Personal Information Protection and Electronic Documents Act (PIPEDA)

S.C. 2000, c. 5, Part 1

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force since 1 January 2001.

A comprehensive regime rule binding private bodies.

As of 2 September 2026.

What it requires

Obtain knowing, meaningful consent before collecting, using or disclosing personal information, and limit collection to what a reasonable person would consider appropriate for the stated purpose.
Comply with the ten Schedule 1 fair information principles, including limiting use and disclosure to the purposes for which information was collected and keeping it only as long as necessary.
Remain accountable for personal information transferred to a third party for processing, in Canada or abroad, and use contractual or other means to ensure a comparable level of protection.
Give individuals access to their own personal information on request and a way to challenge the organization's compliance with these obligations.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Governs the collection, use and disclosure of personal information by private-sector organizations in the course of commercial activity, and by any organization in connection with the personal information of its employees where the organization is a federal work, undertaking or business.

Every organization must comply with the ten Schedule 1 fair information principles (accountability, identifying purposes, consent, limiting collection, limiting use and disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance) and may collect, use or disclose personal information only for purposes a reasonable person would consider appropriate.

It excludes government institutions covered by the Privacy Act, purely personal or domestic use, and journalistic, artistic or literary purposes.

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
automated_outreach
high_risk_decisions
processes_voice
processes_biometrics
publishes_adult_content
operates_social_platform
serves_minors
operates_app_store
ships_mobile_app
aggregates_content

Read the law

official consolidated statute text, Department of Justice Canada Justice Laws Website

Back to the example · Lint your app