PIPEDA does not prescribe controls, so compliance evidence is the record that your safeguards fit the sensitivity of the data and are reviewed. Keep a named accountable person, a security policy, test results, training records, and a log of every breach of security safeguards for 24 months.
Who must comply?
The Office of the Privacy Commissioner of Canada says PIPEDA applies to private sector organizations across Canada that collect, use or disclose personal information in the course of commercial activity. Alberta, British Columbia and Quebec have their own private sector laws deemed substantially similar, and organizations under those laws are generally exempt for activity within the province. Information crossing provincial or national borders is covered by PIPEDA. If you are unsure, check the OPC page or ask counsel. This article explains the framework and is not legal advice.
What do the ten principles ask for?
The principles are accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance. Accountability requires appointing someone responsible for compliance.
For engineers, safeguards is the principle that touches the stack most. The OPC guidance says to protect personal information against loss, theft and unauthorized access, disclosure, copying, use or modification, in a way that is appropriate to its sensitivity. It states plainly that PIPEDA does not specify particular security safeguards, and that you must keep adequate protection as technologies and risks change.
What safeguards does the OPC list?
It describes physical measures, technological tools such as passwords, encryption, firewalls and security patches, and organizational controls such as limiting access, staff training and agreements. Factors in choosing include sensitivity, amount, extent of distribution, format, storage type and the risks you face. It asks you to review safeguards regularly, including by security audits or testing, and to train staff.
What breach records must you keep?
Under section 10.1 of the Act, an organization must report to the Commissioner a breach of security safeguards involving personal information under its control if it is reasonable to believe it creates a real risk of significant harm, and must notify affected individuals in the same circumstance, as soon as feasible. The Breach of Security Safeguards Regulations require a record of every breach for 24 months after the day the organization determines it occurred, including whatever lets the Commissioner verify compliance. That record applies to every breach, not only the reportable ones.
Evidence checklist
Constructed example: a Canadian SaaS company gets an enterprise customer questionnaire that asks about privacy compliance. Its answer pack holds the items below, each with an owner and a review date.
- Name and role of the person accountable, and the internal privacy policy.
- A data inventory: what personal information, where stored, why collected, retention period.
- The security policy and a mapping of safeguards to data sensitivity.
- Access reviews, showing who can reach personal data and that it is need to know.
- Patch and vulnerability management records, plus penetration test or audit results.
- Encryption configuration for data at rest and in transit.
- Training attendance for staff who handle personal data.
- Vendor list with the data each vendor processes and the agreements in place.
- Breach log with assessment of harm, decisions and notifications, kept 24 months.
- Process and records for access requests and complaints.
What to do
- Appoint and document the accountable person.
- Build the data inventory before anything else. Every other item depends on it.
- Write the risk to safeguard mapping, then collect real evidence for each line.
- Set a calendar for access reviews, testing and training.
- Create the breach log now, before you need it, and rehearse an incident.
- Review the pack twice a year and after major changes.
Quick check
Does PIPEDA require a certification?
No. It requires appropriate safeguards and accountability. A certification may help as evidence but is not required by the Act.
How long are breach records kept?
24 months after the day you determine the breach occurred, under the regulations.
Sources
- OPC: PIPEDA requirements in brief
- OPC: PIPEDA fair information principles
- OPC: Principle 7, Safeguards
- PIPEDA section 10.1, Justice Laws
- Breach of Security Safeguards Regulations, Justice Laws
Last reviewed: 18 October 2026.
