Canada has a patchwork of federal and provincial privacy laws. Understanding which laws apply to your organization is essential for proper document handling and redaction.
PIPEDA (Federal)
Applies to private sector organizations across Canada (except in provinces with substantially similar legislation). Governs collection, use, and disclosure of personal information in commercial activities.
Alberta and BC PIPA
Alberta and British Columbia each run their own private-sector privacy law, substantially similar to PIPEDA and overseen by provincial commissioners.
Provincial Laws (BC, Alberta)
British Columbia's PIPA and Alberta's PIPA are substantially similar to PIPEDA and apply instead of the federal law for private sector activities within those provinces.
Personal Information to Redact
Standard Personal Information
- Names and signatures
- Home addresses
- Email addresses
- Phone numbers
- Social Insurance Numbers (SIN)
- Driver's license numbers
- Bank account numbers
- Provincial health card numbers
Sensitive Personal Information
- Health information
- Financial information
- Ethnic origin
- Political opinions
- Religious beliefs
- Sexual orientation
- Biometric data
- Criminal records
Coming: Consumer Privacy Protection Act (CPPA)
Federal Privacy Law Reform
The proposed Consumer Privacy Protection Act (CPPA) would replace PIPEDA with significantly stronger requirements:
- Penalties up to $25 million CAD or 5% of global revenue
- Private right of action for individuals
- Algorithmic transparency requirements
- Enhanced consent requirements
- Data portability and disposal rights
Organizations should prepare now for stricter requirements.
When Redaction is Required
Access Requests
When responding to individual access requests, redact information about other identifiable individuals. You must respond within 30 days.
Third-Party Disclosure
Before sharing documents with third parties, redact personal information not necessary for the disclosed purpose.
Legal Proceedings
Court filings and litigation discovery often require redaction of irrelevant personal information to protect third-party privacy.
Retention & Disposal
When documents must be retained but personal information is no longer needed, redaction can de-identify while preserving records.
PIPEDA Principles That Require Redaction
Principle 4.4 — Limiting Collection
Personal information must be limited to what is necessary. When sharing documents containing more data than needed, redaction ensures compliance.
Principle 4.5 — Limiting Use, Disclosure, Retention
Personal information must not be used for purposes beyond original collection, except with consent or as required by law. Redaction is the primary tool for compliant disclosure.
Principle 4.7 — Safeguards
Personal information must be protected by appropriate security safeguards. The OPC considers whether reasonable steps were taken when investigating complaints — redaction before sharing is a reasonable step.
Principle 4.9 — Individual Access
Individuals can request access to their personal information. When responding, redact third-party data — similar to GDPR DSARs and Australian APP 12.
Federal vs Provincial Enforcement
Federal: OPC (PIPEDA)
The OPC investigates complaints and makes recommendations. Currently cannot directly impose fines, but can refer to Federal Court for damages.
Mandatory breach reporting: Since November 2018, breaches with "a real risk of significant harm" must be reported. Failure: fines up to C$100,000 per offense.
Provincial: Alberta and BC (PIPA)
Each province enforces its own private-sector law through a provincial commissioner.
Both regimes are considered substantially similar to PIPEDA; organizations subject to them deal with the provincial commissioner rather than the OPC.
CPPA: What's Coming
Bill C-27 would replace PIPEDA with significantly stronger enforcement. It died when Parliament prorogued in January 2025 but is expected to be reintroduced.
C$25M
or 5% of global revenue
Maximum for serious violations
C$10M
or 3% of global revenue
Administrative penalties (no court)
New
Private right of action
Class action exposure similar to CCPA
How SafeRedact Helps
AI Detection
Automatically identifies SINs, health card numbers, addresses, and other Canadian personal information.
Permanent Removal
Data is permanently removed from the document—not just covered with black boxes.
Meet Deadlines
Process access requests efficiently to meet 30-day response requirements.
Protect Personal Information. Comply with Canadian Law.
AI-powered redaction for PIPEDA and provincial privacy compliance. Start free—no credit card required.
Start Redacting Free