What does Canada's PIPEDA require of a software company?

PIPEDA, Canada's federal private-sector privacy law, requires organizations to follow ten fair information principles when handling personal information in commercial activity. It also requires that any collection, use or disclosure serve purposes a reasonable person would consider appropriate. Security safeguards, principle seven, must match how sensitive the data is.

What are the ten principles?

The Office of the Privacy Commissioner of Canada (OPC) lists them. In plain words:

1. Accountability: someone is appointed to answer for compliance, and you remain responsible for data under your control.
2. Identifying purposes: say why you collect data before or when you collect it.
3. Consent: get the person's knowledge and consent for collection, use and disclosure, except where inappropriate.
4. Limiting collection: collect only what the stated purposes need, by fair and lawful means.
5. Limiting use, disclosure and retention: use data only for the purposes collected, and keep it only as long as needed.
6. Accuracy: keep it accurate, complete and current enough for the purpose.
7. Safeguards: protect it with security appropriate to its sensitivity.
8. Openness: publish clear information about your practices.
9. Individual access: tell people on request what you hold and how it is used and disclosed.
10. Challenging compliance: let people challenge your compliance and have the challenge handled.

What is the appropriate purposes test?

Beyond the principles, the OPC says collection, use or disclosure must be only for purposes a reasonable person would consider appropriate in the circumstances. It lists purposes it generally considers inappropriate, such as ways that are otherwise unlawful, profiling that leads to unfair or discriminatory treatment contrary to human rights law, purposes likely to cause significant harm, and surveillance of a person through their own device's microphone or camera.

For a product team, this means a feature can be technically secure and still fail, if its purpose is not appropriate.

What do engineers actually own?

Several principles land on engineering work. A constructed example: a meeting app logs full request bodies for debugging, including attendee emails, and keeps them indefinitely. That conflicts with limiting collection and retention, and the log store may be less protected than the production database, which strains safeguards.

Engineering-owned items include data inventories, retention jobs that actually delete, access controls and encryption proportionate to sensitivity, logging that avoids personal data, and a way to find everything held about one person for an access request.

How to check or apply this

1. Name the accountable person and write down who handles access and challenge requests.
2. Build a data map: what personal information you collect, where it flows, and which vendors receive it.
3. Attach a stated purpose to each data element, and delete elements without one.
4. Set retention periods and verify deletion runs, including in backups and logs.
5. Match security controls to sensitivity, and record why the level is appropriate.
6. Publish a plain privacy notice and keep it aligned with the data map.
7. Test your access request process end to end with a dummy record.
8. Review new features for appropriate purpose before they ship.

This is an explanation of the framework, not legal advice, and no tool makes you compliant by itself. Safeguard's compliance automation can help you organize evidence for controls you decide to adopt.

Quick check

Sources

• Office of the Privacy Commissioner of Canada: PIPEDA fair information principles

Last reviewed: 18 October 2026.