Página traducida y verificada automáticamente. Prevalece la versión en inglés. Algunas partes siguen en inglés mientras se verifica su traducción. Ver en inglés · Informar un error de traducción
PIPEDA
Ley de Protección de la Información Personal y los Documentos Electrónicos (Canadá)
Ley federal de privacidad de Canadá para el sector privado, basada en diez principios de tratamiento leal de la información.
The law in brief
PIPEDA is Canada's federal privacy law for the private sector. It is built on ten fair information principles, with meaningful consent at its center, and it includes mandatory reporting of breaches that create a real risk of significant harm.
It applies across Canada except where a province has a substantially similar law for activity within that province, as Quebec, British Columbia and Alberta do. Cross-border and interprovincial activity stays under PIPEDA.
A quién se aplica
- Private-sector organizations that collect, use or disclose personal information in the course of commercial activity.
- Federally regulated works and businesses, such as banks, airlines, telecommunications and broadcasting, including for their employees' information.
- Personal information that crosses provincial or national borders in commercial activity.
- Organizations outside Canada with a real and substantial connection to Canada.
What it requires
The ten fair information principles
Comply with the principles in Schedule 1: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance.
Meaningful consent
Obtain valid consent: individuals must reasonably understand the nature, purpose and consequences of the collection, use or disclosure they consent to.
Appropriate purposes
Collect, use or disclose personal information only for purposes a reasonable person would consider appropriate in the circumstances.
Report and notify breaches
Report to the Commissioner, and notify affected individuals as soon as feasible, any breach of security safeguards involving personal information that creates a real risk of significant harm, and keep records of all breaches for 24 months.
Derechos de las personas
Individuals can access their personal information and challenge its accuracy, withdraw consent subject to legal or contractual restrictions, and complain to the Office of the Privacy Commissioner, then apply to the Federal Court.
Enforcement and penalties
El Comisionado de Privacidad investiga y emite conclusiones y recomendaciones, pero no puede multar. No notificar a sabiendas una violación, no avisar a las personas o no llevar registros de violaciones es un delito sancionado con multas de hasta C$100,000. El Tribunal Federal puede ordenar el cumplimiento y conceder indemnizaciones.
What's changing
Reform stalled. Bill C-27, which would have replaced PIPEDA with a new Consumer Privacy Protection Act, died when Parliament was prorogued in January 2025. Regulatory Watch reports any new federal privacy bill.
What to do first
- Name the person accountable for privacy compliance.
- Check consent is meaningful: clear about what, why, with whom, and the risks, with express consent for sensitive information.
- Map cross-border transfers and tell people when their data may be processed outside Canada.
- Set up breach assessment against the real risk of significant harm test, and keep a record of every breach for 24 months.
- Check provincial laws in Quebec, British Columbia and Alberta, and health information laws.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Novedades recientes
Aún no hay nada que informar. Regulatory Watch enumera las nuevas normas, medidas de cumplimiento y decisiones judiciales a medida que llegan.
Fuentes
- Ley de Protección de la Información Personal y los Documentos Electrónicos (S.C. 2000, c. 5) Justice Laws Website · Texto oficial o regulador
Biblioteca de regulaciones
Todas las leyes estatales de privacidad de EE. UU., en un mapa
24 estados tienen una ley integral de privacidad en la biblioteca, junto con las leyes de la UE, del Reino Unido, federales de EE. UU. y globales: 102 en total, cada una explicada en palabras sencillas con sus fuentes. Seleccione un estado para ver qué se aplica allí.
- En vigor
- Entrada en vigor
- Leyes sectoriales