Canada Personal Information Protection and Electronic Documents Act (PIPEDA)

Dates and status re-checked against primary sources on September 30, 2026. How we verify

Canada's federal private-sector privacy law, phased in from January 1, 2001 and fully in force since January 1, 2004, governing how organizations collect, use, and disclose personal information in the course of commercial activity. The Office of the Privacy Commissioner has issued guidance on how PIPEDA applies to AI, including automated decision-making and AI training data. Quebec's Law 25 (phased in between September 2022 and September 2024) is stricter and acts as the provincial overlay for Quebec residents.

Key requirements

• Meaningful consent required for collection, use, and disclosure of personal information
• Individuals can access their personal information and challenge inaccuracies
• Designated Privacy Officer accountable for PIPEDA compliance
• Mandatory breach notification to OPC and affected individuals for breaches creating real risk of significant harm
• Quebec Law 25: privacy impact assessments, notice and review rights for decisions made exclusively by automated processing, stricter breach reporting

Further reading

• AI Data Privacy for Small Teams: 9-Tool DPA Table + GDPR/CCPA Checklist (2026)
• AI Vendor Due Diligence in 30 Minutes (Questions + Scoring Sheet)