PIPEDA, Canada's Privacy Act, and Bill C-27: What SaaS Companies Need to Know About Canadian Privacy Law

Canada's Privacy Landscape in 2026

Canada has a patchwork of privacy laws that affect SaaS companies selling into the Canadian market. The headline federal law for private-sector organisations is PIPEDA (Personal Information Protection and Electronic Documents Act), in force since 2001 and amended in 2015 and 2018. Canada is also mid-transition to a new regime under Bill C-27, which introduces the Consumer Privacy Protection Act (CPPA), the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act (AIDA).

If your SaaS handles personal information of Canadian residents in the course of commercial activity, PIPEDA applies to you — even if you're based in the US, EU, or elsewhere.

PIPEDA at a Glance: The 10 Fair Information Principles

PIPEDA is built on 10 principles from the Canadian Standards Association Model Code (Schedule 1 of PIPEDA):

#	Principle	What It Means for SaaS
1	Accountability	Designate a Privacy Officer; create a privacy programme; be responsible for third-party processors
2	Identifying purposes	Identify purposes before collecting personal information; document in privacy notice
3	Consent	Obtain knowledge and consent (can be implied for non-sensitive data in commercial relationships)
4	Limiting collection	Collect only what is necessary for identified purposes — data minimisation
5	Limiting use, disclosure, retention	Don't use data for undisclosed purposes; retain only as long as necessary
6	Accuracy	Keep personal information accurate; provide correction mechanism
7	Safeguards	Implement security appropriate to the sensitivity of the information
8	Openness	Make policies and practices available to individuals; maintain privacy notice
9	Individual access	Respond to access requests within 30 days; provide personal information held
10	Challenging compliance	Process for individuals to challenge compliance; escalate to Privacy Commissioner if needed

PIPEDA vs GDPR: Key Differences SaaS Companies Get Wrong

Area	PIPEDA (current)	GDPR
Legal basis for processing	Consent-centric (implied or express); no separate legal bases like legitimate interests or contract	6 legal bases (consent, contract, legal obligation, vital interests, public task, legitimate interests)
Consent standard	Meaningful consent; can be implied for non-sensitive data in commercial relationships	Freely given, specific, informed, unambiguous; pre-ticked boxes invalid
Right to erasure	Not an explicit right; deletion must occur when no longer needed for identified purpose	Explicit right to erasure (Art. 17) with defined triggers
Data portability	No formal portability right (CPPA will introduce one)	Explicit right to data portability (Art. 20)
Breach notification	Report to OPC + notify affected individuals if real risk of significant harm; no fixed timeline	72-hour notification to DPA; notify individuals if high risk (Art. 33-34)
Cross-border transfers	Can transfer to third countries if equivalent protection; no adequacy decision mechanism per se	Adequacy decisions, SCCs, BCRs required for transfers outside EEA
Privacy officer	Required (Privacy Officer designation, Principle 1)	DPO required in certain circumstances (Art. 37)
DPA equivalent	Office of the Privacy Commissioner (OPC) — investigates, makes recommendations	Supervisory Authority — can impose fines up to 4% global turnover
Penalties	Currently limited to public findings and court orders; CPPA raises to $25M CAD or 5% of global revenue	Up to €20M or 4% global annual turnover
Processor agreements	No formal DPA requirement; but accountability principle requires equivalent protection from third parties	Formal DPA required under Art. 28

PIPEDA Breach Notification: What SaaS Companies Must Do

The 2018 amendments to PIPEDA introduced mandatory breach notification obligations (Breach of Security Safeguards Regulations). The trigger is not any breach — it's a breach that poses a real risk of significant harm to an individual.

"Significant harm" includes: bodily harm, humiliation, damage to reputation, loss of employment, financial loss, identity theft, negative effects on a credit record, and damage to or loss of property.

What you must do when the threshold is met:

Report to the OPC — as soon as feasible after determining the breach meets the threshold. No fixed 72-hour window (unlike GDPR), but "as soon as feasible" is interpreted as prompt reporting.
Notify affected individuals directly — the notification must give enough information for the person to understand the significance of the breach and what steps they can take.
Notify third parties — if an organisation is involved that can mitigate harm (e.g. banks if payment data is involved), you must notify them.
Keep records — maintain a record of every breach of security safeguards for 24 months, even those below the notification threshold. The OPC can request these records.

Where SaaS companies get this wrong: Assuming GDPR's 72-hour window applies. PIPEDA doesn't have a fixed window, but the OPC expects prompt reporting. Waiting weeks will be treated as a violation. Also: recording all breaches (not just notifiable ones) is mandatory — many companies don't know this.

Cross-Border Data Transfers Under PIPEDA

PIPEDA doesn't use an adequacy mechanism like GDPR. Under Principle 1 (Accountability), organisations that transfer personal information to third parties must ensure comparable protection. In practice, this means:

Your contracts with sub-processors must require equivalent data protection standards
You should be able to demonstrate that your sub-processors handle Canadian personal information appropriately
Your privacy notice must disclose that personal information may be transferred to other jurisdictions (including the US) where courts, law enforcement, and regulators may be able to access it

The OPC's 2009 guidelines on cross-border data flows emphasise that organisations cannot transfer personal information to a third party without ensuring comparable protection, but they do not prohibit such transfers — they require contractual safeguards.

