Personal Information Protection and Electronic Documents Act
Canada · Law · Parliament of Canada
Our summary
This federal law governs how private-sector organizations in Canada collect, use and disclose personal information in the course of commercial activities and for employees. It establishes obligations for organizations to handle personal data in a manner that respects individuals' privacy rights while recognizing legitimate business needs.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
40 sections
Jump to a chapter
- Language selection
- Personal Information Protection and Electronic Documents Act
- Short Title
- PART 1 Protection of Personal Information in the Private Sector
- PART 2 Electronic Documents
- PART 6 Coming into Force
- 4.1 Principle 1, Accountability
- 4.2 Principle 2, Identifying Purposes
- 4.3 Principle 3 - Consent
- 4.4 Principle 4, Limiting Collection
- 4.5 Principle 5 -Limiting Use, Disclosure, and Retention
- 4.6 Principle 6, Accuracy
- 4.7 Principle 7, Safeguards
- 4.8 Principle 8, Openness
- 4.9 Principle 9, Individual Access
- 4.10 Principle 10, Challenging Compliance
- SCHEDULE 2 (Sections 38 to 47, 49 and 51)
- SCHEDULE 3 (Sections 38 to 47, 49 and 51)
- SCHEDULE 4 (Subsection 4(1.1) and paragraph 26(2)(c))
- Amendments not in force
Language selection
Personal Information Protection and Electronic Documents Act
This Act establishes rules to protect personal information collected, used or disclosed in defined circumstances, provides for electronic communication and record-keeping, and amends related federal legislation. It applies to organizations in the private sector and those operating federal works or undertakings.
Short Title
The Act is cited as the Personal Information Protection and Electronic Documents Act.
PART 1 Protection of Personal Information in the Private Sector
9 sections
Part 1 covers protections for personal information in the private sector, including definitions and interpretation, the Act's purpose, application rules, protection of personal information, security breaches, remedies, audits, and transitional provisions.
Interpretation
The Act defines key terms including alternative format, breach of security safeguards, business contact information, business transaction, commercial activity, Commissioner, Court, federal work undertaking or business, organization, and personal health information, each with specific meanings for the Act's application. The Act defines personal information as information about an identifiable individual and sets other definitions including prescribed, record, and federal work undertaking or business (which covers navigation, shipping, transportation, financial institutions, telecommunications, and other works within Parliament's authority).
Purpose
The law aims to set rules for gathering, using and sharing personal data in a context where technology makes information flow easier. These rules balance individuals' privacy rights over their personal data with organizations' legitimate needs to handle data for ends that are reasonable to expect based on the situation.
Application
Part 1 applies to organizations collecting, using or disclosing personal information during commercial activities or regarding employees and job applicants in federal works or undertakings, but excludes government institutions under the Privacy Act, individuals handling information for personal or domestic purposes, and organizations handling information solely for journalistic, artistic or literary purposes; business contact information used only for employment, business or professional communication is also excluded. If a Canada Evidence Act certificate prohibiting disclosure is issued before a complaint is filed, access rights do not apply to the certified information, and if issued after a complaint is filed, all proceedings are discontinued and the Commissioner must return the information within 10 days of publication. The Commissioner and their staff must not disclose certified information and can delegate related investigations only to a maximum of four designated officers or employees.
DIVISION 1 Protection of Personal Information
Organizations must follow Schedule 1 obligations and gather, use or share personal information for purposes a reasonable person would consider suitable, with consent valid only if a reasonable person would understand what data are collected, used or shared and why. They may use or disclose information without consent in specified circumstances including investigations of legal contraventions, emergencies threatening life or health, insurance claims, employment or business matters consistent with original purpose, statistical or scholarly research where impracticable, sharing with lawyers or for debt collection, complying with court orders, government institutions investigating national security or enforcing laws, preventing fraud or financial abuse, identifying injured or deceased individuals, money laundering legislation, historical or archival conservation, and when legally required, with some disclosures requiring notification unless deceased. In business transactions, organizations may handle disclosed data without consent if they agree on rules protecting confidentiality, limiting use to prior aims, respecting consent withdrawal, and notifying the individual, and these rules exclude transactions where buying, selling or leasing data is the main purpose.
DIVISION 1.1 Breaches of Security Safeguards
Organizations that notify individuals of breaches must also notify other organizations or government institutions if those entities could reduce or mitigate harm, or if prescribed conditions are met. Personal information may be disclosed without consent to the notified organization solely to reduce or mitigate harm from the breach, and may be disclosed for purposes other than its original collection when making such harm-reduction disclosures. Organizations must keep and maintain records of every breach under their control according to prescribed requirements, and provide the Commissioner with access or copies of such records upon request.
DIVISION 2 Remedies
This division covers procedures for resolving privacy complaints and enforcement, including filing complaints, investigating complaints, discontinuing investigations, issuing Commissioner reports, court hearings, and entering compliance agreements.
Filing of Complaints
Investigations of Complaints
Discontinuance of Investigation
Commissioner’s Report
Hearing by Court
Compliance Agreements
DIVISION 3 Audits
The Commissioner may audit an organization's personal information management practices if reasonably believing it has breached privacy rules or is not following Schedule 1 recommendations, with powers including summoning witnesses, compelling evidence and records, entering non-residential premises, examining records, and conducting private inquiries. The Commissioner may delegate these powers and must return produced records within ten days of request unless re-requiring them, and must provide the audited organization with a report containing findings and recommendations, which may be included in the annual report.
DIVISION 4 General
The Commissioner and persons acting on their behalf must maintain confidentiality of information obtained through duties, except as necessary for investigations, audits, proceedings, prosecutions for related offences, court hearings, appeals, judicial review, and disclosing offences to the Attorney General; the Commissioner may disclose information in the public interest and may authorize disclosures by others for investigation and legal proceedings, may disclose breach reports or records to government institutions if reasonably believing the information could help investigate law violations, and may establish agreements with provincial and territorial regulators and foreign regulators with similar functions to share information relevant to ongoing or potential investigations under this law or similar legislation, subject to procedures restricting use to the original purpose and requiring confidential treatment. The Commissioner and persons acting in good faith have protection from criminal or civil proceedings or defamation actions, the Commissioner is not a competent witness except in prosecutions for false statements, offences under the Act, court hearings, or appeals, and the Commissioner must develop public education programs, publish research, encourage privacy policies and codes, and annually report to Parliament after consulting provincial experts. Any person may report suspected violations to the Commissioner and request anonymity, which must be kept confidential; employers cannot penalize employees who report violations in good faith, refuse to participate, or take steps to prevent violations, or whom employers suspect will do such things.
DIVISION 5 Transitional Provisions
The Act does not apply to an organization collecting or using information within a province regulated by that province, unless the organization does so in connection with a federal work or business or transfers the information outside the province for consideration; this exception expired three years after the section came into force. The Act does not apply to personal health information collection, use or disclosure; this exception expired one year after the section came into force.
PART 2 Electronic Documents
4 sections
This part of the law addresses interpretation, purpose, electronic alternatives and regulations for electronic documents.
Interpretation
Data includes any form of information representation; an electronic document is data on a computer system readable by a person or machine, including outputs; an electronic signature consists of digital symbols in an electronic document; federal law includes Acts of Parliament and instruments issued under them except territorial acts; a responsible authority is the minister, issuer, or Governor-designated person for a federal law provision; a secure electronic signature uses prescribed technology or processes.
Purpose
Establishes that this Part enables federal public bodies to use electronic alternatives wherever federal laws currently allow paper-based recording or communication but do not specify the particular method required.
Electronic Alternatives
Federal ministers and departments may use electronic means for creating, managing and distributing documents, electronic payments, and may establish electronic forms, filing and submission methods through regulation, treating them as equivalent to paper-based counterparts where applicable federal law does not prescribe a specific manner. An electronic certificate or document signed with a secure electronic signature satisfies proof or evidence requirements, and electronic document retention meets statutory requirements if the format preserves original information, remains readable to authorized persons, and includes origin, destination and timing details. Electronic documents recognized as notarial acts under Quebec law may be used for federal purposes if listed in Schedule 2 or 3, and a secure electronic signature may replace a required personal seal if listed in those schedules.
Regulations and Orders
The Governor in Council may prescribe technologies and processes for secure electronic signatures that are unique to and entirely under the user's control, capable of identifying the user, and able to detect changes to the document; amending or repealing such prescriptions does not invalidate prior signatures. Responsible authorities may add or remove federal laws or provisions from Schedule 2 or 3 by order and may make regulations specifying how electronic documents must be made, formatted, transmitted, verified and signed, including technologies and timing, with regulations permitted to require mutual agreement and control by the recipient and to incorporate by reference government standards as they exist at a fixed time or as subsequently amended. Striking a provision from Schedule 2 or 3 does not invalidate prior actions complying with regulations that applied while the provision was listed.
