What Is PIPEDA?
PIPEDA stands for the Personal Information Protection and Electronic Documents Act. It is Canada’s federal private-sector privacy law, governing how organisations collect, use, and disclose personal information in the course of commercial activities. It came into force in stages between 2001 and 2004 and applies across Canada, with the exception of provinces that have enacted substantially similar provincial legislation (currently British Columbia, Alberta, and Quebec).
PIPEDA is being replaced by the Consumer Privacy Protection Act (CPPA) under Bill C-27, but as of early 2026, PIPEDA remains the operative federal privacy law for most Canadian organisations.
Does PIPEDA Apply to Non-Profits?
The answer is yes for most non-profits, at least in part. PIPEDA applies when an organisation collects, uses, or discloses personal information in connection with commercial activities. For non-profits, this typically includes online donation processing, membership fee collection, event ticketing, and email newsletter subscription management — all activities with a commercial dimension.
Non-commercial activities — such as sharing information internally about program participants for service delivery purposes — may fall outside PIPEDA’s scope, but provincial privacy legislation may still apply depending on your province and sector.
The 10 Principles of PIPEDA
PIPEDA is built on 10 fair information principles derived from the Canadian Standards Association’s Model Code for the Protection of Personal Information. These are: accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and challenging compliance.
In practical terms for a non-profit website, these principles require you to: collect only the personal information you actually need, explain to visitors why you are collecting it, obtain meaningful consent before collecting it, keep it accurate, protect it with appropriate security measures, make your privacy practices transparent through a published privacy policy, and allow individuals to access and correct information you hold about them.
What Your Privacy Policy Must Cover
Your website must have a privacy policy that is accessible from every page (typically linked from the footer). It must explain: what personal information you collect, why you collect it, how it is used, who it is shared with and why, how long you retain it, what security measures protect it, and how individuals can request access to or correction of their information.
If you use Google Analytics or other tracking technologies, your privacy policy must disclose this. If you send email marketing, your policy must reference CASL consent and your unsubscribe process.
PIPEDA and Your Website: The Practical Checklist
An accessible, current privacy policy linked from every page. A cookie consent mechanism for tracking technologies. CASL-compliant opt-in consent on all email sign-up forms. Secure form handling (HTTPS) on all pages collecting personal information. A documented process for responding to individual access requests. Annual review of your privacy policy to ensure it reflects your current data practices.
Pragmatica builds PIPEDA-compliant digital platforms for Canadian non-profits, including privacy policy templates, cookie consent implementation, and secure form handling. Learn more about our compliance services.
