What Is PIPEDA? – Definition and How It Works
Learn what Canada's PIPEDA requires, its ten fair information principles, and how it treats publicly available data.
The Personal Information Protection and Electronic Documents Act is Canada's federal private-sector privacy law. It is principles-based rather than prescriptive. This page is a general explanation, not legal advice.
1. Scope
PIPEDA applies to organisations collecting, using, or disclosing personal information in the course of commercial activity.
Two scope features worth knowing:
- Some provinces have substantially similar laws that apply instead for intra-provincial activity — Quebec, British Columbia, and Alberta among them.
- It reaches organisations outside Canada with a real and substantial connection to Canada.
Non-commercial activity is outside its scope, which is a narrower trigger than GDPR's.
2. The Ten Fair Information Principles
PIPEDA is structured around principles rather than a list of legal bases:
| Principle | Requirement |
|---|---|
| Accountability | Designate someone responsible |
| Identifying purposes | State why, before collecting |
| Consent | Obtain meaningful consent |
| Limiting collection | Collect only what the purpose needs |
| Limiting use, disclosure, retention | Use only for the stated purpose; retain no longer than needed |
| Accuracy | Keep information accurate and current |
| Safeguards | Protect it appropriately |
| Openness | Make policies available |
| Individual access | Provide access and correction |
| Challenging compliance | Provide a complaint route |
3. Consent Is Central
Where GDPR offers several legal bases, PIPEDA centres consent — express or implied depending on sensitivity, and required to be meaningful: the individual must understand what is collected, why, and to whom it is disclosed.
That framing makes undisclosed collection harder to justify than under a legitimate-interest analysis, because the question is whether the individual would reasonably understand and expect it.
4. Publicly Available Information
PIPEDA has a narrow, enumerated exception. Regulations specify categories of publicly available information that may be collected, used, and disclosed without consent — such as certain public registries, telephone directories, and professional listings, generally with a condition that use relates to the purpose of publication.
The important point: the exception is a defined list, not a general principle that anything published online is fair game. Information posted publicly on a website is not automatically within it, and a social media profile is generally not a listed category.
That is a meaningful contrast with the intuition that public equals usable.
5. Accuracy Is an Obligation
Uncommon among privacy regimes to emphasise this, and directly relevant to collected data: PIPEDA requires personal information to be as accurate, complete, and up to date as necessary for its purpose.
For anyone building a dataset about people from web sources, that has teeth. Stale scraped records used to make decisions about individuals are a compliance problem, not merely a quality one — and it argues for recording observation dates and refreshing rather than accumulating.
6. What This Means for Collection
- Establish whether the activity is commercial — that is the scope trigger.
- Check whether the data is personal information at all; much collected data is not.
- Do not assume a public-data exception. It is an enumerated list, and a website is usually not on it.
- State purposes narrowly and use data only for them.
- Keep records accurate and dated, since accuracy is an obligation.
- Limit retention, and be able to delete.
- Check provincial law, which may apply instead of the federal act.
7. Enforcement and Direction
The Office of the Privacy Commissioner investigates complaints and issues findings. Historically PIPEDA's enforcement powers were weaker than GDPR's, and reform to strengthen them has been an ongoing legislative topic — so the enforcement posture should be treated as tightening rather than static.
8. Summary
PIPEDA is Canada's federal private-sector privacy law, triggered by commercial activity, structured around ten fair information principles, and centred on meaningful consent rather than a menu of legal bases.
Its publicly-available-information exception is a narrow enumerated list rather than a general permission, so a public website is usually not covered — and its explicit accuracy obligation means stale collected records about people are a compliance issue, which argues for dated observations and active refreshing.