PIPEDA (Personal Information Protection and Electronic Documents Act, Canada)

PIPEDA (Personal Information Protection and Electronic Documents Act, in French: Loi sur la protection des renseignements personnels et les documents électroniques) is the Canadian federal law on personal information protection in the private sector (S.C. 2000, c. 5). It governs the collection, use and disclosure of personal information in interprovincial and international commercial activities. It is the Canadian equivalent of the European GDPR, although less strict on some points (implicit consent sometimes permitted, lower financial penalties).

The 10 PIPEDA principles (from the Canadian Standards Association CAN/CSA-Q830):
1. Accountability — designate a personal information protection officer.
2. Identifying purposes — clearly state the purpose of collection.
3. Consent — obtain informed consent.
4. Limiting collection — collect only what is necessary.
5. Limiting use — use only for stated purposes.
6. Accuracy — keep data current.
7. Safeguards — appropriate technical and organizational protection.
8. Openness — public privacy policy.
9. Individual access — right to access and correct personal information.
10. Complaining procedure — complaint mechanism to the Privacy Commissioner of Canada.

PIPEDA and electronic signature: electronic signature involves processing personal data (name, email address, phone number, IP, session metadata, audit trail). PIPEDA requires:
• informed consent from the signatory before collection;
• secure retention (encryption at rest, restricted access);
• retention period proportionate to purpose (10 years for commercial contracts is generally accepted);
• right of access, correction and deletion on signatory''s request;
• mandatory notification in case of breach presenting real risk of serious harm (since 2018).

Quebec Law 25: the province of Quebec has its own law (Law 25 / Law modernizing personal information protection provisions, in force 2022-2024) which prevails over PIPEDA for intra-Quebec activities. Law 25 is stricter than PIPEDA — aligned with European GDPR on most points: mandatory explicit consent, designation of a personal information protection officer, impact assessments (DPIA), penalties up to 4% of worldwide revenue.

PIPEDA vs GDPR: the European Commission recognizes PIPEDA as providing an "adequate" level of protection under article 45 GDPR (Decision 2002/2/EC confirmed 2024). Transfers of personal data from the EU to Canada are therefore permitted without further formality. For Canadian organizations operating in the EU, GDPR remains applicable to the data of European residents (extraterritoriality, article 3).

Certyneo implementation: PIPEDA + Law 25 + GDPR compliance ensured by our data protection architecture — EU sovereign hosting (IONOS Germany), TLS 1.3 encryption in transit + AES-256 at rest, access logging, right to complete erasure within 30 days, compliant sub-processors. Transfers to Canada (rare — only accounts hosted on request in Canada) are governed by GDPR-PIPEDA standard contractual clauses.