What is PIPEDA and does it apply to your SaaS?
PIPEDA — the Personal Information Protection and Electronic Documents Act — is Canada's federal private-sector privacy law. It has been in force since 2001 (with amendments in 2015 adding mandatory breach reporting) and applies to the collection, use, and disclosure of personal information by organisations in the course of commercial activity.
For SaaS founders, the extraterritorial question is important: PIPEDA applies if you collect personal information from Canadian individuals in connection with commercial activity, even if your company is not based in Canada. If you have Canadian customers, PIPEDA almost certainly applies to you.
There are provincial equivalents that are deemed "substantially similar" to PIPEDA and displace it for intra-provincial activities: British Columbia's PIPA, Alberta's PIPA, and Québec's Law 25 (formerly Act respecting the protection of personal information in the private sector, amended significantly by Law 25 in 2021–2023). Québec's Law 25 is the most GDPR-like of the three and has attracted considerable attention for its scope and enforcement powers.
PIPEDA's 10 Fair Information Principles
PIPEDA is built around 10 principles from the Canadian Standards Association (CSA) Model Code, which are set out in Schedule 1:
- Accountability: your organisation is responsible for personal information in its control, including information transferred to third parties. Designate a privacy officer.
- Identifying purposes: purposes for collection must be identified at or before collection. No purpose creep after the fact.
- Consent: meaningful consent is required for collection, use, or disclosure. Implied consent is permitted for obvious purposes; express consent for sensitive information.
- Limiting collection: collect only what is necessary for the identified purposes (equivalent to GDPR's data minimisation).
- Limiting use, disclosure, and retention: don't use data beyond the consented purpose; don't keep it longer than necessary.
- Accuracy: personal information must be accurate, complete, and up to date as required for its purpose.
- Safeguards: protect personal information with security safeguards appropriate to the sensitivity of the information.
- Openness: make your policies and practices for managing personal information readily available.
- Individual access: individuals have the right to access their personal information and challenge its accuracy.
- Challenging compliance: individuals can challenge your compliance with these principles to your designated privacy officer.
Key differences between PIPEDA and GDPR
| Area | GDPR | PIPEDA |
|---|---|---|
| Legal basis for processing | 6 lawful bases (contract, legal obligation, legitimate interests, consent, vital interests, public task) | Primarily consent-based (implied or express). Fewer non-consent bases. |
| Consent standard | Must be freely given, specific, informed, unambiguous. Pre-ticked boxes invalid. | "Meaningful" consent — can be implied for obvious, low-sensitivity purposes. Express required for sensitive data. |
| DPO requirement | Required for public authorities, large-scale or special category processing | No formal DPO requirement — but must designate a "privacy officer" (often the CEO/founder at small companies) |
| Data subject rights | Access, rectification, erasure, restriction, portability, objection, no automated decisions | Access and accuracy challenge. No explicit right to erasure, portability, or objection. |
| Breach notification | DPA within 72 hours; individuals if high risk (Art. 33/34) | OPC (Office of the Privacy Commissioner) "as soon as feasible"; individuals if real risk of significant harm. Also maintain breach record for 2 years. |
| International transfers | Requires adequacy decision, SCCs, BCRs, or other safeguard | Must ensure comparable protection — contractual obligations, due diligence. No specific mechanism required (no SCC equivalent). |
| Fines | Up to €20M or 4% global revenue (GDPR); €35M or 7% (EU AI Act) | Up to $100,000 CAD per violation under PIPEDA. Law 25 (Québec): up to $25M CAD or 4% global revenue for serious violations — much closer to GDPR. |
| Extraterritorial scope | Applies to organisations processing EU residents' data, regardless of location | Applies to commercial activity in Canada — less clearly extraterritorial than GDPR but broadly interpreted |
Consent under PIPEDA: implied vs express
PIPEDA's consent framework is more flexible than GDPR's. The key distinction is implied vs express consent:
- Implied consent: acceptable when the purpose is obvious, the information is not sensitive, and the individual would reasonably expect the collection and use. Example: collecting a name and email to send a newsletter you've just signed up for.
- Express consent: required for sensitive information (health data, financial details, ethnic origin, political views, sexual orientation) and any purpose the individual would not reasonably anticipate.
The OPC has produced guidance that "meaningful" consent requires: explaining what information is being collected, why it's needed, how it will be used, and who will have access. This is similar in substance to GDPR's transparency requirements, even if the legal mechanism differs.
A practical consequence: if you're already GDPR-compliant with a clear privacy policy that describes your data processing, you're largely meeting PIPEDA's transparency and consent requirements. The bigger gaps are usually in rights fulfillment and breach notification procedures.
