Canada Privacy Act
Privacy Act (R.S.C., 1985, c. P-21) — Parliament of Canada / OPC (Office of the Privacy Commissioner of Canada)
Also known as: R.S.C., 1985, c. P-21, Loi sur la protection des renseignements personnels, Canadian federal Privacy Act
Official site Official change log Subscribe to Canada Privacy Act (RSS)
At a glance
- Current version
- Privacy Act (R.S.C., 1985, c. P-21), as last amended 2 June 2025
- Published 2 June 2025. source
- Status
- In force
- Next deadline
- None announced
- Who must comply
- Federal government institutions listed in the schedule to the Act, plus parent Crown corporations and their wholly-owned subsidiaries, for the personal information they hold. source
- How it is assessed
- Institutions apply the Act's collection, use, accuracy, retention and disclosure rules themselves, subject to complaints to the Privacy Commissioner. source
- Authority
- An Act of the Parliament of Canada. The Privacy Commissioner of Canada investigates complaints about federal institutions; refusals of access can be reviewed by the Federal Court. source source
- Enforced by
- The Privacy Commissioner investigates complaints; individuals refused access can apply to the Federal Court, and obstructing the Commissioner is an offence. source
- Last change
- None recorded yet
The federal public-sector counterpart of PIPEDA: it governs how Canadian government institutions collect, use, disclose and retain personal information, and gives people a right of access to what the state holds about them. It matters to companies that supply or run systems for government institutions, which is where it meets the CCCS control guidance we already track.
Recent changes
No changes recorded yet — we are watching, and nothing has been published.
Key dates
No upcoming datesAmendments
-
Not confirmed by an official source yet.
Who it applies to
The Act governs how federal government institutions collect, use, disclose, retain and dispose of personal information, and gives individuals a right of access to it.
- Government institutions
- Departments, ministries of state, bodies and offices listed in the schedule, and parent Crown corporations and their wholly-owned subsidiaries under the Financial Administration Act. source
- Not covered
- Political parties, members of Parliament and senators, courts, and private sector organisations. source
- Right of access
- Any individual, in or outside Canada, may request access to personal information about themselves under the control of a federal institution; institutions ordinarily have 30 days to respond. source
- Contractors
- Personal information does not include, for certain provisions, some professional information about individuals performing services under contract for a government institution. source
How compliance is assessed
Institutions apply the Act's collection, use, accuracy, retention and disclosure rules themselves, subject to complaints to the Privacy Commissioner.
- Collection
- Collect personal information only where it relates directly to an operating program or activity, and from the individual whenever possible. source
- Retention
- Personal information used for an administrative purpose must be retained for at least two years unless the individual consents to its disposal. source
- Disclosure
- No disclosure without consent except in specified cases, such as a consistent use, legislative authority, court orders or where the public interest outweighs the invasion of privacy. source
Enforcement and penalties
The Privacy Commissioner investigates complaints; individuals refused access can apply to the Federal Court, and obstructing the Commissioner is an offence.
Up to $1,000
Section 68, on summary conviction, for obstructing the Privacy Commissioner or a person acting for the Commissioner. source
- Complaints
- The Commissioner accepts complaints about the personal information handling practices of federal institutions subject to the Act. source
- Federal Court review
- An individual refused access may, after a complaint to the Commissioner, apply to the Federal Court for review within 45 days of the investigation results (section 41). source
Documents
Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to Canada Privacy Act (RSS)