PIPEDA Compliance for SaaS: 10 Principles as Controls

PIPEDA (the Personal Information Protection and Electronic Documents Act) is Canada's federal privacy law for private-sector organizations that handle personal information in the course of commercial activity. PIPEDA compliance means meeting the 10 fair information principles in Schedule 1 of the Act, plus the breach reporting, notification, and 24-month record-keeping duties in sections 10.1 to 10.3. For a SaaS company, each principle becomes a control, and each control has to produce evidence a regulator or enterprise customer can inspect.

Who does PIPEDA apply to, and when does a provincial law apply instead?

PIPEDA applies to every organization that collects, uses, or discloses personal information in the course of commercial activities, under section 4(1) of the Act. A SaaS company selling to Canadian businesses or consumers is engaged in commercial activity.

Three provinces have general private-sector laws deemed substantially similar, and four have substantially similar health information laws. The OPC's list of provincial laws confirms that PIPEDA still applies to personal information transferred across borders and to federally regulated businesses, even in those provinces.

A US headquarters does not put a SaaS company outside PIPEDA. In the OPC's findings on Clearview AI (PIPEDA Findings #2021-001), the regulator states that PIPEDA applies to organizations outside Canada where a real and substantial connection to Canada exists, and that a physical presence in Canada is not required. The connecting factors come from Federal Court decisions such as A.T. v. Globe24h.com (2017 FC 114) and include the location of the target audience and of the operator. The OPC's summary of PIPEDA requirements adds that businesses handling personal information that crosses provincial or national borders are subject to PIPEDA regardless of the province or territory in which they are based.

What are the 10 PIPEDA principles, and what evidence does each one require?

The 10 PIPEDA principles are set out in Schedule 1 of PIPEDA, taken from the CSA Model Code, and section 5(1) makes the principles binding:

1. Accountability
2. Identifying Purposes
3. Consent
4. Limiting Collection
5. Limiting Use, Disclosure, and Retention
6. Accuracy
7. Safeguards
8. Openness
9. Individual Access
10. Challenging Compliance

The table converts each principle into a control, the evidence a regulator or enterprise customer will ask for, and the SOC 2 and ISO 27001 overlap. SOC 2 P-series criteria apply only when the Privacy category is in scope.

The mapping follows the AICPA 2017 Trust Services Criteria. The SOC 2 trust services criteria guide explains the Common Criteria, and the post on SOC 2 trust services categories covers when to add Privacy.

How does PIPEDA accountability work for service providers and cross-border transfers?

PIPEDA accountability stays with the organization that collected the data after the data goes to a cloud host or sub-processor. Clause 4.1.3 of Schedule 1 makes an organization responsible for information transferred to a third party for processing and requires contractual or other means to provide a comparable level of protection.

The OPC's Guidelines for processing personal data across borders (2009) set three expectations for SaaS companies hosting outside Canada:

• A transfer for processing is a use, not a disclosure, so no additional consent is needed if the data serves the original purpose.
• The transferring organization stays accountable for the data in the processor's hands.
• Customers must be told their data may be processed in another jurisdiction and accessed there by courts, law enforcement, and national security authorities.

The OPC's guidance on assessing third-party service providers (page dated September 2026) adds the sequence: assess the provider before signing, confirm PIPEDA obligations in the contract, and monitor afterwards, for example through inspections or independent audits.

We often see a data processing agreement signed at onboarding and no later review. The evidence that holds up includes:

• a current sub-processor list with processing locations
• a signed agreement per provider holding production data
• a dated review of each provider's SOC 2 or ISO 27001 report

The SOC 2 CC9.2 vendor risk management guide covers the provider review.

When does PIPEDA require breach notification?

PIPEDA breach notification is required when it is reasonable to believe a breach of security safeguards creates a real risk of significant harm (RROSH) to an individual. Section 10.1 of PIPEDA then requires a report to the OPC and a notification to each affected individual, as soon as feasible after the organization determines the breach occurred.

Significant harm includes, among other listed harms:

• humiliation
• damage to reputation or relationships
• financial loss
• identity theft
• negative effects on the credit record

The RROSH test weighs two named factors: the sensitivity of the information and the probability that the information has been, is being, or will be misused.

