PIPEDA

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-06-15 Bill C-36, which would enact the Protecting Privacy and Consumer Data Act, is introduced
2. 2026-03-26 Budget 2025 Implementation Act, No. 1 (S.C. 2026, c. 3) receives Royal Assent; its Division 23 adds a data mobility right to PIPEDA, in force on a day fixed by order
3. 2018-11-01 Mandatory reporting of breaches of security safeguards takes effect
4. 2004-10-12 British Columbia exemption order registered: organisations under BC's PIPA are exempt from PIPEDA Part 1 for activity within the province

1. 2026-06-15
   Bill C-36 (Protecting Privacy and Consumer Data Act) Draft

   Government bill to enact the Protecting Privacy and Consumer Data Act and amend PIPEDA, introduced on 15 June 2026; as of October 2026 it is at second reading in the House of Commons. source

2. 2025-03-04
   PIPEDA (S.C. 2000, c. 5), as last amended 4 March 2025 AmendmentCurrent text source

   Not confirmed by an official source yet.

3. 2018-11-01
   Mandatory breach reporting in force Amendment

   Breach reporting, notification and record-keeping duties (sections 10.1 to 10.3), added by the Digital Privacy Act, took effect with the Breach of Security Safeguards Regulations. source

4. 2015-06-18
   Digital Privacy Act (S.C. 2015, c. 32) Amendment

   Amending Act that, among other changes, added the breach of security safeguards regime. source

5. 2000-04-13
   PIPEDA (S.C. 2000, c. 5) Major version

   Assented to 13 April 2000; Part 1 (protection of personal information) came into force on 1 January 2001. source

Part 1 governs personal information handled in commercial activity across Canada, except where a provincial law has been recognised as substantially similar.

Commercial activity

Every organisation in respect of personal information it collects, uses or discloses in the course of commercial activities (section 4(1)(a)). source

Employees

Employee and applicant information only where collected, used or disclosed in connection with the operation of a federal work, undertaking or business (section 4(1)(b)). source

Excluded

Government institutions under the Privacy Act, purely personal or domestic use, and journalistic, artistic or literary purposes (section 4(2)). source

Provinces

Where a provincial law is substantially similar, organisations it covers can be exempted for activity within that province (section 26(2)(b)), as British Columbia's were in 2004. source source

Organisations apply the fair information principles of Schedule 1 themselves and must report, notify and record breaches of security safeguards.

Breach reporting

Report to the Commissioner any breach of security safeguards that creates a real risk of significant harm to an individual, as soon as feasible (section 10.1). source

Breach records

Keep and maintain a record of every breach of security safeguards involving personal information under the organisation's control (section 10.3). source

Notify individuals

Notify affected individuals of breaches that pose a real risk of significant harm, and report them to the Privacy Commissioner. source

The Privacy Commissioner investigates and audits; complainants can go to the Federal Court, and knowing breaches of key duties are offences with fines up to $100,000.

Federal Court

The Court can order an organisation to correct its practices, publish corrective measures and pay damages, including for humiliation (section 16). source

Compliance agreements

The Commissioner can enter into a compliance agreement with an organisation it believes has contravened, or is likely to contravene, Division 1 or 1.1 (section 17.1). source

Audits

The Commissioner may audit an organisation's personal information management practices on reasonable grounds (section 18). source

1. Law text Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5)
2. Law text Breach of Security Safeguards Regulations (SOR/2018-64)
3. Guidance What you need to know about mandatory reporting of breaches of security safeguards (OPC)
4. Law text Bill C-36 (45-1) on LEGISinfo
5. Law text Budget 2025 Implementation Act, No. 1, Division 23 (data mobility amendments to PIPEDA)

1. Quebec Law 25

   Quebec's private-sector privacy law as rebuilt by Law 25, with administrative monetary penalties of up to $10 million or 2% of worldwide turnover.

2. BC PIPA

   British Columbia's private-sector act, which replaces PIPEDA Part 1 for organisations' activity within BC under a federal exemption order.

3. Canada Privacy Act

   The federal public-sector privacy law for government institutions.

4. GDPR

   The EU regulation, enforced by data protection authorities able to impose turnover-based administrative fines.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to PIPEDA (RSS)