To implement PIPEDA, Canada's federal private sector privacy law, a software company appoints an accountable person, maps the personal information it handles, applies the ten fair information principles to each use, and builds a breach process that assesses real risk of significant harm, notifies, and records every breach.
What are the ten principles?
The Office of the Privacy Commissioner of Canada describes them as the ground rules for collection, use and disclosure of personal information. In short: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access and challenging compliance. The OPC adds that any collection, use or disclosure must be for purposes a reasonable person would consider appropriate, and lists no-go zones, for example profiling that leads to unfair or discriminatory treatment, and surveillance using an individual's own device camera or microphone.
Step by step
Step 1, accountability. Appoint someone accountable for compliance. The OPC says an organization is responsible for personal information under its control and must name that person. Publish how to reach them.
Step 2, map your data. List what personal information your product and company collect, where it flows and who processes it. Include logs, analytics, support tickets and sub-processors. You cannot apply the other steps to data you cannot see.
Step 3, purposes and consent. Write down why each item is collected, before or at the time of collection. Make the notices match the real use. Obtain consent as the principle requires, unless an exception applies.
Step 4, limits. Collect only what the purposes need, use it for those purposes and keep it only as long as required. Set retention periods per data type and automate deletion where you can.
Step 5, safeguards. The OPC says security must be appropriate to the sensitivity of the information. For software, that means access control, encryption, secure development, dependency and vulnerability management, vendor review and logging.
Step 6, openness and access. Publish clear policy information. Build a process to answer individuals who ask what you hold, how you use it, and to correct inaccuracies.
Step 7, complaints. Provide a way for individuals to challenge compliance, handled by the accountable person.
Step 8, breaches. The OPC guidance says PIPEDA requires you to report to the OPC breaches of security safeguards that pose a real risk of significant harm, notify affected individuals and relevant third parties, and keep records of all breaches, whether or not they meet that threshold. A breach is a loss of, or unauthorized access to, use or disclosure of personal information.
A constructed example: a B2B scheduling app stores customer contact details. A developer exports a production table to debug a report and leaves the file in a shared drive with broad access. Under the guidance you assess whether harm is a real risk, record the event regardless of the result and decide on notification. Having the runbook and a record template ready makes this take hours, not days.
How do you show it works?
Keep a register of processing, a retention schedule, the breach log, training records and a vendor list. Review them at least yearly and after significant changes. Safeguard's compliance automation, asset discovery and SBOM and dependency scanning can help keep the technical side of safeguards and inventory current, and does not replace legal advice on whether PIPEDA or a provincial law applies to you.
What to do
- Appoint the accountable person and publish contact details.
- Build the data map and vendor list.
- Write purposes, notices and consent flows that match actual use.
- Set retention rules and delete on schedule.
- Document technical safeguards and test them.
- Create access request and complaint procedures.
- Write the breach runbook, using the OPC's form and risk factors, and keep a log of all breaches.
- Ask counsel whether provincial laws also apply to your operations.
Quick check
Must every breach be reported to the OPC?
No. Report breaches that pose a real risk of significant harm. You must keep records of all breaches, whether or not they are reportable.
Do I need consent for everything?
The consent principle requires knowledge and consent, except where inappropriate, and collection must still serve a purpose a reasonable person would consider appropriate.
Sources
Last reviewed: 18 October 2026.
