PIPEDA for Canadian SaaS — Best practices
Personal Information Protection and Electronic Documents Act compliance for SaaS providers
PIPEDA (Personal Information Protection and Electronic Documents Act) is Canada's federal private-sector privacy law, applying to all commercial activities across the country. Combined with provincial laws (Quebec Law 25, BC PIPA, Alberta PIPA), it forms Canada's privacy framework. This guide covers PIPEDA requirements for SaaS providers — data residency, consent, breach notification, individual rights.
PIPEDA scope and 10 fair information principles
PIPEDA applies to private-sector organisations collecting personal information in the course of commercial activities. The 10 fair information principles: accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, challenging compliance. SaaS provider role: data processor for customer's data.
Consent under PIPEDA
Consent must be meaningful — individual understands what they're agreeing to. Implied consent acceptable for low-sensitivity uses related to product/service. Express consent needed for sensitive info (financial, health, biometric) and for any secondary uses. Withdrawal must be possible and processed promptly.
Mandatory breach reporting (since November 2018)
Breaches involving real risk of significant harm (RROSH) must be: (1) reported to Office of the Privacy Commissioner ASAP, (2) notified to affected individuals ASAP, (3) recorded in business breach log (kept 24 months minimum). Failure to report: up to $100k per affected individual.
Individual access rights
Individuals can request: confirmation that their data is held, copy of the data, account of how it's used, account of disclosures. Response within 30 days (extension 30 days possible if needed). Refusal grounds limited: solicitor-client privilege, ongoing legal proceedings, etc.
Data retention and disposal
Personal information should be retained 'only as long as necessary' for the purposes collected. Must have documented retention schedule. CRA tax-related records: 6 years. Employment records: per provincial labour code (typically 3-7 years). Customer commercial data: typically 1-2 years post-relationship.
How 4b2b helps
Frequently asked questions
Am I a data controller or processor?
Usually data processor — your customer (the SaaS user) is the controller of their end-users' data. You process under their instructions per the DPA you sign with them.
Do I need consent for all data collection?
Implied consent is acceptable for typical commercial uses. Express consent required for sensitive data and any secondary uses. Best to err on side of express consent.
What's a 'reportable breach'?
Real risk of significant harm (RROSH) to individuals: identity theft, financial loss, employment loss, embarrassment, damage to reputation. If unclear, err on side of reporting.
How does PIPEDA differ from GDPR?
PIPEDA generally less strict: implied consent often OK, no right to data portability or erasure (though access rights similar), DPO not mandatory (unlike Law 25 Quebec).
Quebec Law 25 vs PIPEDA?
Quebec Law 25 generally stricter and applies to Quebec residents. If you have Quebec customers, comply with Law 25 (which subsumes PIPEDA federal in Quebec). Otherwise PIPEDA federal applies.
Related solutions & industries
Put this guide into practice with concrete 4b2b solutions and industry-specific examples.