If your business collects, uses, or stores personal information about customers, employees, or partners, you're subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). This applies to most private-sector organizations in Ontario.

Non-compliance isn't just a legal risk; it can affect your ability to get cyber insurance, win contracts, and maintain customer trust. Here's a practical checklist to assess where your business stands.

What Is PIPEDA?

PIPEDA is Canada's federal privacy law governing how private-sector organizations handle personal information during commercial activities. "Personal information" includes anything that can identify an individual: names, email addresses, phone numbers, financial data, health information, employee records, and more.

The Office of the Privacy Commissioner of Canada (OPC) enforces PIPEDA and can investigate complaints, conduct audits, and make public findings.

The PIPEDA Compliance Checklist

Accountability

You have designated a privacy officer (can be an existing employee with added responsibilities)
Privacy policies are documented and accessible to customers
Employees who handle personal information have received privacy training
Third-party vendors who access personal information have data processing agreements in place

Identifying Purposes

You document why you collect each type of personal information
Purposes are communicated to individuals before or at the time of collection
You don't collect information "just in case." There must be a specific business reason

Consent

You obtain meaningful consent before collecting personal information
Consent forms are written in plain language, not legal jargon
Individuals can easily withdraw consent
You use opt-in (not pre-checked boxes) for marketing communications

Limiting Collection

You only collect personal information that's necessary for the stated purpose
You don't ask for information you don't need (e.g., SIN number for a newsletter signup)
Forms only request relevant fields

Limiting Use, Disclosure, and Retention

Personal information is only used for the purpose it was collected
You have retention schedules so data isn't kept forever
When data is no longer needed, it's securely destroyed
Information isn't shared with third parties without consent

Accuracy

Personal information is kept up to date
Individuals can request corrections to their information
You have a process for handling correction requests

Safeguards

Physical security: offices are locked, documents are secured
Technical security: encryption, access controls, firewalls, and managed cybersecurity controls including EDR
Administrative security: access is limited to those who need it
Computers and devices are protected with strong passwords and MFA
Data at rest and in transit is encrypted
Regular security assessments are performed
Employee accounts are deactivated promptly when they leave

Openness

Your privacy policy is published on your website
It explains what information you collect, why, and how it's protected
Contact information for your privacy officer is available

Individual Access

Individuals can request access to their personal information
You respond to access requests within 30 days
You provide information in a format the individual can understand

Challenging Compliance

You have a process for individuals to challenge your compliance
Complaints are investigated and resolved
You keep records of complaints and resolutions

Mandatory Breach Reporting

Since November 2018, PIPEDA requires organizations to:

Report breaches to the OPC if they create a "real risk of significant harm"
Notify affected individuals of the breach
Keep records of all breaches for at least 24 months (even ones you don't report)

Failure to report a breach can result in fines of up to $100,000 per violation.

The IT Connection

Many PIPEDA requirements are directly tied to your IT infrastructure:

Safeguards = encryption, MFA, EDR, access controls, backup
Breach reporting = incident detection, forensic investigation, audit logs
Retention = data lifecycle management, secure deletion
Access requests = ability to search and export data

A managed IT provider like ClayGen implements these technical safeguards as part of standard service delivery. You get PIPEDA-aligned IT infrastructure without having to become a privacy expert.

Next Steps

If you went through this checklist and found gaps, you're not alone. Most businesses have room for improvement, especially on the technical safeguards side.

ClayGen helps Ontario businesses implement the IT controls needed for PIPEDA compliance: encryption, access management, backup, monitoring, and breach detection. Contact us for a free compliance-focused IT assessment.

For the broader view of this topic, see our complete compliance guide for Ontario businesses.

PIPEDA Compliance Checklist for Ontario Businesses