What’s PIPEDA?

Canada’s law around privacy, the Personal Information Protection and Electronic Documents Act (PIPEDA), governs how private Canadian companies are responsible for the collection, use and disclosure of personally identifiable information (PII) during the course of their regular business activities. Each company has a responsibility for ensuring that it only collects information that it needs to conduct business and that it stores and controls access to that information in a secure fashion. They should also make sure that it securely destroys that information as soon as it no longer needs to keep it. PIPEDA also has strong breach notification provisions, meaning that if you have a breach, you have an obligation to report the breach to both the people affected by the breach, and Canada’s privacy commissioner. Failure to do so can result in significant fines and penalties.