Before you read
This site is NOT legal advice, and using it creates no lawyer and client relationship. It is a set of findings, checked against published sources and dated, that may help software developers and other individuals. For a decision that matters, ask a qualified lawyer in the country concerned.
Canada
Sources last checked:
PIPEDA is Canada’s federal private-sector privacy law. It applies to personal information that an organisation collects, uses or discloses in commercial activities.1
At a glance
| Question | Answer |
|---|---|
| Answer an access request | Within 30 days, extendable2 |
| Report a breach to the regulator | When there is a real risk of significant harm3 |
| Highest fine | $100,000, for specified offences4 |
Consent and access
An individual’s knowledge and consent are required to collect, use or disclose personal information, except where inappropriate.5 You can ask an organisation about your data, get access to it, and challenge its accuracy.6
Breaches
An organisation must report a breach to the Privacy Commissioner, and tell the people affected, when it is reasonable to believe it creates a real risk of significant harm.3
If you get nowhere
You can complain in writing to the Privacy Commissioner,7 and then apply to the Federal Court.8
What may change
Bill C-36, the Protecting Privacy and Consumer Data Act, was introduced on 15 June 2026. On 9 November 2026 Parliament’s record showed it at second reading in the House of Commons.9
Quebec
Quebec has its own, separate private-sector law, which this site does not cover yet.
Source note: Quebec’s official legal site could not be reached, so its law was not read.