Documentation / Platform glossary / PIPEDA
Canada's Personal Information Protection and Electronic Documents Act governs how private-sector organizations collect, use, and disclose personal information in commercial activity. It is built on ten fair information principles, with meaningful consent and identified purpose at its centre, and is overseen by the federal Privacy Commissioner.
PIPEDA is principles-based rather than prescriptive. Its ten fair information principles cover accountability, identifying purposes, consent, limiting collection, limiting use and disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance.
Two principles carry most of the operational weight. Identifying purposes requires an organization to determine and document why it is collecting personal information before it collects it — purpose is not something established retroactively. Consent must be meaningful, which means the individual can reasonably understand what they are agreeing to; consent buried in dense terms may not qualify.
PIPEDA applies to commercial activity across Canada, except where a province has substantially similar private-sector legislation — Quebec, British Columbia, and Alberta each do. Employee personal information is covered only for federally regulated works and undertakings, which is a frequent source of confusion for HR systems.
For workforce and candidate data, PIPEDA's purpose limitation constrains reuse. Information gathered for recruitment cannot be repurposed for an unrelated program without addressing consent. Its retention principle points the same direction: personal information should not be kept once the identified purpose is fulfilled.
Quebec's Law 25 has moved that province closer to a GDPR-style regime, so "Canada" is not a single compliance target.
QueryTek documents PIPEDA so teams evaluating Canadian deployments can reason about purpose limitation, consent, and retention using consistent vocabulary. This is evaluation literacy, not legal advice; applicability depends on jurisdiction, sector, and the nature of the data.
