What is PIPEDA (Canadian privacy law)

PIPEDAPersonal Information Protection and Electronic Documents Act

In short

PIPEDA is Canada's federal private-sector privacy law: it governs how organizations collect, use and disclose personal information in commercial activities, including health information. Its second part covers electronic documents and signatures. In provinces with substantially similar laws, such as the health information laws of Ontario or New Brunswick, specific orders exempt the organizations covered from its first part, for activity within the province.

Explanation

What it is

The Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5) received Royal Assent on 13 April 2000. It has two main parts:

Part 1: protection of personal information in the private sector. Schedule 1 sets out ten principles: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access and challenging compliance.
Part 2: electronic documents. It defines a "secure electronic signature" as one that results from a technology or process prescribed by regulation.

The Office of the Privacy Commissioner of Canada (OPC) oversees it.

Who it applies to

Every organization in respect of personal information it collects, uses or discloses in the course of commercial activities, and employee data of federal works or undertakings (s. 4). The Act defines "personal health information", including information concerning physical or mental health and health services provided.

There are exemption orders for organizations in Alberta, British Columbia and Quebec, and for health information custodians in Ontario, New Brunswick, Newfoundland and Labrador and Nova Scotia.

Breaches

Division 1.1 requires reporting to the Commissioner any breach of security safeguards that it is reasonable to believe creates a real risk of significant harm to an individual (s. 10.1). That obligation and its regulations have applied since 1 November 2018.

Status as of October 2026

According to the Justice Laws Website, the consolidated text is current to 30 September 2026 and was last amended on 4 March 2025.
The Budget 2025 Implementation Act, No. 1 (S.C. 2026, c. 3, assented to on 26 March 2026) adds a data mobility framework; those amendments are not yet in force.
Bill C-27, which would have replaced Part 1, died when Parliament was prorogued in January 2025, according to the OPC.
Bill C-36, introduced at first reading on 15 June 2026, would enact a Protecting Privacy and Consumer Data Act and repeal Part 1. It is not law.

Common misconceptions

Believing C-27 or C-36 already apply. PIPEDA remains in force.
Believing PIPEDA covers all health information in every province. The exemption orders defer to provincial laws.

Usage examples

The Health Information Custodians in the Province of Ontario Exemption Order exempts Ontario health information custodians from Part 1.

Equivalent orders exist for health information custodians in New Brunswick, Newfoundland and Labrador and Nova Scotia.

The Breach of Security Safeguards Regulations (SOR/2018-64) have applied since 1 November 2018.

Part 2 defines the "secure electronic signature" for documents governed by federal law.

The Budget 2025 Implementation Act, No. 1 adds a Division 1.2 on mobility of personal information, not yet in force.

Bill C-36 (2026) would repeal Part 1 and change the Act's short title to the Electronic Documents Act.

Interoperability assessment

Architecture definition

Data modeling

Implementation Guides

FHIR layer

HIE Integration

Cloud Repositories

Kivú RIS

Kivú PACS

Kivú FHIR

Kivú Terminology

Kivú Conquest

Kivú eSignature