PIPEDA

What it is

The Personal Information Protection and Electronic Documents Act, in force since 2001. Governs how private-sector organizations collect, use, and disclose personal information in the course of commercial activity. Three provinces (BC, Alberta, Quebec) have substantially-similar laws that displace PIPEDA locally; PIPEDA still covers federal works, undertakings, and inter-provincial flows.

Why it matters

OPC has audit and investigation power and publishes findings. Reform proposals (CPPA / Bill C-27) have been introduced repeatedly — the modern bar is meaningful consent, breach reporting under PIPEDA's 2018 amendments, and a publicly-available privacy policy.

Who it applies to

Commercial activity in Canada — federally regulated everywhere; private-sector everywhere except where a substantially-similar provincial law applies.

• Jurisdictions: Canada

How WQI scores it

Web Quality Index considers this standard satisfied when all of the 3 supporting factors pass.

0 of 3 supporting factors are currently collected. Sites where the remaining 3 haven't been measured will show as partial or unknown on this standard until the data lands.

Related standards

See also

GDPR , Law 25

Standards that share factors with this one

Auto-computed from overlapping factor tickets in satisfiedBy, excluding standards already listed under "See also" above. Strong overlap suggests these standards rise and fall together when sites are scored.

• Australian Privacy Act + APPs 3 shared factors Privacy Australia's federal privacy law, anchored on the 13 Australian Privacy Principles. The 2024 reforms added a statutory tort for serious privacy invasions and direct OAIC penalty powers.
• Colorado Privacy Act 3 shared factors Privacy Colorado's CCPA-shaped privacy law, with a hard requirement to honour Universal Opt-Out Mechanisms like Global Privacy Control as of July 2024.
• Connecticut Data Privacy Act 3 shared factors Privacy Connecticut's CCPA-shaped privacy law. Like Colorado, recognises Global Privacy Control as a valid opt-out signal — and the AG has been actively issuing cure notices since 2023.
• COPPA 3 shared factors Privacy If your site is directed at U.S. children under 13 — or you knowingly collect from them — you need verifiable parental consent before any data collection. The 2025 amendments tightened this further around third-party advertising.
• HIPAA 3 shared factors Privacy If your site collects, displays, or transmits protected health information, HIPAA applies. A privacy policy plus an explicit Notice of Privacy Practices and a clear consent flow are the minimum visible signals.

Other references

• guidance OPC — PIPEDA overview and fair information principles