Who does PIPEDA apply to?

PIPEDA governs how private sector organizations across Canada collect, use, and disclose personal information in the course of commercial activity, including when information crosses provincial or national borders. It is enforced by the Office of the Privacy Commissioner of Canada (OPC). Provinces with substantially similar legislation, such as Québec with Law 25, apply their own law to intraprovincial activities.

When must a breach be reported to the OPC?

PIPEDA requires organizations to report to the OPC any breach of security safeguards that poses a real risk of significant harm to an individual, as soon as feasible after determining that it occurred, to notify affected individuals, and to keep a record of all breaches. Sentrix automates breach classification, OPC report documentation and affected individual notification records.

Does the federal reform replace PIPEDA?

A federal privacy reform was proposed under the former Bill C-27, which provided for a Consumer Privacy Protection Act with stronger consent requirements, a right to disposal and higher penalties. Until a new law is enacted, PIPEDA remains in force; Sentrix tracks the reform's progress and shows your current controls against the proposed requirements.

Framework · PIPEDA

PIPEDA: ten principles, enforceable obligations

Canada's federal private-sector privacy law: ten fair information principles, breach reporting to the Privacy Commissioner and the bridge to GDPR adequacy.

PIPEDA (Personal Information Protection and Electronic Documents Act) governs how private sector organizations across Canada collect, use, and disclose personal information in the course of commercial activity. It is enforced by the Office of the Privacy Commissioner of Canada (OPC). A federal reform, proposed under the former Bill C-27, would have replaced it with a Consumer Privacy Protection Act; Sentrix tracks its progress.

Key facts

10 principles: the fair information principles, drawn from the Canadian Standards Association code.
OPC: the Office of the Privacy Commissioner of Canada receives breach reports and complaints.
Real risk of significant harm: the threshold for reporting breaches to the OPC and notifying individuals, as soon as feasible.
GDPR adequacy: Canada holds a European Union adequacy decision for organizations subject to PIPEDA.

What PIPEDA requires

PIPEDA is built on ten fair information principles. While the principles are high-level, the OPC and courts have consistently held that meaningful compliance requires technical controls, not just policy statements.

Accountability: designated privacy officer, privacy program governance
Identifying purposes: documented purpose limitation for all data collection
Consent: valid consent mechanisms with withdrawal tracked
Limiting collection, use and retention: data minimization controls and inventory
Safeguards: encryption, access control, and breach detection evidence
Openness and individual access: privacy notice and data subject request handling

What Sentrix provides for PIPEDA

Privacy officer governance

PIPEDA requires a designated individual accountable for compliance. Sentrix provides the governance infrastructure that privacy officer needs: program documentation, evidence, and reporting to demonstrate accountability to the OPC.

Breach reporting workflow

Sentrix automates breach classification against the real risk of significant harm threshold, OPC report documentation, affected individual notification records and the breach register.

Data subject requests

Individuals have the right to access and correct their personal information. Sentrix tracks all requests with response deadline monitoring and documentation archived for OPC review.

Federal reform readiness

Sentrix tracks the progress of the federal privacy reform and shows your current PIPEDA controls against the proposed requirements, including stronger consent, a right to disposal and algorithmic transparency.

Crosswalks

Law 25: organizations operating in both Québec and other provinces manage PIPEDA and Law 25 from one program; the overlap in consent, access rights, and safeguards is mapped.
GDPR: Canada holds adequacy status, but organizations must demonstrate their practices meet it; Sentrix maps PIPEDA controls to GDPR requirements.
ISO 27001: Annex A controls address the safeguards principle.
SOC 2: the Privacy category of the Trust Services Criteria is mapped to the PIPEDA principles.

See your PIPEDA compliance posture live.

Contact us

Frequently asked questions

Who does PIPEDA apply to?: PIPEDA governs how private sector organizations across Canada collect, use, and disclose personal information in the course of commercial activity, including when information crosses provincial or national borders. It is enforced by the Office of the Privacy Commissioner of Canada (OPC). Provinces with substantially similar legislation, such as Québec with Law 25, apply their own law to intraprovincial activities.
When must a breach be reported to the OPC?: PIPEDA requires organizations to report to the OPC any breach of security safeguards that poses a real risk of significant harm to an individual, as soon as feasible after determining that it occurred, to notify affected individuals, and to keep a record of all breaches. Sentrix automates breach classification, OPC report documentation and affected individual notification records.
Does the federal reform replace PIPEDA?: A federal privacy reform was proposed under the former Bill C-27, which provided for a Consumer Privacy Protection Act with stronger consent requirements, a right to disposal and higher penalties. Until a new law is enacted, PIPEDA remains in force; Sentrix tracks the reform's progress and shows your current controls against the proposed requirements.

Related pages

Let's talk about your compliance program.