Laws

PIPEDA: how to access, correct and control your personal information in Canada

Quick answer

PIPEDA, Canada's federal private-sector privacy law, lets you ask a business in writing what personal information it holds about you and get access to it at minimal or no cost. It must answer within 30 days, and if it says nothing, the law treats that as a refusal. You can also have errors corrected and withdraw consent, and if the business won't help, you can file a complaint with the Office of the Privacy Commissioner of Canada.

“Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information.”

All privacy laws
Applies in
Canada
In force since
Companies must answer within
No later than 30 days after the organization receives your request. It can extend that by up to 30 more days if meeting the limit would unreasonably interfere with its activities or consultations make it impracticable, or for as long as needed to convert the information to an alternative format. It must send you notice of the extension, its reasons and your right to complain within the first 30 days. No response in time counts as a refusal (PIPEDA section 8).
Regulator
Office of the Privacy Commissioner of Canada (OPC)
Last updated

By Anthon Wansland

Head of Product & Co-Founder

Reviewed by Ludwig Sandgren

Head of Legal

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

Sources checked: laws-lois.justice.gc.ca, priv.gc.ca

Last verified against the official page:

How we research this Report an error

Organizations that collect, use or disclose personal information in the course of commercial activities, plus employee information at federal works, undertakings and businesses. It doesn't cover federal government institutions (they fall under the Privacy Act), or purely personal, journalistic, artistic or literary use. The OPC notes that Alberta, British Columbia and Quebec have private-sector privacy laws that may apply instead.

Your rights

  • Right of access

    Be told whether an organization holds personal information about you, get access to it, and get an account of how it has been used and which third parties it was disclosed to (PIPEDA Principle 4.9).

  • Right to correction

    If you show that information is inaccurate or incomplete, the organization must amend it (by correcting, deleting or adding to it) and, where appropriate, pass the change on to third parties. If a challenge isn't resolved, it must be recorded (PIPEDA clause 4.9.5).

  • Withdrawing consent

    Withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. The organization must explain what withdrawing means for you (PIPEDA clause 4.3.8).

  • Destruction of information that's no longer needed

    Personal information no longer required for the purposes it was collected for should be destroyed, erased or made anonymous. This is a duty on the organization, not a standalone right to erasure like the GDPR's (PIPEDA clause 4.5.3).

  • Right to challenge compliance

    Raise a challenge with the person accountable for the organization's privacy compliance. Its complaint procedures should be easily accessible and simple to use (PIPEDA Principle 4.10).

  • Right to complain to the Privacy Commissioner

    File a written complaint with the Privacy Commissioner of Canada against an organization that breaks the Act or doesn't follow a recommendation in Schedule 1 (PIPEDA section 11).

General information, not legal advice.

How to use it

  1. 1

    Write to the organization's privacy contact

    Access requests under PIPEDA must be in writing. Send yours to the address the organization gives for access or privacy requests, often in its privacy policy. If you need help preparing the request, the organization has to assist you.

  2. 2

    Describe the information you want

    The OPC's sample letter refers to clause 4.9 of Schedule 1 of PIPEDA and lists the information sought. A clear, narrow request (a specific topic or date range) can get a faster answer. Add details that help the organization find your records, such as an account number.

  3. 3

    Wait up to 30 days

    The organization should give you access within 30 calendar days, or tell you within those 30 days that it needs an extension and why. It can only charge a minimal fee, and only if it told you the approximate cost first and you chose to go ahead. Access doesn't always mean a paper copy: it can mean viewing the material on site.

  4. 4

    Ask for corrections

    If something is wrong or missing, ask for a correction and include evidence. If you and the organization can't agree, ask for your concerns to be recorded with the information.

  5. 5

    Raise it with the organization's privacy officer

    The OPC says to always try to resolve the issue with the organization first, usually through its privacy officer, or it may not be able to accept your complaint. It suggests asking for a response within 30 business days.

  6. 6

    File a complaint with the OPC

    If the organization doesn't respond or you're not satisfied, go to the OPC's Report a concern page and file a formal complaint. If your access request was refused, or the deadline passed, you have six months from that point to complain.

  7. 7

    Apply to the Federal Court if needed

    After the Commissioner issues a report on your complaint (or discontinues it), you can apply to the Federal Court within one year.

No answer in time? Complain to Office of the Privacy Commissioner of Canada (OPC) .

Deletion is the weak spot

If you're used to the GDPR, PIPEDA will feel thinner on deletion. There's no right to say "erase me" and have it done. What you have instead is a duty on the organization. Information it no longer needs for the purposes it collected it for should be destroyed or erased, or made anonymous. You can also withdraw consent, and a successful accuracy challenge can end with information being deleted.

In practice: ask for access first, so you know what they hold. Then point to those clauses.

The deadlines that apply to you

Most people focus on the organization's 30 days. You have deadlines too. A complaint about a refused access request has to reach the Privacy Commissioner within six months of the refusal, or of the missed deadline. And after the Commissioner's report, you have one year to apply to the Federal Court.

Who isn't covered

PIPEDA covers private-sector organizations in commercial activity. Federal government institutions fall under a separate law, the Privacy Act. Purely personal use is outside it, and so is purely journalistic, artistic or literary use. In Alberta, British Columbia and Quebec, a provincial law may apply instead.

Part 1 of PIPEDA came into force on 1 January 2001, according to a footnote in the Justice Laws text. The Act was last amended on 4 March 2025.

Where Serus fits

PIPEDA requests go one organization at a time, in writing, with a 30-day wait each. Serus finds the data brokers and people-search sites that operate where you live and sends the requests for you. It follows up when an answer is late, and it checks whether your details reappear. If you only need to deal with one or two businesses, the steps above cost nothing. Run a free scan to see where you're listed.

Data brokers that list people in Canada

Each guide shows how to opt out of that site, step by step.

All data broker guides
Serus

Let Serus send the requests for you

Serus finds the data brokers that list you where you live and removes you from them.

Run a free scan

Related

Frequently asked

Does PIPEDA give me a right to have my data deleted?

Not as a standalone right. Information that's no longer needed should be destroyed, erased or made anonymous, and correcting inaccurate information after a successful challenge can include deleting it.

Can a business charge me for my personal information?

Only a minimal fee, and only if it told you the approximate cost up front and you chose to go ahead.

What if the business ignores my request?

If it doesn't respond within the time limit, the law treats the request as refused, and you can complain to the OPC. For refused access requests, complain within six months.

How long do OPC complaints take?

The OPC says a high volume of complaints has caused processing delays of several months.

Has PIPEDA been replaced by a new law?

No. PIPEDA is still the law in force; the earlier Consumer Privacy Protection Act was never enacted. Bill C-36, the Protecting Privacy and Consumer Data Act, was tabled in June 2026 but is only a bill.

Does PIPEDA apply in Quebec, Alberta or British Columbia?

Those three provinces have their own private-sector privacy laws, which may apply instead of PIPEDA. This page covers PIPEDA only.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.