PIPEDA Compliance Checklist for Small Business (2026)

Does PIPEDA apply to your business?

The Personal Information Protection and Electronic Documents Act covers private-sector organizations that handle personal information in the course of commercial activity. That includes customer names, emails, payment details, employee records at federally regulated businesses, and anything else that identifies a person.

The picture is more nuanced than "PIPEDA applies across most of Canada". Alberta, British Columbia and Quebec have their own private-sector privacy laws that have been recognized as substantially similar, and those laws generally apply to organizations operating within those provinces. PIPEDA still applies to personal information that crosses provincial or national borders in the course of commercial activity, and to federally regulated businesses everywhere. In the rest of the country, PIPEDA is the main law. If you serve customers in several provinces, you may answer to more than one regime at once.

If you operate in Quebec, read our guide to Law 25 for small business alongside this page. Where two rules overlap, follow the stricter one.

The 10 fair information principles, in plain English

PIPEDA's rules are organized around ten principles set out in the Act's schedule. The Office of the Privacy Commissioner explains them in its fair information principles guide. The table translates each into an action and the evidence worth keeping.

Printable checklist

Copy this into a document or spreadsheet and assign an owner and a date to each line. It is grouped by area so you can work through it in a sitting or two.

Governance

• ☐ A named person is accountable for privacy, and customers can reach them
• ☐ Staff who handle personal information have had short privacy training
• ☐ Privacy decisions and reviews are written down

Data inventory and consent

• ☐ You know what personal information you hold, where it is kept and who can access it
• ☐ Each type of data has a stated purpose and a retention period
• ☐ Consent wording is clear, and sensitive data gets express consent
• ☐ Forms collect only what you actually use

Safeguards and vendors

• ☐ Multi-factor authentication is on for email, cloud apps and remote access
• ☐ Laptops and phones that hold personal data are encrypted and can be wiped
• ☐ Access is limited to the people who need it and reviewed regularly
• ☐ Backups exist, are tested and are protected from ransomware
• ☐ Every service provider that handles personal information is listed, and contracts require comparable protection

Breach and individual rights

• ☐ A written breach plan names who decides, who is told and who keeps the record
• ☐ A breach record is kept for every incident, whether or not it is reported
• ☐ People can request access to, and correction of, their personal information
• ☐ People can complain, and complaints are logged and answered

Breach response under PIPEDA

PIPEDA's breach rules are the part most small businesses have never read. The Office of the Privacy Commissioner explains them in its guidance on responding to a privacy breach at your business. In short:

• Assess the risk. A breach of security safeguards means loss of, unauthorized access to, or unauthorized disclosure of personal information. You must decide whether it creates a real risk of significant harm (often shortened to RROSH), considering how sensitive the data is and how likely it is to be misused.
• Report and notify. If the risk threshold is met, you must report the breach to the Office of the Privacy Commissioner and notify affected individuals as soon as feasible. You may also need to tell other organizations that can reduce the harm.
• Keep records. Keep a record of every breach of security safeguards, including ones you decide not to report, for 24 months.
• Know the consequences. The Commissioner does not issue fines, but knowingly failing to report a breach or keep records is an offence under the Act. Check the statute for current maximums.

Our incident response checklist gives you a practical sequence to follow, and our guide to reporting a data breach in Quebec covers the provincial side.

Technical safeguards regulators and clients ask about

"Appropriate safeguards" is a standard, not a product list, but a few controls come up again and again when a client, insurer or investigator looks at your setup:

• Multi-factor authentication on every account that can reach personal information. See our MFA setup guide.
• Encryption of laptops, phones and backups.
• Access control and logs, so you can show who can see what and who did what.
• Tested backups kept separate from your main network. See backup and disaster recovery.
• Staff training, especially on phishing. See phishing prevention.

PIPEDA and Law 25 side by side

Law 25 modernized Quebec's private-sector privacy act. It overlaps with PIPEDA but is stricter in several places. This is a simplified comparison, not a legal opinion.

Note that Law 25 does not set a 72-hour deadline. That number comes from Europe's GDPR. Quebec's rule is to report promptly when the incident presents a risk of serious injury.

Where small businesses slip

These are the gaps we see most often when we review small Canadian organizations. They are practical observations from our own work, not statistics: a vague or missing privacy notice, no named privacy contact, no multi-factor authentication on email, and no plan for access requests or breaches. Fixing these covers the most common weaknesses, but it is not the same as full compliance, so keep going through the checklist above.

What may change

Federal privacy reform has been proposed in recent years, and the rules may change. PIPEDA remains the law in force until Parliament passes a replacement. Check the Office of the Privacy Commissioner's website for the current status before you rely on any summary, including ours.

Want help with the technical side? IT Cares can set up the security and access controls that privacy law expects. See also our PIPEDA compliance checklist overview and privacy officer guide.

Frequently asked questions