PIPEDA compliance means following ten fair information principles whenever your business collects, uses or discloses personal information in the course of commercial activity. In practice that comes down to six things: know what personal information you hold, collect only what you need, get meaningful consent, protect the data, respond to access requests and complaints, and record and report serious breaches. If your business operates in British Columbia, your day-to-day rules usually come from BC's own law instead. We explain which law applies to you first, then give you a checklist you can work through.
Table of Contents
- Does PIPEDA apply to my business?
- Which law applies if I am in British Columbia?
- What are the ten PIPEDA principles in plain language?
- What does a practical PIPEDA compliance checklist look like?
- What must I do after a data breach?
- How does PIPEDA differ from the GDPR?
- We build for privacy: our perspective
- How can AI tools fit with PIPEDA compliance?
- Where can we help?
- Frequently asked questions
- Sources
Does PIPEDA apply to my business?
PIPEDA is the Personal Information Protection and Electronic Documents Act, Canada's federal private-sector privacy law. The Office of the Privacy Commissioner of Canada (OPC) says it applies to private-sector organizations across Canada that collect, use or disclose personal information in the course of commercial activity. If you want a second overview of which organizations must comply with PIPEDA, that guide covers the basics from an IT angle.
"Commercial activity" is wider than most owners expect. The OPC's brief says it covers a particular transaction, act or conduct, or a regular course of conduct of a commercial character. That includes selling, bartering or leasing donor, membership or fundraising lists. So a small non-profit that sells its mailing list is in scope, even though a non-profit's ordinary operations may not be.
Personal information is any information about an identifiable individual. For a typical small business that means:
- customer names, emails, phone numbers and addresses
- invoices and payment history tied to a person
- appointment and scheduling records
- chat and support transcripts
- employee files, for federally regulated employers
If a record can be tied back to a real person, treat it as personal information.
Which law applies if I am in British Columbia?
This is where many owners get confused, and it is the question we hear most from clients in Surrey and Metro Vancouver.
The OPC explains that Alberta, British Columbia and Quebec have their own substantially similar private-sector laws that generally apply to in-province activity instead of PIPEDA. PIPEDA still applies to federally regulated businesses (think banks, airlines and telecommunications) and to personal information that crosses provincial or national borders. More than one law can apply to different parts of the same business.
In BC the provincial law is the Personal Information Protection Act (PIPA). The BC Information and Privacy Commissioner says PIPA applies to any private sector organization that collects, uses and discloses personal information of individuals in BC. It also applies to organizations located in BC that handle the information of people inside or outside the province.
Here is how that plays out for a few typical businesses:
| Situation | Law that most likely applies |
|---|---|
| Surrey dental clinic serving local patients | BC PIPA |
| Vancouver e-commerce shop shipping to Ontario customers | BC PIPA for in-province activity, PIPEDA for the interprovincial sales |
| Trucking company running interprovincial routes | PIPEDA for the federally regulated side of the business |
| Business in Yukon, the Northwest Territories or Nunavut | PIPEDA, as the OPC treats these organizations as federally regulated |
That last row comes straight from the OPC's guidance on provincial laws. If you are unsure which row you fit, ask a privacy lawyer. The good news is that the two laws are built on similar ideas, so a program that meets the ten principles below will serve you under either one.
What are the ten PIPEDA principles in plain language?
The Act is built on ten fair information principles. Here is what each one asks of a small business.
- Accountability. Someone in your business is responsible for personal information, and you have policies to back it up.
- Identifying purposes. Tell people why you are collecting their information, before or when you collect it.
- Consent. Get appropriate consent for collection, use and disclosure.
- Limiting collection. Collect only what you need for the purposes you stated.
- Limiting use, disclosure and retention. Use information only for the purposes you collected it for, unless the person consents or the law allows otherwise. Keep it only as long as necessary.
- Accuracy. Keep information accurate enough for its purpose.
- Safeguards. Protect information with security that fits its sensitivity.
- Openness. Make your privacy practices easy to find and understand.
- Individual access. Let people see their information and challenge its accuracy.
