001
Who enforces itOffice of the Privacy Commissioner of Canada
Who it applies toPrivate-sector organizations handling personal information in commercial activity, outside provinces with substantially similar laws.
Tell the regulatorReport to the Commissioner as soon as feasible if a breach creates a real risk of significant… DPO requiredEvery organization must designate an individual accountable for compliance RegistrationNot addressed Transfers abroadOrganization remains accountable and must use contracts or other means to ensure comparable pr… Request deadlineRespond within 30 days, extendable by up to 30 more days Maximum fineFines up to CAD 100,000 on indictment (CAD 10,000 summary) for knowing breach-reporting and li…
90%

of Canada's 21 requirements are already met by European Union (GDPR). Here is what PIPEDA adds, biggest gaps first.

Lawful basisReach and lawful basisBig gap
GDPR1 Six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests.
PIPEDA adds3 Consent is the default basis, with limited statutory exceptions. s.7; Sch. 1 cl. 4.3 · source ↗
DPO requiredGovernanceBig gap
GDPR1 DPO required for public bodies, large-scale systematic monitoring, or large-scale special-category or criminal data processing.
PIPEDA adds3 Every organization must designate an individual accountable for compliance. Sch. 1 cl. 4.1 · source ↗

Already covered by GDPR: Reach abroad, Consent, Sensitive data, Children, Rights, Request deadline, Marketing, DPO qualifications, Registration, DPIA, Records, Retention, Tell the regulator, Tell people, Transfers abroad, Localization, Maximum fine, Criminal liability, Private action.

A gap means PIPEDA is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.

Regulations library

Every US state privacy law, on one map

24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.

Explore the mapFollow Regulatory Watch
  • In force
  • Coming into force
  • Sector laws
AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL