PIPEDA
Also known as: Personal Information Protection and Electronic Documents Act · Canadian federal privacy law
PIPEDA is Canada's federal private-sector privacy law, applying to commercial activity that crosses provincial or national borders.
It rests on principles drawn from a Canadian standard rather than detailed rules, which makes it more flexible than the GDPR but also harder to turn into a checklist.
It gives way to provincial laws declared substantially similar — the case in Quebec, British Columbia and Alberta — so a Quebec company answers to Law 25 for local activity and to PIPEDA for what crosses a border.
It has for several years required reporting breaches that create a real risk of significant harm, and keeping a record of every breach, including those not reported.
What it means for a small business
The least-known duty is the record: every breach must be logged, even minor ones, even unreported ones. An investigating commissioner can ask for it.
Related terms
So what actually applies to you?
A definition tells you what a term means, not what your organization must do. The assessment answers the second question — free, no credit card.
Updated September 1, 2026 · Educational definition; not legal advice.