- Challenging compliance. Have a way to receive and respond to complaints and inquiries.
Notice how many of these are about what you do not do: do not collect extra, do not keep forever, do not reuse for new purposes. Most privacy problems we see in small businesses come from data sprawl rather than from hackers.
What does a practical PIPEDA compliance checklist look like?
The OPC's accountability guidance recommends a privacy management program with a designated privacy official, senior-management support, privacy impact and threat assessments, documented policies, employee training, third-party practices, incident protocols and regular review. The Act itself requires accountability policies and practices covering procedures to protect personal information, to receive and respond to complaints and inquiries, to train staff and to explain your privacy policies.
Turned into a working checklist for a small or mid-sized business:
- Name a privacy officer. One person, with a backup. In a ten-person company this is often the owner or office manager. Write the name into your privacy policy.
- Inventory your personal information. List every system that holds customer or employee data: your CRM, accounting package, email, scheduling tool, spreadsheets, shared drives and any chatbot. Note what is stored, why, who can see it and where it is hosted. Our guide to data mapping that stands up to PIPEDA audits walks through this step.
- Document purposes and consent. For each type of data, write down why you collect it and how people agree to it. Update forms and sign-up pages to match.
- Limit collection. Remove form fields you never use. If you do not need a birth date, do not ask.
- Set retention and deletion rules. The OPC says organizations should know what they hold, limit employee access, set retention periods and securely dispose of information that no longer has a purpose. See our data retention policy mapped to systems for a worked approach.
- Put safeguards in place. Role-based access, strong passwords with multi-factor authentication, encryption, backups and device controls. Match the effort to how sensitive the data is.
- Publish your privacy information. A plain-language privacy policy on your site, with your privacy officer's contact details.
- Build an access and complaints process. Decide who receives a request, how you verify identity, and how fast you respond.
- Prepare a breach response plan. More on this below.
- Vet service providers and new tools. Any vendor that touches personal data, including AI tools, needs a look at where data goes and how it is protected. Our plain guide on whether business data is safe with AI tools is a good place to start.
- Train your staff. People cause most accidental breaches, and they also catch most problems early.
- Review on a schedule. Once a year is a reasonable starting rhythm, and again whenever you adopt a major new system.
The OPC also offers a self-assessment tool and checklists that let you test your practices against the ten principles, find gaps and guide fixes. It is free and worth an afternoon.
What must I do after a data breach?
A breach of security safeguards is any loss of, unauthorized access to, or unauthorized disclosure of personal information. The trigger for reporting is not every incident. Per the OPC, you must report when it is reasonable to believe the incident creates a real risk of significant harm. Even so, every breach must be recorded, whether or not it reaches that threshold.
When the threshold is met, the OPC says notifying affected individuals must happen as soon as feasible after you determine the risk. The notice has to explain:
- the circumstances of the breach
- when it happened
- what information was involved
- the steps you have taken to reduce harm
- who they can contact
In practice, you want a one-page incident plan before anything goes wrong: who investigates, who decides if the harm threshold is met, who writes the notice, and where the breach log lives. Good audit logging makes this much easier, and we cover it in five risky events Canadian teams should capture.
BC organizations should also check PIPA's own requirements with the BC commissioner's office, since the provincial law governs most in-province activity.
How does PIPEDA differ from the GDPR?
Both laws are built on consent, purpose limits, safeguards and individual access, so a business that already handles data carefully has a head start on either. The differences matter mainly if you sell to people in the European Union.
According to one security vendor's comparison, the key differences include:
- Erasure. The GDPR gives an explicit right to be forgotten. PIPEDA lets people withdraw consent and challenge accuracy, but retention is tied to purpose rather than a stand-alone erasure right.
- Portability. The GDPR includes a right to data portability. PIPEDA does not.
- Structure. The GDPR is a single regime with firm rules for EU data subjects. PIPEDA is principles-based and sits alongside provincial laws.
The practical takeaway: if you have EU customers, PIPEDA compliance is a foundation but not a substitute for GDPR obligations. Get specific legal advice for that situation.
