Skip to main content

​
Canada PIPEDA Posture Guide

Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) is the federal private-sector privacy law: ten fair-information principles that govern how you collect, use, and disclose personal information in the course of commercial activity. If you message or call Canadian recipients, PIPEDA sits behind every record you hold about them — separate from CASL, the anti-spam statute that governs whether you may send, and separate from the provincial laws a few provinces run on top of the same consent model.
Everything below is a tenant-owned control. Orbit ships the surfaces — the consent ledger, the DSAR workflow, retention settings, the breach incident register, the subprocessor registry — defaults-open; your organization configures them for Canada. PIPEDA compliance remains your responsibility, and the Office of the Privacy Commissioner of Canada (OPC) enforces it regardless of what any toggle says. This page is documentation, not legal advice — have counsel review your consent capture language, your retention schedule, and whether PIPEDA or a substantially-similar provincial law (Quebec Law 25, Alberta PIPA, BC PIPA) governs any given recipient.

​
1. PIPEDA vs CASL — two separate obligations

Canadian operations routinely conflate the two federal regimes. They answer different questions: A CASL-compliant campaign can still breach PIPEDA: the message went out with valid implied consent, but the record behind it has no purpose limitation, no retention window, and no answer when the recipient asks what you hold. Conversely, an immaculate privacy posture does not authorise a single send — CASL judges dispatch; PIPEDA judges stewardship. You need both, and Orbit keeps the surfaces separate on purpose.

​
2. The PIPEDA surface map

PIPEDA codifies ten fair-information principles (accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, challenging compliance). This table maps each principle a Canadian reviewer actually tests to the Orbit control that holds it: The accountability principle also asks where your processing answer is written down: the privacy register records each activity’s purpose, lawful basis, and retention window, and PIPEDA appears there as a first-class jurisdiction exactly as it does on the DSAR surface.
PIPEDA’s mandatory breach-record duty is broader than its notification duty: you keep a record of every breach of security safeguards for 24 months, even the ones you assess as below the RROSH threshold. Open each incident in the register when you detect it, close below-threshold incidents with notification_required: false and the RROSH rationale in remediation, and the register is the 24-month record.

​
3. Worked sequence — an access or erasure request

A Canadian recipient emails your privacy address asking what you hold about them, or asking to be erased. File it under PIPEDA from the first call so the SLA tracker applies the statutory clock:
What happens next, and what evidence each step leaves:
  1. The 30-day clock starts. applicable_jurisdiction: "pipeda" puts the request in the DSAR queue on PIPEDA’s statutory response window, alongside gdpr, ccpa, lgpd, pdpa, and dpdp. If the request arrived generically, reclassify it after intake — the jurisdiction decides which deadline counts.
  2. Erasure feeds suppression. When a delete completes, the outcome flows into your suppression list, so the erased Canadian contact does not re-enter marketing sends through a later CSV import — see Opt-Out & Suppression.
  3. Retention sweeps before requests arrive. PIPEDA’s limiting-retention clause only defends itself if data aged out on schedule. Configure the retention policy per data domain and individual requests mostly find nothing left to erase.
For an access (know) request the same intake applies — swap request_type to know and fulfil through the export the DSAR pipeline produces.

​
4. Worked sequence — a breach with a real risk of significant harm

A support agent’s credential is phished and a mailbox with customer email threads is read. You assess the breach against RROSH — the sensitivity of the information and the probability it will be misused — and conclude reporting thresholds are met. The register carries the record; you carry the Report to the OPC and the individual notifications.
  1. Open the incident. POST /compliance/breach-incidents — the incident lands as detected and discovered_at anchors the attestation clock:
  2. Assess. PATCH /compliance/breach-incidents/{id} with status: "under_assessment", refining the affected counts as forensics progress. Record the RROSH reasoning in remediation — the sensitivity/probability assessment is exactly what an OPC review asks for.
  3. File your Report to the OPC yourself. You submit through the OPC’s reporting channel, then stamp the register: POST /compliance/breach-incidents/{id}/notifications with party: "supervisory_authority" and the OPC case reference — the same move the GDPR walkthrough makes with authority_portal; carry method: "other" or your actual channel when the report went outside a portal. Repeat with party: "data_subjects" for the individual notifications PIPEDA also requires at RROSH.
  4. Pull the attestation. GET /compliance/breach-incidents/{id}/attestation returns the discovery instant, the computed deadline, both parties’ notification timestamps, and a compliant verdict — the 72-hour attestation that turns “we reported promptly” from a claim into a timestamped proof. Attach it to your evidence binder.
Cross-border chains (Ontario → Quebec → British Columbia recipients in one breach) mean the Report, the Quebec CAI filing, and the Alberta OIPC filing may all be owed — the register records each party separately, counsel decides which thresholds apply.

​
5. Boundary — what Orbit never does for you

State these out loud in any posture review, because they define the edge of the platform:
  • Orbit never reports to the OPC for you. The register records and attests; the Report to the Privacy Commissioner, the Quebec CAI, or the Alberta OIPC leaves through your legal channels. Same for the individual notifications.
  • CASL consent is not PIPEDA consent. A CASL implied-consent tier (existing business relationship, conspicuously published address) answers “may we send” — it does not stand in for PIPEDA’s meaningful-consent principle behind the record. Track both; see CASL (Canada’s Anti-Spam Legislation).
  • Provincial carve-outs are yours to route. PIPEDA applies federally and to federally-regulated industries, and to inter-provincial trade; Quebec Law 25, Alberta PIPA, and BC PIPA carry their own rights and sometimes stricter clocks. The DSAR surface files pipeda for the federal route — the provincial decision is a legal classification Orbit never makes.
  • Nothing here gates sending by itself. Every control on this page defaults open; an empty register exports as an empty register. Assemble the posture first, export second.

​
Frequently asked questions

Does a completed CASL posture give me PIPEDA compliance? No. CASL covers the dispatch — consent tier, identification, unsubscribe. PIPEDA judges the stewardship behind the record: purpose limitation, safeguards, retention, access, and breach reporting. A CASL-clean campaign whose records have no retention window still fails a PIPEDA review. Which DSAR clock does a Canadian request carry? 30 days — file or reclassify with applicable_jurisdiction: "pipeda" and the SLA tracker applies the federal statutory window. Do I report every breach to the OPC? No — notification and the OPC Report attach when the breach poses a real risk of significant harm. But the 24-month record-keeping duty covers every breach, including the ones assessed below RROSH; close those in the register with notification_required: false and the assessment rationale recorded. Does Orbit decide my Canadian privacy posture? No. Orbit ships defaults-open controls — the consent ledger, the DSAR pipeline, retention settings, the breach register — for your organization to configure. Tenant-owned posture, explicitly.
This page is documentation, not legal advice — an engineering map of the Orbit surfaces, not a legal opinion. PIPEDA breaches attract OPC findings and can be liable to fines under the Breach of Security Safeguards Regulations for the record-keeping duty alone; have counsel review your consent language, RROSH threshold, and provincial routing before you send to Canadian recipients.