PIPEDA Compliance Checklist for Small Business: Canadian Basics

Does PIPEDA cover my business?

PIPEDA is the federal private-sector privacy law for organizations that collect, use, or disclose personal information during commercial activity. Substantially similar provincial laws apply to provincially regulated organizations in Alberta, British Columbia, and Quebec, while federally regulated businesses remain under PIPEDA.

The Office of the Privacy Commissioner of Canada oversees PIPEDA, and its ten fair information principles shape the duties that follow. Identify the law that applies before reviewing your renewal and inspection rules, especially where the business operates across provinces or conducts more than one licensed activity.

PIPEDA is a compliance duty, not a license. It has no application, fee or registration, but it sits alongside licenses, inspections and renewals in the compliance file, and its dates are fixed by the law: breaches are reported as soon as feasible, breach records are kept for 24 months, and access requests are answered within 30 days.

The ten principles as a checklist

Who should be responsible for privacy work?

The organization is accountable for its privacy practices, so assign a person to manage questions, complaints, and incident records. A named privacy officer gives customers a clear contact and helps make accountability visible before a breach or complaint occurs.

Use a written allocation of responsibility to keep privacy work connected to the business's normal compliance tasks. A short intake checklist can help identify the applicable rules, key dates, and records, while an Alberta privacy context can help compare provincial requirements.

What should my notice explain?

Make the privacy notice easy to find and understand. It should identify who is accountable, what information is collected and why, how consent works, and how people can access or correct their information.

The notice should also explain who receives information, how long it is kept, what safeguards apply, and how to make a complaint. A written policy can help organize these points, but the final notice must reflect the organization's actual practices and identify its privacy officer.

Listing data categories by itself is not enough. Make sure the notice names an accountable contact and describes consent, retention, access, and safeguards in a way that can be compared with the organization's records and practices.

What should I record during ordinary operations?

Keep evidence that the organization follows its stated approach to consent, complaints, and transfers of information. These records make it possible to compare what the notice promises with what the organization actually does when handling personal information.

Set review dates in a compliance calendar template, and use consistent document management practices to organize supporting records. The safeguards principle does not prescribe a particular product, but suitable security controls remain part of the organization's privacy work.

When must I report a breach?

Record every breach of security safeguards involving personal information, including incidents that do not require a report. Report the breach to the OPC, using its online breach report form, and notify affected individuals when there is a real risk of significant harm, then keep each breach record for 24 months.

The OPC's guidance on mandatory reporting of breaches of security safeguards can help with the reporting decision, and the Breach of Security Safeguards Regulations (SOR/2018-64) set the record-keeping period. Include the incident date, what happened, what information was involved, how many people were affected, and the response taken.

A small Ontario accounting firm finds a lost, unencrypted laptop holding client tax files. It assesses a real risk of significant harm, reports the incident to the OPC, notifies clients, and keeps the record for 24 months. The record documents the breach and the actions taken in response.

How do provincial requirements differ?

The comparison of PIPEDA, Quebec Law 25 and Alberta PIPA shows how the regimes diverge for campaign data. In short:

Alberta's Personal Information Protection Act requires reporting to its commissioner when a breach creates a real risk of significant harm. British Columbia's Personal Information Protection Act has no general mandatory breach-reporting duty, although its commissioner encourages voluntary reporting. Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25, adds a breach register, assessments for certain projects, stronger consent rules, and an explicit privacy officer duty.

The Commission d'accès à l'information enforces Quebec's duties. Ontario has health-specific rules but no general private-sector law, so PIPEDA covers most Ontario businesses. Review which requirements fit the organization's province and activities rather than assuming one provincial regime applies everywhere.

What can happen after non-compliance?

The OPC can investigate complaints, seek a Federal Court order when it finds a violation, and publish the organization's name and its findings. PIPEDA also creates offenses for failures involving breach reporting and record keeping, with fines of up to $10,000 on summary conviction or up to $100,000 on indictment. Quebec's Law 25 sets penal fines of up to $25 million or 4 percent of worldwide turnover.

A person who knowingly fails to report, notify affected individuals, or keep records can be convicted. Individuals may also sue for damages if their privacy is violated. Keep the notice, decisions, and incident log together so the organization can explain what it did and why.

What should I do first?

Start by identifying the privacy law that applies, then assemble the notice, accountability contact, and incident records. These steps give the business a practical starting file before a renewal, audit, or complaint.