Canadian PIPEDA

Canada

4 domains

31 controls

Personal Information Protection and Electronic Documents Act. Federal Canadian private-sector privacy law.

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (4)

PIPEDA: Breach of Security Safeguards (Division 1.1)

5 controls

Controls in the PIPEDA: Breach of Security Safeguards (Division 1.1) domain of Canadian PIPEDA — 5 controls
Code	Title	Description
PIPEDA-10.1	Report of Breach to the Commissioner	s.10.1(1): an organization must report to the Privacy Commissioner any breach of security safeguards involving personal...
PIPEDA-10.1(6)	Real Risk of Significant Harm Assessment	s.10.1(7)-(8): factors relevant to assessing the real risk of significant harm, including sensitivity of the information...
PIPEDA-10.1-ind	Notification of Breach to Individuals	s.10.1(3): an organization must notify affected individuals of a breach that creates a real risk of significant harm, un...
PIPEDA-10.2	Notification to Other Organizations	s.10.2: an organization must notify other organizations or government institutions that may be able to reduce or mitigat...
PIPEDA-10.3	Records of Breaches	s.10.3: an organization must keep and maintain a record of every breach of security safeguards involving personal inform...

PIPEDA: Complaints and Oversight

1 controls

Controls in the PIPEDA: Complaints and Oversight domain of Canadian PIPEDA — 1 controls
Code	Title	Description
PIPEDA-11	Filing of Complaints with the Commissioner	s.11: an individual may file a written complaint with the Privacy Commissioner against an organization for contravening...

PIPEDA: Consent and Use (Division 1)

4 controls

Controls in the PIPEDA: Consent and Use (Division 1) domain of Canadian PIPEDA — 4 controls
Code	Title	Description
PIPEDA-5(3)	Appropriate Purposes	s.5(3): an organization may collect, use or disclose personal information only for purposes that a reasonable person wou...
PIPEDA-6.1	Valid Consent	s.6.1: consent is valid only if it is reasonable to expect that the individual understands the nature, purpose and conse...
PIPEDA-7	Collection, Use and Disclosure Without Consent	s.7: limited circumstances in which personal information may be collected, used or disclosed without knowledge or consen...
PIPEDA-7.3	Disclosure for Prospective Business Transaction	s.7.2/7.3: conditions for using and disclosing personal information in the course of a prospective or completed business...

PIPEDA: Schedule 1 Fair Information Principles

21 controls

Controls in the PIPEDA: Schedule 1 Fair Information Principles domain of Canadian PIPEDA — 21 controls
Code	Title	Description
PIPEDA-4.1	Principle 1 - Accountability	Schedule 1, 4.1: an organization is responsible for personal information under its control and must designate an individ...
PIPEDA-4.1.3	Accountability for Transfers to Third Parties	Schedule 1, 4.1.3: an organization is responsible for personal information transferred to a third party for processing a...
PIPEDA-4.1.4	Policies and Practices (Privacy Management Program)	Schedule 1, 4.1.4: implement policies and practices to give effect to the principles - procedures, complaint handling, t...
PIPEDA-4.10	Principle 10 - Challenging Compliance	Schedule 1, 4.10: an individual must be able to address a challenge concerning compliance to the designated accountable...
PIPEDA-4.2	Principle 2 - Identifying Purposes	Schedule 1, 4.2: the purposes for which personal information is collected must be identified at or before the time of co...
PIPEDA-4.2.4	New Purpose Requires New Consent	Schedule 1, 4.2.4: identifying a new purpose after collection requires the consent of the individual before use.
PIPEDA-4.3	Principle 3 - Consent	Schedule 1, 4.3: the knowledge and consent of the individual are required for the collection, use or disclosure of perso...
PIPEDA-4.3.4	Form of Consent Calibrated to Sensitivity	Schedule 1, 4.3.4-4.3.6: the form of consent (express vs implied, opt-in vs opt-out) depends on the sensitivity of the i...
PIPEDA-4.3.8	Withdrawal of Consent	Schedule 1, 4.3.8: an individual may withdraw consent at any time, subject to legal or contractual restrictions and reas...
PIPEDA-4.4	Principle 4 - Limiting Collection	Schedule 1, 4.4: collection must be limited to what is necessary for the identified purposes and collected by fair and l...
PIPEDA-4.5	Principle 5 - Limiting Use, Disclosure and Retention	Schedule 1, 4.5: personal information must not be used or disclosed for purposes other than those for which it was colle...
PIPEDA-4.5.3	Secure Destruction and Retention	Schedule 1, 4.5.3: information no longer required must be destroyed, erased or made anonymous; guidelines and procedures...
PIPEDA-4.6	Principle 6 - Accuracy	Schedule 1, 4.6: personal information must be as accurate, complete and up-to-date as necessary for the purposes for whi...
PIPEDA-4.7	Principle 7 - Safeguards	Schedule 1, 4.7: personal information must be protected by security safeguards appropriate to the sensitivity of the inf...
PIPEDA-4.7.3	Categories of Safeguards	Schedule 1, 4.7.3: safeguards must include physical, organizational and technological measures.
PIPEDA-4.7.4	Employee Awareness of Safeguards	Schedule 1, 4.7.4: organizations must make employees aware of the importance of maintaining the confidentiality of perso...
PIPEDA-4.8	Principle 8 - Openness	Schedule 1, 4.8: an organization must make readily available specific information about its policies and practices relat...
PIPEDA-4.8.2	Required Openness Information	Schedule 1, 4.8.2: the information made available must include the accountable person contact, access procedures, a desc...
PIPEDA-4.9	Principle 9 - Individual Access	Schedule 1, 4.9: upon request, an individual must be informed of the existence, use and disclosure of their personal inf...
PIPEDA-4.9.4	Access Response Timelines	Schedule 1, 4.9.4: requested information must be provided within a reasonable time and at minimal or no cost (generally...
PIPEDA-4.9.5	Correction and Notation	Schedule 1, 4.9.5: an individual may challenge the accuracy and completeness of information and have it amended; unresol...

Maps to 1 other framework

31 total controls

GDPR

21 source controls mapped|9 target controls covered

68%

Compare Canadian PIPEDA with GDPR

Frequently Asked Questions

What is Canadian PIPEDA?

Canadian PIPEDA is a compliance framework from Canada with 4 domains and 31 controls. Personal Information Protection and Electronic Documents Act. Federal Canadian private-sector privacy law. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does Canadian PIPEDA have?

Canadian PIPEDA has 31 controls organised across 4 domains. The largest domains are PIPEDA: Schedule 1 Fair Information Principles (21 controls), PIPEDA: Breach of Security Safeguards (Division 1.1) (5 controls), PIPEDA: Consent and Use (Division 1) (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does Canadian PIPEDA map to?

Canadian PIPEDA maps to 1 other compliance frameworks. The top mapping partners are GDPR (68% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I get started with Canadian PIPEDA compliance?

Start your Canadian PIPEDA compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Canadian PIPEDA requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 31 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 718 frameworks.

Get Started Free →

Free forever — no credit card required