Personal Information Protection and Electronic Documents Act (Canada, S.C. 2000, c. 5)
Below is what the official text of Personal Information Protection and Electronic Documents Act (Canada, S.C. 2000, c. 5) states about whom it covers, when it applies to a business and since when. Where the pages we read do not say, the row says "not stated".
The wording shown is taken from the official page named in each row. The duties of a business and the contents of a privacy notice are in the paid checklist.
Typical situations, run through the same conditions as the check
- A for-profit business established in Canada (outside Quebec): Applies, or may apply: conditions to check.
- A US business with users in Canada (outside Quebec): Applies, or may apply: conditions to check.
- A US business with no users in Canada (outside Quebec): Not triggered by these answers.
Judged on 2026-10-06. Our law data was last verified on 2026-10-06; a law that took effect after that date is not in it. These situations leave other answers blank or neutral: use the check for your own.
What the official text states
| Question | What the official text states | Source |
|---|---|---|
| What it covers | Part 1 establishes rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information.Official wordingrules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information | laws-lois.justice.gc.ca read 2026-10-06 |
| When it applies to a business | Part 1 applies to every organization in respect of personal information it collects, uses or discloses in the course of commercial activities (and employee information in a federal work, undertaking or business). Conditions to check: The Act text we read does not state a territorial test. The geographic condition is a judgement: the OPC states (Clearview AI findings, as source 1) that PIPEDA applies to organizations outside Canada where a real and substantial connection to Canada exists. The Act applies only to 'commercial activity' (a defined term) by organizations; s.4(2) excludes government institutions under the Privacy Act, purely personal/domestic use and journalistic, artistic or literary purposes. Provincial laws (e.g. Quebec, Alberta, British Columbia) may apply instead for some activities; that rule was not verified here. Official wording4 (1) This Part applies to every organization in respect of personal information that (a) the organization collects, uses or discloses in the course of commercial activities; or | laws-lois.justice.gc.ca read 2026-10-06 |
| In force from | 2001-01-01 Footnote in the consolidated Act: Part 1 in force January 1, 2001 (SI/2000-29). Some later provisions (e.g. s.10.1 breach reporting) came into force later; the regime was staged. Official wordingPart 1 in force January 1, 2001, see SI/2000-29. | laws-lois.justice.gc.ca read 2026-10-06 |
| Privacy notice | Included in the paid checklist. See the checklist | — |
| Consent and opt-out | Included in the paid checklist. See the checklist | — |
| Rights of individuals | Included in the paid checklist. See the checklist | — |
| Data protection officer | Included in the paid checklist. See the checklist | — |
| Breach notification | Included in the paid checklist. See the checklist | — |
| What the privacy notice must contain | Included in the paid checklist. See the checklist | — |
What we do not cover
These areas are outside this site, so nothing on this page says anything about them:
- Privacy laws for particular sectors (for example health care, banking and credit, education)
- Rules specific to children's online privacy
- Cookie and electronic-communications rules (including consent for cookies and marketing messages)
- Employee, job applicant and contractor data
- Rules on sending personal data to other countries
- US state data-breach notification laws (a separate set of state laws)
- US state privacy laws that are not yet in force, and state laws on particular topics (for example biometric or health data)
- Privacy laws of countries that are not listed here
- Planned changes to the laws listed here