PIPEDA, Canada’s federal private-sector privacy law, applies to most organizations that collect, use or disclose personal information in the course of commercial activity. Compliance isn’t a certificate you can hold; it’s a set of habits. Records management is one of the first places a regulator or auditor looks, because it’s where good intentions often meet a back room full of boxes.
Which law applies to you?
- Most private-sector businesses across Canada fall under PIPEDA.
- Alberta, British Columbia and Quebec have their own private-sector privacy laws that are considered substantially similar, and those apply to most organizations operating within those provinces.
- In Ontario, doctors and other health information custodians follow PHIPA for patient information instead.
If you’re unsure which applies, ask your lawyer or check with the Office of the Privacy Commissioner of Canada.
The checklist. Can you answer yes to each one?
- ☐ We know what we hold. We can list the personal information we keep (customers, clients, patients, employees), in what formats, and where it physically lives.
- ☐ We have a retention schedule. In writing: how long each type of record is kept, and why. Not “forever, just in case”.
- ☐ We destroy on schedule. Records past their retention period are actually destroyed, not left to accumulate.
- ☐ Destruction is secure and documented. We can produce a Record of Destruction (or equivalent) if asked.
- ☐ Paper is physically secure. Locked, access-controlled, not sitting in an open office or unsecured storage area.
- ☐ Digital records are protected. Backed up, access-controlled, and we know who can see what.
- ☐ We have a succession plan for records. If the business closes, is sold, or a key person retires, we know where the records go.
- ☐ We can answer access requests. PIPEDA gives people the right to see their personal information, and organizations generally have 30 days to respond.
- ☐ We know what to do if there’s a breach. PIPEDA requires organizations to report breaches that pose a real risk of significant harm to the Privacy Commissioner and to affected individuals, and to keep a record of breaches.
Where businesses usually fall short
Not on the digital side. Most organizations have reasonable IT security. The gap is physical: filing cabinets, storage rooms and boxes in basements rarely have a retention schedule or a destruction plan, and that is exactly what an audit or a breach investigation asks about first.
What to do if you ticked “no” on several
Building all of this internally is slow. Secure storage, scheduled destruction and retention scheduling are services a records management provider already runs. Handing those pieces off often fixes the physical-records gap faster than writing new internal procedures.
Make it a habit
PIPEDA compliance is a standing practice, not a one-time project. A short annual review against a checklist like this one catches most gaps early.
Not sure where your gaps are? Talk to us about a records review.
Related reading
- Security and compliance
- Secure shredding services
- Secure Shredding vs. DIY Disposal: Why a Record of Destruction Matters
Sources and further reading
This article is general information, not legal advice.