If your business collects names, emails, phone numbers, payment details or any other information about identifiable people, Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) almost certainly affects you. The good news: PIPEDA is principle-based. You do not need an in-house legal team to comply — you need a clear process and the discipline to follow it.
This guide translates PIPEDA’s 10 fair information principles into a practical checklist for small and mid-sized businesses.
Does PIPEDA apply to my business?
PIPEDA applies to private-sector organizations that collect, use or disclose personal information in the course of commercial activity. A few nuances matter:
- Quebec, Alberta and British Columbia have their own private-sector privacy laws that are considered “substantially similar”. Inside those provinces, the provincial law generally governs — but PIPEDA still applies when personal information crosses provincial or national borders in a commercial transaction.
- Federally regulated businesses (for example banks, airlines and telecom companies) are covered by PIPEDA everywhere in Canada.
- “Personal information” is broad: it includes any information about an identifiable individual — from a customer’s email address to an employee’s performance review (for federally regulated employers) or an IP address linked to a profile.
The 10 principles as a checklist
1. Accountability
Someone in your organization must be responsible for privacy.
- Name a privacy officer (in a small business this can be the owner or operations lead).
- Publish a way to contact that person, such as privacy@yourdomain.
- Make sure contracts with service providers (hosting, CRM, payroll, email marketing) require them to protect the data you share.
2. Identifying purposes
- Write down why you collect each type of personal information — order fulfilment, billing, support, marketing, analytics.
- Explain those purposes to people at or before the time of collection (for example on forms and in your privacy policy).
3. Consent
- Obtain meaningful consent: people should understand what is collected, why, who it is shared with and the risks involved.
- Use express (opt-in) consent for sensitive information such as health or financial data, and for uses people would not reasonably expect.
- Make it easy to withdraw consent — and actually honour withdrawals.
4. Limiting collection
- Audit your forms. Remove every field you do not genuinely need (date of birth “just in case” is a common offender).
5. Limiting use, disclosure and retention
- Use information only for the purposes you identified, unless you obtain new consent.
- Set retention periods for each data category and delete or anonymize data when it is no longer needed.
6. Accuracy
- Give customers a simple way to update their details, and correct errors promptly when they are reported.
7. Safeguards
- Use protections proportionate to sensitivity: multi-factor authentication, encryption, role-based access, locked devices, secure disposal.
- Train staff — most incidents start with a phishing email or a misdirected attachment.
8. Openness
- Publish a clear, plain-language privacy policy. See our privacy policy checklist for Canadian businesses.
9. Individual access
- Have a process for access requests. Under PIPEDA you generally have 30 days to respond. Our guide to handling access requests walks through each step.
10. Challenging compliance
- Offer a simple complaint process, investigate complaints, and tell people they can also complain to the Office of the Privacy Commissioner of Canada (OPC).
Don’t forget breach reporting
Since 2018, PIPEDA requires organizations to report breaches of security safeguards that create a real risk of significant harm to the OPC, notify affected individuals as soon as feasible, and keep a record of every breach for 24 months — even the ones that do not need to be reported. Knowingly failing to report or keep records can lead to fines of up to $100,000. Read our step-by-step data breach response plan to get ready before something happens.
Common mistakes we see
- Copying another company’s privacy policy that does not match how you actually handle data.
- Pre-checked consent boxes for marketing emails (also a problem under CASL).
- No inventory of where personal information lives — spreadsheets, shared drives, old CRM exports.
- Keeping data forever because deleting it was nobody’s job.
A 30-day starter plan
- Week 1: Appoint a privacy officer and list every system that stores personal information.
- Week 2: Document purposes and retention periods for each data type; trim unnecessary form fields.
- Week 3: Update your privacy policy and consent wording; review vendor contracts.
- Week 4: Write a short breach response procedure and an access-request procedure, then brief your team.
Frequently asked questions
Is PIPEDA being replaced?
The federal government proposed replacing it with the Consumer Privacy Protection Act through Bill C-27, but that bill died when Parliament was prorogued in January 2025. PIPEDA remains in force. Building good practices now will make any future transition much easier.
Does PIPEDA apply to my employees’ data?
Only for federally regulated employers. Provincially regulated employers in Alberta, BC and Quebec have employee-privacy obligations under their provincial laws.
Do small businesses get an exemption?
No. PIPEDA applies regardless of company size, although expectations for safeguards scale with the sensitivity and volume of the data you hold.
Get a second pair of eyes
Secure Pathways helps small and mid-sized businesses turn privacy requirements into a clear, manageable routine — from privacy audits and policy templates to consent management and breach readiness. If you are not sure where you stand on PIPEDA compliance, get in touch for a complimentary consultation.
This article is general information, not legal advice. Privacy rules change and depend on your industry and province — confirm your obligations with a qualified professional.
