CIPP/C cheat sheet

PIPEDA is federal, private-sector, and activity-based: it attaches to personal information collected, used, or disclosed in the course of commercial activity, including employee data of federally regulated businesses.

Constitutionality rests on the trade and commerce power; PIPEDA s. 4(1)(a) expressly preserves provincial legislation that is substantially similar, so the substantially similar designation is the pivot of the federal-provincial architecture.

Quebec's private-sector law (Law 25, formerly the Act respecting the protection of personal information in the private sector) is the only substantially similar law that is not based on PIPEDA's CSA Model Code; it applies to all enterprises in Quebec, not just commercial activity.

Alberta PIPA and BC PIPA are substantially similar to PIPEDA and cover private-sector organizations operating in those provinces; both use a reasonable-person standard rather than PIPEDA's 10 principles.

Ontario, New Brunswick, Newfoundland and Labrador, and Nova Scotia each have health-sector privacy statutes declared substantially similar to PIPEDA for health information; Ontario PHIPA also covers health information custodians broadly.

The Privacy Act governs federal public bodies and is overseen by the Privacy Commissioner of Canada; it is not substantially similar legislation and coexists with PIPEDA rather than replacing it.

PIPEDA's 10 fair information principles (Schedule 1) run: accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, challenging compliance.

Consent under PIPEDA must be knowledge-based and reasonable; s. 6.1 permits collection without knowledge or consent only in narrow circumstances (e.g., investigation, emergency, or where consent would compromise accuracy).

Bill C-27 would have replaced PIPEDA with the Consumer Privacy Protection Act and created the Personal Information and Data Protection Tribunal; it died on the Order Paper in January 2025, so PIPEDA remains in force.

Quebec Law 25 phases in: breach notification and confidentiality-by-default duties, privacy impact assessments for certain projects, portability rights, and biometric processing rules, with the final tranche effective September 2025.

The Office of the Privacy Commissioner of Canada (OPC) is an ombudsman model: it investigates complaints, issues findings and recommendations, but cannot impose fines under PIPEDA.

PIPEDA s. 14 permits a complainant to apply to the Federal Court for a hearing after receiving the Commissioner's report; the Court may order compliance and, since 2015, award damages.

The Privacy Commissioner may name organizations publicly under PIPEDA s. 20(5) when a matter is not resolved, and may apply to the Federal Court under s. 15 for a compliance order in specific circumstances.

Quebec's CAI (Commission d'accès à l'information) has order-making power and can impose administrative monetary penalties, with Law 25 raising them to the greater of CAD 15 million or 4% of worldwide turnover for the most serious offences.

Alberta's OIPC and BC's OIPC issue orders that are binding and enforceable through the courts; BC's OIPC may also impose administrative penalties under PIPA.

Breach reporting under PIPEDA is mandatory where there is a real risk of significant harm; the report must go to the OPC and affected individuals as soon as feasible, and organizations must keep records for 24 months.

Significant harm under the Breach of Security Safeguards Regulations includes bodily harm, humiliation, damage to reputation, financial loss, identity theft, and damage to property or relationships.

Enforcement patterns: the OPC prioritizes systemic investigations and joint statements (e.g., with provincial commissioners on generative AI and data scraping) over individual complaint-by-complaint action.

Provincial health privacy regulators (e.g., Ontario's IPC) issue binding orders and can prosecute offences; penalties under PHIPA were raised in 2020 to up to CAD 1 million for individuals and CAD 5 million for organizations.

PIPEDA Principle 1 (Accountability) requires designating an individual accountable for compliance; that person's identity must be made known on request and may be delegated but accountability cannot.

A program's foundational documents are: privacy policy, retention schedule, consent forms, breach response plan, access-request procedure, vendor/third-party management procedure, and training records.

The 10 principles map to program controls: consent management (Principle 3), minimization (4 and 5), security safeguards (7), transparency (8), access and correction (9), and complaints handling (10).

Privacy impact assessments are mandatory in Quebec for projects involving new technology, cross-border transfers, or sensitive information; under federal policy, PIAs are required for federal institutions, not private organizations.

Cross-border transfers: PIPEDA requires organizations to use comparable protection and to disclose to individuals that information may be processed in another jurisdiction and accessible to foreign authorities.

Quebec Law 25 requires a pre-transfer assessment before sending personal information outside Quebec and, since September 2023, a documented assessment of the legal framework of the destination jurisdiction.

Governance design should separate the privacy officer's advisory role from the security function and from business ownership; the accountable executive must have authority to halt non-compliant processing.

Record-keeping obligations: PIPEDA requires a personal information inventory for access purposes and 24-month breach records; Quebec requires a register of confidentiality incidents.

Maturity models (e.g., NIST Privacy Framework functions: Identify-P, Govern-P, Control-P, Communicate-P, Protect-P) provide a common language for scoping program gaps; PIPEDA does not mandate any framework.

Access requests under PIPEDA: respond at latest 30 days after receipt, with a possible extension under s. 8(4) by notice to the Commissioner; fees must be minimal and disclosed in advance.

Refusals to access must be in writing, cite the specific statutory exemption (e.g., s. 9(3) solicitor-client privilege, litigation, or danger to life), and inform the individual of the right to complain to the OPC.

Breach response sequence: contain, assess real risk of significant harm, notify OPC and individuals as soon as feasible, notify other organizations if they can mitigate harm, and log in the breach register.

Consent operations: use plain-language purpose statements, separate consent for materially different purposes, avoid bundled consent, and record the date, scope, and channel of consent.

Vendor management: contract for purpose limitation, security safeguards, breach notification timelines shorter than the organization's own duty, audit rights, return/destruction of data, and subcontractor approval.

Data subject requests (access, correction, withdrawal, deletion where applicable) need a tracked workflow with identity verification proportionate to sensitivity and a defined escalation path for refusals.

Privacy by design in operations: default settings must be the most privacy-protective, collection forms must collect only fields with a documented purpose, and retention triggers must be automated in systems.

Training and awareness: role-based training for frontline staff on consent and access requests, for developers on PIAs and data minimization, and for executives on breach escalation; keep completion records.

Monitoring: track metrics such as access-request turnaround, breach volume and time-to-notify, vendor assessment completion, and consent withdrawal rates; feed results into annual program review.