US transfers: PIPEDA does not prevent transfers to the US. The privacy notice must disclose that US government agencies may be able to access data under US law. This is a significant disclosure requirement that many SaaS companies miss.

Provincial Privacy Laws: Quebec Law 25 is GDPR-Adjacent

Three provinces (Quebec, Alberta, British Columbia) have substantially similar provincial laws that apply to intra-provincial commercial activity. For most inter-provincial or international organisations, the federal PIPEDA applies. But Quebec's Law 25 (Act Respecting the Protection of Personal Information in the Private Sector) is significant:

Phased in from September 2022 through September 2023
Explicit right to erasure (unlike PIPEDA)
Right to data portability (not yet in PIPEDA)
Mandatory Privacy Impact Assessment (PIA) for high-risk projects, including AI systems
72-hour breach notification to the Commission d'accès à l'information (CAI) — same as GDPR
Consent for profiling and automated decision-making
Data localisation option: if processing outside Quebec, must ensure equivalent protection
Fines up to $25M CAD or 4% of worldwide turnover

If you serve customers in Quebec, Law 25 compliance is essential. It's the closest Canadian analogue to GDPR, and enforcement has been active since 2023.

Bill C-27 and the CPPA: What's Coming

Bill C-27, introduced in June 2022, proposes to replace PIPEDA with three new laws:

Consumer Privacy Protection Act (CPPA): Replaces PIPEDA's Schedule 1 principles with more GDPR-like rights (erasure, portability, automated decision-making explanations); introduces meaningful consent requirements; raises fines to $25M CAD or 5% of global revenue; creates a Privacy Tribunal with enforcement powers.
Personal Information and Data Protection Tribunal Act: Creates an administrative tribunal to review OPC findings and impose penalties.
Artificial Intelligence and Data Act (AIDA): Regulates high-impact AI systems; requires impact assessments; creates federal AI regulator.

As of mid-2026, Bill C-27 is still working through the parliamentary process. It has not yet received Royal Assent. But the direction is clear: Canada is moving toward GDPR-equivalent enforcement and rights. Organisations that build GDPR compliance now will have an easier CPPA transition.

Practical PIPEDA Compliance Checklist for SaaS

Requirement	What to Do	Priority
Designate a Privacy Officer	Name someone responsible; doesn't need to be full-time; include in privacy notice	High
Privacy notice / policy	Identify purposes, list sub-processors, disclose cross-border transfers (including US), provide contact	High
Consent mechanism	Implied consent acceptable for non-sensitive commercial data; express consent for sensitive data; document consent mechanism	High
Breach notification process	Document who to notify, how quickly, what to include; maintain breach log (mandatory for 24 months)	High
Access request process	30-day response window; ability to provide personal information held; document the process	High
Sub-processor contracts	Contractual requirement for comparable protection; not a formal DPA template but best practice	Medium
Data retention and deletion	Delete personal information when no longer needed for identified purpose; document retention schedules	Medium
Quebec Law 25 PIA	If processing Quebec residents' data in high-risk contexts (AI, profiling), conduct and document a PIA	Medium (Quebec)
Security safeguards	Implement security appropriate to sensitivity; document your controls (PIPEDA Principle 7)	High
Cross-border disclosure	Privacy notice must disclose that data may be transferred to other jurisdictions; specifically name US if applicable	High

PIPEDA, GDPR, and CCPA: Which Applies to You?

Many SaaS companies have customers in multiple jurisdictions. The general rule:

GDPR — applies if you target or monitor EU residents, or offer goods/services to EU residents
PIPEDA — applies if you collect, use, or disclose personal information about Canadian residents in the course of commercial activity
Quebec Law 25 — applies if you collect personal information of Quebec residents
CCPA/CPRA — applies if you meet thresholds (annual revenue >$25M, or handle data of 100,000+ California consumers, or derive 50%+ revenue from selling data)

These laws have overlapping but not identical requirements. The pragmatic approach for a SaaS company is: build to GDPR standards (the most demanding), then check the delta for each jurisdiction. PIPEDA is generally satisfied by a GDPR-compliant programme with some specific Canadian additions (US transfer disclosure, OPC notification process, Privacy Officer designation).

Generate a Privacy Policy That Covers Canadian Requirements

Use the Privacy Policy Generator to create a GDPR, PIPEDA, and CCPA/CPRA-compliant privacy policy. Select Canada and US as applicable jurisdictions to include PIPEDA-specific disclosures (cross-border transfer notice, Privacy Officer, OPC complaint process).

⚠️ This guide is for informational purposes only and does not constitute legal advice. Privacy law compliance is jurisdiction-specific and complex. Consult a qualified privacy lawyer for advice specific to your organisation.