← Global Privacy Laws Research Library
S.C. 2000, c. 5
Personal Information Protection and Electronic Documents Act
Personal Information Protection and Electronic Documents Act: PIPEDA: Canada
Prepared by Shubhank Suman · Last reviewed
Current. The Justice Laws Website's current consolidation was updated in 2026. (Department of Justice Canada)
- Legal character
- Federal statute
- Region
- North America
What it covers
PIPEDA establishes Canada's federal private-sector framework for handling personal information in commercial activities.
Its core privacy framework incorporates the 10 principles in Schedule 1, including:
- accountability
- identifying purposes
- consent
- limiting collection
- limiting use/disclosure/retention
- accuracy
- safeguards
- openness
- individual access
- challenging compliance.
AI, privacy and cybersecurity relevance
- AI: Moderate
- Privacy: Very High
- Cyber: High
AI
Moderate / indirect
PIPEDA is not an AI statute.
It can apply to AI systems where a covered organisation collects, uses, discloses or otherwise handles personal information in the course of commercial activities.
AI-specific concerns such as automated decision-making, explainability and generative-AI training therefore arise primarily through the general privacy principles and regulatory guidance rather than through a dedicated AI chapter in PIPEDA.
Privacy
Very High
Important statutory areas include:
Section 3: purpose Section 4: application Sections 5–10: private-sector privacy rules Schedule 1: ten privacy principles Sections 10.1 onwards: breach of security safeguards Sections 11–17: complaints, investigations and court remedies Section 18: audits.
The current Justice Laws structure expressly identifies Part 1 as the protection of personal information in the private sector and contains a dedicated breach-of-security division at section 10.1. (Department of Justice Canada)
Cybersecurity
High
The safeguards principle requires protection appropriate to the sensitivity of the information.
Section 10.1 deals specifically with breaches of security safeguards. (Department of Justice Canada)
Applicability
PIPEDA generally applies to:
- private-sector organisations engaged in commercial activities
- federally regulated businesses
- interprovincial/international commercial activities,
subject to exemptions for substantially similar provincial privacy laws.
Current validity
CURRENT
Read first
Section 3 → Section 4 → Schedule 1 → Sections 5–10 → Section 10.1 → Sections 11–18.
Provisions / sections covered
Critical site distinction
Do not imply PIPEDA governs every private-sector business throughout Canada without qualification. Alberta, British Columbia and Quebec have substantially similar provincial private-sector privacy regimes, while PIPEDA continues to have specific federal/interprovincial/international applications.
Subject-matter tags
- Consent
- Automated decision-making
- Security
- Cross-border transfers
- Data protection officer
- Retention
- Transparency
- Accountability
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
- Artificial Intelligence and Data Act (AIDA), CanadaBill · HistoricalSame jurisdiction; assess applicability separately.
- Digital Charter Implementation Act, 2022: Bill C-27: CanadaBill · HistoricalSame jurisdiction; assess applicability separately.
- Operationalizing the Gen-AI Voluntary Code of Conduct for Canadian Critical Infrastructure EntitiesGuidance · Voluntary / non-bindingSame jurisdiction; assess applicability separately.
- Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems, CanadaCode of Conduct · Voluntary / non-bindingSame jurisdiction; assess applicability separately.
- Canada's Anti-Spam Legislation (CASL), S.C. 2010, c. 23Law · Current (phased commencement)Same jurisdiction; assess applicability separately.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.