This is the federal legislation that sets out the ground rules for how private-sector organizations collect, use or disclose personal information in the course of commercial activities across Canada. It also applies to personal information of employees of federally regulated works, undertakings, or businesses (organizations that are federally regulated, such as banks, airlines, and telecommunications companies).

It should be noted that PIPEDA does not apply to organizations that are not engaged in commercial activity. As such, it does not generally apply to not-for-profit and charity groups, associations or political parties, for example—unless the organization is conducting a commercial activity (fundraising is not considered a commercial activity).

In addition, PIPEDA will not apply to an organization that operates wholly within a province that has legislation that has been deemed substantially similar to PIPEDA, unless the personal information crosses provincial or national borders. Alberta, British Columbia, and Quebec have general private-sector legislation that has been deemed substantially similar. Therefore, PIPEDA generally applies to:

See Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5.