PART 6 Coming into Force
Parts 1 to 5 of the Act enter into force on dates fixed by the Governor in Council, on the Minister of Industry's recommendation for Parts 1 and 2, and the Minister of Justice's recommendation for Parts 3 to 5.
4.1 Principle 1, Accountability
Organizations must designate one or more individuals accountable for compliance with personal information principles. Responsibility for compliance rests with designated individuals, though others may handle daily collection and processing or act on their behalf. Organizations must disclose the identity of designated individuals on request and ensure third parties processing personal information provide comparable protection through contracts or other means.
4.2 Principle 2, Identifying Purposes
Organizations must identify purposes for collecting personal information at or before collection and document them for compliance with openness and access principles. When collected information will be used for a previously unidentified purpose, the new purpose must be stated before use; unless required by law, the individual's permission is needed before that use. Collection personnel should be able to explain collection purposes to individuals.
4.3 Principle 3 - Consent
Reasonable expectations of individuals are relevant in determining consent; consent must not be obtained through deception. Organizations should seek express consent for sensitive information and may use implied consent for less sensitive information. Consent can be given in various forms including application forms, checkoff boxes, orally, or through product or service use.
4.4 Principle 4, Limiting Collection
Organizations must limit collection of personal information to what is necessary for identified purposes and collect it by fair and lawful means. Information must not be collected indiscriminately, and the amount and type collected must be necessary to fulfil identified purposes. Collection by deception or misleading statements about purposes is prohibited.
4.5 Principle 5 -Limiting Use, Disclosure, and Retention
Organizations must not apply personal information for different purposes than originally collected without individual consent or legal obligation, and must keep personal information only for as long as needed to achieve those purposes. Organizations should establish retention policies with minimum and maximum periods, retain information used for individual decisions long enough for access after the decision, and develop procedures to destroy, erase or anonymize information that is no longer needed.
4.6 Principle 6, Accuracy
Organizations must maintain personal information that is sufficiently accurate, complete and current based on how it will be used, considering the individual's interests and minimizing the risk of wrong decisions. Organizations should not automatically update personal information unless necessary for the original collection purposes, and should keep information that is used continuously or shared with others current and accurate unless limitations on accuracy requirements are explicitly defined.
4.7 Principle 7, Safeguards
Personal information must be protected by security safeguards appropriate to its sensitivity, defending against loss, theft, unauthorized access, disclosure, copying, use, or modification across all formats. Safeguards must reflect the sensitivity, amount, distribution, format, and storage method of information and include physical measures such as locked cabinets and restricted access, organizational measures such as security clearances and need-to-know restrictions, and technological measures such as passwords and encryption. Organizations must ensure employees understand the importance of maintaining confidentiality and exercise care in disposing or destroying information to prevent unauthorized access.
4.8 Principle 8, Openness
Organizations must make their policies and practices regarding personal information management readily available to individuals in understandable form and without unreasonable effort. Specific disclosures required include the name and address of the accountable person, access methods, types of information held and their uses, policy documents, and information shared with related organizations.
4.9 Principle 9, Individual Access
Upon request, organizations must confirm whether they hold personal information about an individual, provide access to it, disclose how it is used and to which third parties it has been shared, and respond within a reasonable time at minimal or no cost. Individuals may challenge the accuracy or completeness of their information and require it to be amended, with amendments transmitted to third parties where appropriate; if a challenge remains unresolved, the organization must record and communicate this fact.
4.10 Principle 10, Challenging Compliance
Individuals may challenge organizational compliance with the preceding principles by contacting the designated accountable person. Organizations must establish easily accessible complaint procedures, inform individuals of their existence, investigate all complaints, and take appropriate corrective action including amending policies if a complaint is justified.
SCHEDULE 2 (Sections 38 to 47, 49 and 51)
SCHEDULE 3 (Sections 38 to 47, 49 and 51)
SCHEDULE 4 (Subsection 4(1.1) and paragraph 26(2)(c))
The World Anti-Doping Agency is exempted from this Act in respect of personal information it gathers, processes or shares during its cross-border or worldwide activities.
Amendments not in force
1 section
DIVISION 1.2 Mobility of Personal Information
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 0 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 0 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 0 are shown.
Change history
- Official text wordingSource for this change (opens in a new tab)