CIPP/C key terms

Information about an identifiable individual, recorded in any form. Under PIPEDA it excludes business contact information and publicly available information in specified circumstances, but includes aggregated data that can be re-linked to a person.

The quality of data that allows a specific individual to be singled out, directly or indirectly, including by combining it with other available data. Canadian regulators treat serious possibility of identification, not certainty, as the test.

The federal Personal Information Protection and Electronic Documents Act, which governs private-sector handling of personal information in federally regulated businesses and in provinces without substantially similar legislation, and applies to cross-border and interprovincial commercial activity.

The ten schedule 1 principles at the core of PIPEDA, covering accountability, identifying purposes, consent, limiting collection, limiting use and retention, accuracy, safeguards, openness, individual access, and challenging compliance. They are stated as obligations, not suggestions.

A provincial privacy statute the federal government has declared comparable to PIPEDA, so it displaces PIPEDA for personal information handled within that province. Examples include Quebec, Alberta, British Columbia, and health-sector laws in Ontario, New Brunswick, and Newfoundland and Labrador.

Quebec legislation amending its private-sector privacy regime, phased in from 2022 to 2024. It adds privacy impact assessments, breach notification, confidentiality by default, portability, and biometrics rules, giving Quebec the strictest provincial framework.

A structured review, required before a federal institution launches a program or system involving personal information, that identifies privacy risks and mitigation. Under Law 25, Quebec organizations must conduct one for projects involving new technology or sensitive data.

A Quebec Law 25 rule requiring that technological products and services, when offered commercially, be configured to protect personal information with the highest level of privacy by default, without the user having to change settings.

An approach embedding privacy protections into systems, processes, and business practices from the outset rather than retrofitting them later. It includes minimizing data collection, limiting use, and building safeguards into architecture and governance.

Consent that a reasonable person would understand and accept, given clear explanations of what data is collected, why, with whom it is shared, and the consequences. Regulators reject bundled, vague, or forced consent and require withdrawal mechanisms.

A clear, affirmative statement or action agreeing to the handling of personal information, given directly by the individual. It is generally required for sensitive information, such as health data or financial details, and for secondary uses.

Consent reasonably inferred from an individual's conduct or the circumstances, such as providing contact details to receive a delivery. It is acceptable only where the information is non-sensitive and the purpose is obvious and expected.

Information enabling contact at a place of work, such as name, title, business address, phone, and email. PIPEDA does not apply to it, though provincial statutes such as Alberta's PIPA and Quebec's Law 25 may still cover it.

The PIPEDA principle requiring an organization to designate a privacy officer or equivalent, document its privacy practices, train staff, and respond to complaints. Responsibility for compliance cannot be outsourced to a processor or vendor.

The individual designated by an organization to be accountable for compliance with privacy law, handle access requests and complaints, and act as the contact point for regulators and individuals. The role may be combined with other duties.

The documented governance structure, policies, training, risk assessments, incident response, and monitoring an organization uses to embed privacy compliance into operations. Regulators expect it to be proportionate to the sensitivity and volume of data handled.

Collecting and retaining only the personal information needed for a stated purpose, for only as long as necessary. It reduces breach impact and supports the PIPEDA limits on collection and retention.

A documented plan specifying how long each category of personal information is kept and how it is destroyed. Retention periods must reflect legal requirements and operational need, with secure destruction at the end.

Irreversibly eliminating personal information so it cannot be reconstructed, using methods such as cross-cut shredding, degaussing, cryptographic erasure, or certified media destruction. Records must be destroyed when retention periods end.

Physical, organizational, and technological controls protecting personal information against loss, theft, unauthorized access, and disclosure. They must be proportionate to sensitivity, and include access controls, encryption, and staff training.

Technical and administrative measures limiting who can view or use personal information, based on role and need to know. Examples include role-based permissions, multi-factor authentication, and audit logs of access.

A security principle granting users only the access necessary to perform their duties, and revoking it when no longer needed. It limits the scope of insider misuse and the damage from compromised accounts.

Loss of, unauthorized access to, or unauthorized disclosure of personal information resulting from a failure of safeguards. PIPEDA requires reporting to the Privacy Commissioner and notifying affected individuals when there is a real risk of significant harm.

The PIPEDA threshold for mandatory breach reporting and notification. It considers sensitivity of the data, probability of misuse, and factors such as whether the information could cause humiliation, reputational damage, or financial loss.

A record every organization must keep of any breach of security safeguards, whether or not it meets the reporting threshold. Records must be retained for 24 months and provided to the Privacy Commissioner on request.

The federal regulator overseeing PIPEDA and the Privacy Act. It investigates complaints, conducts audits, issues findings and guidance, and can take matters to Federal Court to enforce compliance.

Federal legislation governing how government institutions collect, use, retain, and disclose personal information. It gives individuals access rights and is overseen by the Privacy Commissioner, separate from PIPEDA's private-sector scope.

An investigation opened by the Privacy Commissioner on their own initiative rather than from a public complaint, often triggered by a breach, media report, or audit finding. It can lead to published findings and recommendations.

A formal examination by a privacy regulator of an organization's practices, compliance, and records. In Canada, the Commissioner may audit an organization's personal information handling under PIPEDA, and findings may be published.

Ongoing oversight of an organization's privacy performance through metrics, internal reviews, testing, and follow-up on corrective actions. It turns policies into verifiable practice and demonstrates accountability to regulators.

An individual's formal request to see the personal information an organization holds about them, plus details of its use and disclosure. Organizations must respond within statutory time limits, generally 30 days, with limited exceptions.

A request that an organization amend inaccurate or incomplete personal information. If the organization refuses, it must annotate the record with the individual's disagreement and inform relevant third parties where appropriate.

The PIPEDA principle requiring personal information to be as accurate, complete, and up to date as necessary for the purposes for which it is used. The standard depends on the use, with higher expectations for data that affects decisions about individuals.

A third party that handles personal information on behalf of another organization for defined purposes and under contract. Under PIPEDA the original organization remains accountable for the processor's compliance.

Disclosing personal information to a service provider, including one abroad, for processing such as payroll or cloud hosting. PIPEDA requires contractual protections and, for cross-border transfers, disclosure of the possibility of foreign law access.

Moving personal information to another jurisdiction for storage or processing. Canadian guidance requires comparable protection, transparency to individuals, and consideration of whether foreign authorities can compel disclosure.

Removing or altering identifiers so that personal information can no longer be linked to an identifiable individual, while reducing re-identification risk. Residual risk must be assessed and managed continuously.

Irreversibly removing personal identifiers so the data no longer relates to an identifiable individual. If anonymization is reversible or re-identification is reasonably possible, the data remains personal information under Canadian law.