> ## Documentation Index
> Fetch the complete documentation index at: https://help.dsalta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# PIPEDA

> Comply with Canada's federal private-sector privacy law.

> Comply with Canada's federal private-sector privacy law.

The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's federal privacy law for private-sector organizations. It governs how businesses collect, use, and disclose personal information in the course of commercial activity, based on ten fair information principles.

<Note>
  PIPEDA applies to private-sector organizations across Canada, except in provinces with substantially similar laws (such as Quebec, British Columbia, and Alberta) for intra-provincial activity.
</Note>

## Who needs PIPEDA?

<CardGroup cols={2}>
  <Card title="Canadian businesses" icon="flag">
    Private-sector organizations that collect personal information during commercial activities.
  </Card>

  <Card title="Businesses serving Canadians" icon="globe">
    Organizations outside Canada that handle the personal data of Canadians may also be subject to PIPEDA.
  </Card>
</CardGroup>

## Key components

<CardGroup cols={3}>
  <Card title="Ten principles" icon="list-ol">
    Accountability, identifying purposes, consent, limiting collection, and six more fair information principles.
  </Card>

  <Card title="Meaningful consent" icon="square-check">
    Obtain valid, informed consent for collection, use, and disclosure.
  </Card>

  <Card title="Access rights" icon="user-shield">
    Individuals can access and correct their personal information.
  </Card>

  <Card title="Breach reporting" icon="bell">
    Report breaches posing real risk of significant harm to the Privacy Commissioner.
  </Card>
</CardGroup>

## How DSALTA helps with PIPEDA

<Steps>
  <Step title="Activate PIPEDA">
    Select PIPEDA from the Frameworks page. DSALTA maps the ten principles to controls.
  </Step>

  <Step title="Review privacy controls">
    Review controls for consent, access, and safeguards.
  </Step>

  <Step title="Collect evidence automatically">
    Connect integrations to maintain privacy evidence.
  </Step>

  <Step title="Approve privacy policies">
    Review and approve Canada-specific privacy policies.
  </Step>

  <Step title="Maintain accountability">
    Track consent records and breach response procedures.
  </Step>
</Steps>

## Frequently asked questions

<AccordionGroup>
  <Accordion title="Does PIPEDA apply to my business?" icon="circle-question">
    If you collect personal information in the course of commercial activity in Canada, generally yes — unless a substantially similar provincial law applies.
  </Accordion>

  <Accordion title="What about Quebec's Law 25?" icon="scale-balanced">
    Quebec has its own modernized privacy law (Law 25). Organizations operating there should assess both.
  </Accordion>
</AccordionGroup>

## Related pages

* [Active Frameworks](/guides/compliance/frameworks-active)
* [Available Frameworks](/guides/compliance/frameworks-available)
* [Controls](/guides/compliance/controls)
* [Audits](/guides/compliance/audits)