Personal Information Protection and Electronic Documents Act (PIPEDA)

The Personal Information Protection and Electronic Documents Act (PIPEDA) is a Canadian federal law enacted in 2000 to regulate the collection, use, and disclosure of personal information by organizations engaged in commercial activities. PIPEDA sets out rules and principles for the protection of individuals’ personal information in the course of commercial transactions. It applies to private sector organizations across Canada, with some exceptions for provinces that have their own substantially similar legislation.

Under PIPEDA, organizations must obtain an individual’s consent before collecting, using, or disclosing their personal information, except in specific situations where consent may not be required. The law also requires organizations to have safeguards in place to protect personal information against unauthorized access or disclosure, and grants individuals the right to access their own personal information and to have it corrected if necessary. PIPEDA establishes the Office of the Privacy Commissioner of Canada, responsible for overseeing compliance with the law and investigating privacy complaints. Overall, PIPEDA aims to strike a balance between individuals’ right to privacy and the legitimate needs of organizations to collect and use personal information in a reasonable manner.