We build for privacy: our perspective
Most small businesses we meet in Surrey and Metro Vancouver do not have a privacy problem so much as a scattered-data problem. Customer details sit in a CRM, a billing tool, a scheduling app, three spreadsheets and someone's inbox. Every extra copy is one more place to secure, one more place to search when a customer asks for their information, and one more thing to delete when the retention period ends.
That is why we build custom software that brings CRM, invoicing, scheduling and reporting behind one login. We are not claiming software alone makes you compliant. Compliance is about policies, people and decisions. But connected data makes those decisions far easier to carry out: one place to set access by role, one place to apply retention rules, one place to answer an access request.
Our clients own the code with no lock-in, and we work to fixed prices with regular milestones, so you can see what is being built and how personal data is handled at each step. Our clients typically report saving 5 to 15 hours of administrative work a week, and a fair share of that comes from no longer re-keying the same customer record into four systems.
Our advice on AI is the same as on everything else. Start with a small pilot, know exactly what data goes in, and train your team on real tasks before you scale. Fast, talented interns still need supervision.
Harry Gill
How can AI tools fit with PIPEDA compliance?
AI is not exempt from privacy law, and it is not automatically a risk either. The same principles apply: know what personal information goes into a tool, make sure your purposes and consent cover that use, and understand where the vendor stores and processes the data.
A few habits keep small teams out of trouble:
- Write an AI policy for employees that says which tools are approved and what data must never be pasted into them.
- Pilot new automation on low-risk data first. Our piece on small business workflow automation that respects PIPEDA shows how.
- If you want a customer-facing or internal chatbot, scope it to approved content. Our 30-day pilot for a privacy-safe knowledge base chatbot is one way to do it.
- Keep a record of each tool in your data inventory, so the next review catches it.
Where can we help?
If your data lives in too many places to map confidently, or you want your team trained on AI tools without creating new privacy exposure, we can help. We design custom software that unifies your operational tools, and we run AI training and workshops built around your real tasks. If you are not sure where to begin, AI strategy consulting can start with a review of what data you hold and which tools are worth building.
We will not promise that a tool makes you compliant. We will help you build systems where compliance is easier to practise and easier to prove.
Frequently asked questions
Who is covered by PIPEDA?
Private-sector organizations that collect, use or disclose personal information in the course of commercial activity, plus federally regulated businesses and cross-border handling of personal information. In BC, Alberta and Quebec, the provincial law generally applies to in-province activity instead. Organizations in the three territories are treated as federally regulated.
Does PIPA still exist in BC?
Yes. BC's Personal Information Protection Act has been in force since January 2004 and applies to private-sector organizations handling personal information of individuals in BC. For most BC businesses operating within the province, PIPA is the main law, with PIPEDA applying to federally regulated work and cross-border activity.
Do I need a privacy officer?
The accountability principle requires you to be responsible for personal information under your control, and the OPC recommends designating a privacy official. In a small business that can be an existing role such as the owner or office manager. What matters is that the name is documented and the person has authority to act.
Do I have to report every data breach?
No. You must report to affected individuals, and to the OPC where it applies, when a breach creates a real risk of significant harm. You must still keep a record of every breach, including those you decide not to report. When in doubt, get advice from a privacy lawyer.
Sources
- PIPEDA requirements in brief, Office of the Privacy Commissioner of Canada
- Provincial laws that may apply instead of PIPEDA, OPC
- Legislation, Office of the Information and Privacy Commissioner for BC
- PIPEDA fair information principles, OPC
- PIPEDA Fair Information Principle 1, Accountability, OPC
- Personal Information Protection and Electronic Documents Act, Justice Laws Website
- PIPEDA Fair Information Principle 5, Limiting Use, Disclosure and Retention, OPC
- PIPEDA Self-Assessment Tool, OPC
- What you need to know about mandatory reporting of breaches of security safeguards, OPC
- PIPEDA vs GDPR: The Key Differences, Endpoint Protector
- PIPEDA Compliance: A Practical Guide for Canadian Businesses