PIPEDA Explained for Small Business (Without the Legalese)

PIPEDA is the Personal Information Protection and Electronic Documents Act, and it is the main privacy law for private businesses in Canada. The name is a mouthful and the text is dense, which leaves a lot of owners assuming it is somebody else’s problem. It is not. If you keep a list of customers with their names and email addresses, you are already handling “personal information,” and PIPEDA already applies.

The good news is that the law is built on ten straightforward principles, and once you read them in plain language they mostly describe how a decent business would want to treat customers anyway. Here is the working owner’s version. It is general information, not legal advice, and for anything specific you should talk to a privacy lawyer.

Who PIPEDA covers

PIPEDA applies to organizations that collect, use, or disclose personal information in the course of commercial activity. There is no blanket “you’re too small to matter” exemption. A solo consultant with a client list is handling personal information just like a national retailer is.

Personal information means information about an identifiable individual: names, emails, phone numbers, addresses, purchase history, and plenty more. If you can tie the data back to a specific person, treat it as personal information.

A quick note on jurisdiction. Alberta, British Columbia, and Quebec have their own private-sector privacy laws considered substantially similar to PIPEDA, and those govern activity within the province. Quebec’s Law 25 is the strict one and deserves its own attention if you sell into Quebec. For businesses operating across provinces or dealing with data crossing borders, PIPEDA is generally in the picture.

The ten principles, in plain English

PIPEDA is built on ten fair information principles. Stripped of the legal language, they read like this:

1. Be accountable. Someone in your business owns privacy. Name them, even if it’s you.
2. Say why. Identify the purpose before or when you collect information.
3. Get consent. Collect, use, and share with the person’s knowledge and consent.
4. Collect only what you need. No hoovering up data “just in case.”
5. Use it only for what you said. Don’t quietly repurpose the data later.
6. Keep it accurate. Wrong data leads to wrong decisions and unhappy customers.
7. Protect it. Safeguard the information with security appropriate to how sensitive it is.
8. Be open. Make your privacy practices easy to find and understand.
9. Give access. People can ask what you hold about them and correct it.
10. Provide recourse. Give people a way to challenge how you handled their data.

Read those again and notice how little of it is exotic. Collect what you need, use it for what you said, keep it safe, be honest about it, and let people see and correct their own records. A business that does those five things is most of the way to compliant.

Consent, done meaningfully

Consent under PIPEDA is supposed to be meaningful, which means people should actually understand what they are agreeing to. Burying data collection in a 4,000-word policy that nobody reads is exactly what regulators have started pushing back on. The more sensitive the information, the clearer and more explicit the consent should be. For most small businesses that means a plain-language privacy notice and not asking for more than the job requires.

Breach reporting is mandatory

This is the part owners most often miss. Since November 2018, PIPEDA has required mandatory breach reporting. If your business suffers a “breach of security safeguards” that creates a real risk of significant harm to someone, you must:

• Report it to the Office of the Privacy Commissioner of Canada.
• Notify the affected individuals.
• Keep records of breaches, including ones that don’t rise to the reporting threshold.

That last point catches people. You are expected to keep a log of security incidents even when they are minor. If the regulator ever comes knocking, that record is part of showing you take safeguards seriously.

What about Bill C-27 and “AIDA”?

You may have read that PIPEDA was about to be replaced by a new law, and that Canada was getting an AI-specific statute called AIDA. That was the plan under Bill C-27. It did not happen. The bill died when Parliament was prorogued in early 2025, taking the proposed Consumer Privacy Protection Act and the Artificial Intelligence and Data Act with it. So today, PIPEDA is still the governing federal law, and there is no in-force federal AIDA. Anyone selling you “AIDA-compliant” anything is selling a law that doesn’t exist yet. Build for the rules on the books now.

A short starter list

• Name whoever is responsible for privacy in your business.
• Write a plain-language privacy notice and put it where customers can find it.
• Collect only the personal information you actually need, and use it only for the stated purpose.
• Secure it with measures that match how sensitive it is.
• Have a plan for breach reporting before you need one.

PIPEDA is less a hurdle than a description of trustworthy handling of customer data. The businesses that struggle with it are usually the ones collecting more than they need, storing it carelessly, and hoping nobody asks. Tighten those three habits and most of the law takes care of itself.