PrivacyTerrainStructured privacy law intelligence

north america

Canada

Canada's federal private-sector privacy regime is anchored in PIPEDA, but public comparison should account for substantially similar provincial laws and parallel public-sector frameworks.

Primary lawPersonal Information Protection and Electronic Documents Act
Statusin-force
Last reviewed17/04/2026
Coverage qualityfederal-split
Confidencemedium
Primary sources1
Secondary sources1
Last checkedUnknown
Freshnessunknown
Review priorityhigh

Editorial caveat

Structured values summarize official materials for research and planning. They are reviewed by humans before publication and should not be treated as legal advice.

medium confidence, Public comparison should distinguish PIPEDA from substantially similar provincial private-sector laws and separate public-sector frameworks.

Breach

Breach deadline (hours)
0
Breach notification required
Yes

Marketing

Cookie consent rule
Consent analysis is contextual and shaped by OPC guidance on online tracking and meaningful consent.

Transfers

Cross-border transfer restricted
No
Data localization required
No

Governance

DPO required
No
Impact assessment required
No
Records of processing required
No

Identity

Effective date
2001-01-01
Effective status
in-force
Last amended
2018-11-01
Law status
active

Scope

Extraterritorial application
No
Private sector coverage
Federal private-sector organizations engaged in commercial activities, unless substantially similar provincial law applies.
Public sector coverage
Federal public-sector privacy obligations are governed separately under the Privacy Act.
Territorial scope
Applies to personal information collected, used, or disclosed in the course of commercial activities in Canada, subject to provincial carve-outs.

Legal Basis

Legal bases
consent, statutory exception, reasonable purpose
Requires legal basis
No

Enforcement

Maximum fine
PIPEDA historically relies more on ombudsman-style enforcement than large administrative fines.
Private right of action
No
Regulator or enforcement authority summary
OPC Canada and some provincial authorities

Definitions

Personal data definition
Personal information means information about an identifiable individual.
Sensitive data recognized
Yes

Rights

Right of access
Yes
Right to appeal
Yes
Right to deletion
No
Right to erasure or delete summary
No broad federal erasure right
Right to object
No
Right to portability
No
Right to rectification or correction summary
Correction right

Official sources

Recent change workflow