Breach notification under PIPEDA
Since 2018, PIPEDA requires breach notification (under the Security Breach of Personal Information Regulations, SOR/2018-64):
- Report to the OPC: "as soon as feasible" after determining a breach has occurred that creates a real risk of significant harm. No fixed deadline (unlike GDPR's 72 hours), but regulators expect prompt action.
- Notify affected individuals: if the breach creates a real risk of significant harm — bodily harm, humiliation, damage to reputation, financial loss, identity theft, negative employment effects, or loss of business/professional opportunities.
- Maintain a breach record: every breach, regardless of whether it meets the reporting threshold, must be recorded and retained for 24 months. The OPC can request this record at any time.
"Real risk of significant harm" is assessed based on the sensitivity of the information and the probability of it being misused. Encrypted data that remains unaccessed is generally low risk; unencrypted financial or health data accessed by a third party is high risk.
Québec's Law 25: Canada's strictest privacy law
If you have customers in Québec (which you almost certainly do if you serve Canadian users broadly), Law 25 applies to you. Fully in force as of September 2023, Law 25 significantly upgraded Québec's privacy regime and is now the strictest provincial law in Canada — more aligned with GDPR than with the original PIPEDA.
Key additions under Law 25:
- Privacy impact assessments (PIAs): required before any project involving personal information, and before transferring data outside Québec to another jurisdiction.
- Privacy by default: must collect and use only what's strictly necessary; privacy settings must default to the most privacy-protective option.
- Right to data portability: individuals can request their data in a technological profile that allows reuse.
- Right to be de-indexed: individuals can request de-indexing of information that could cause serious harm.
- Privacy officer designation: a person in charge of personal information protection must be designated and their contact information published.
- Fines: up to $25M CAD or 4% of worldwide turnover for serious violations — effectively GDPR-level enforcement.
Bill C-27: PIPEDA's replacement on the horizon
Bill C-27, the Digital Charter Implementation Act, 2022, would replace PIPEDA with three new statutes: the Consumer Privacy Protection Act (CPPA), the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act (AIDA). As of May 2026, Bill C-27 remains in Parliament and has not received Royal Assent — the federal election and associated legislative reset have introduced further uncertainty about its timeline.
If passed, the CPPA would significantly tighten consent requirements, create a right to disposal (similar to GDPR's right to erasure), impose GDPR-like breach notification timelines, and establish an AI-specific regulatory framework under AIDA. Companies should monitor its progress but are not required to comply with it yet.
What SaaS founders actually need to do for Canada
If you're already GDPR-compliant, you're about 80% of the way to PIPEDA compliance. The gaps to address:
- Designate a privacy officer: note this in your privacy policy. At a small company, this is typically the CEO or founder — it's a designation, not a full-time role.
- Update your privacy policy: explicitly state what information you collect, why, and how individuals can access or correct it. Include a contact for privacy enquiries.
- Breach record: implement a breach log (even a spreadsheet works) and ensure every incident — however minor — is recorded for 24 months.
- Access requests: have a process for responding to data access requests within 30 days (PIPEDA's deadline).
- Third-party contracts: ensure your contracts with processors include equivalent privacy protection obligations.
- Québec users specifically: consider designating a person in charge of personal information and conducting a privacy impact assessment for any new processing involving Québec users' data.
Generate your privacy policy for Canadian compliance
ComplyKit's Privacy Policy Generator covers GDPR and CCPA — and is a solid starting point for PIPEDA compliance given the substantive overlap in transparency requirements. For Québec specifically, you may need additional disclosures about your "person in charge" designation.
- 👉 Privacy Policy Generator — GDPR, CCPA & global-aware
- 👉 CCPA vs GDPR for SaaS — comparison of the two most commonly cited laws
- 👉 GDPR vs LGPD (Brazil) — Brazil's data protection law for SaaS founders
Key takeaways
- PIPEDA applies to any SaaS collecting personal information from Canadian individuals in commercial activity — even if you're not based in Canada.
- PIPEDA is consent-based (implied for obvious purposes, express for sensitive data) — more flexible than GDPR but substantively similar in practice.
- Breach notification under PIPEDA: report to OPC as soon as feasible + notify individuals at real risk of significant harm + keep a 24-month breach record.
- Québec's Law 25 is the strictest provincial law — fine levels match GDPR and a PIA is required before new processing projects.
- Bill C-27 (CPPA) would bring Canada much closer to GDPR — monitor its progress but it's not law yet as of 2026.