Section 10.2 adds a third duty: notify any other organization or government institution that can reduce the harm, such as a payment processor that can block compromised cards.

The OPC's guidance on mandatory breach reporting places the reporting duty on the organization that controls the information. A breach at a sub-processor is still the SaaS company's report to make, so the processor contract needs a prompt notification clause.

What steps does a PIPEDA breach response checklist include?

The PIPEDA breach response checklist follows the statute and the Breach of Security Safeguards Regulations (SOR/2018-64), in force since November 1, 2018.

The SOC 2 CC7.4 incident response guide covers the incident process behind the checklist. Adding a RROSH decision and a breach register entry to the incident runbook meets both requirements.

What are the penalties for PIPEDA non-compliance?

PIPEDA's fines attach to a short list of offences, led by the breach duties. Under section 28, fines reach $10,000 on summary conviction or $100,000 on indictment for these offences:

• knowingly failing to report or notify under section 10.1
• knowingly failing to keep breach records under section 10.3(1)
• knowingly failing to retain information that is the subject of an access request (section 8(8))
• retaliating against an employee who reported a contravention (section 27.1(1))
• obstructing an OPC investigation or audit

The OPC does not issue fines under PIPEDA. The OPC investigates, publishes findings, and can enter compliance agreements under section 17.1. After an OPC report, a complainant can apply to the Federal Court. Under section 16, the Federal Court can order:

• corrected practices
• a published notice of the corrective action
• damages, including damages for humiliation

Beyond PIPEDA fines, a breach costs money through:

• incident response
• class actions
• lost deals

The analysis of the cost of a data breach in Canada breaks down those costs.

What is the status of federal privacy reform after Bill C-27?

PIPEDA remains Canada's federal private-sector privacy law in force. Bill C-27, which would have replaced Part 1 of PIPEDA with the Consumer Privacy Protection Act, was still in committee when the session ended on January 6, 2025, and died on the Order Paper at prorogation (LEGISinfo, Bill C-27).

Bill C-36, which would enact the Protecting Privacy and Consumer Data Act, was introduced on June 15, 2026. As of October 31, 2026, LEGISinfo lists Bill C-36 at second reading in the House of Commons, with no second-reading debate yet. Until a replacement receives Royal Assent and comes into force, PIPEDA's principles and breach duties apply. The post on Canadian privacy after Bill C-27 covers the Bill C-27 timeline.

How does PIPEDA compare with Quebec Law 25 and GDPR?

PIPEDA sets the federal baseline. Quebec Law 25 and the EU GDPR add stricter, penalty-backed duties for data about their residents. The table compares the three laws on the duties a SaaS company evidences most often, using the CAI sanctions page for Law 25 and the GDPR text for the EU.

The EU adequacy decision for Canada (Decision 2002/2/EC) covers PIPEDA-regulated commercial organizations. The Quebec Law 25 guide for SaaS companies and the Law 25 compliance checklist cover Quebec in full.

What belongs on a PIPEDA compliance checklist?

A PIPEDA compliance program works best inside the existing security program, with privacy controls added where security controls stop:

1. Designate the privacy officer in writing, with authority over privacy policies, complaints, and breach decisions.
2. Build the personal information inventory with purpose, location, retention period, and sub-processor per data category.
3. Publish the privacy policy and sub-processor list, including notice of processing outside Canada.
4. Stand up access request and complaint workflows with a 30-day clock and a log.
5. Add a RROSH decision point and a breach register to the incident response runbook.
6. Map the controls to SOC 2 and ISO 27001 so one evidence set serves the privacy program, the audit, and customer reviews. The ISO 27001 and SOC 2 control mapping shows how the shared controls line up.

Truvo Cyber offers a Canadian privacy gap assessment covering PIPEDA and Quebec Law 25 in one pass, delivered in English or French and led by a former security architect for the Bank of Canada and Payments Canada. See the privacy program service or the fractional privacy officer service, or book a strategy call.

Frequently asked questions about PIPEDA compliance

What is PIPEDA compliance?

PIPEDA compliance means meeting the 10 fair information principles in Schedule 1 of the Personal Information Protection and Electronic Documents Act, plus the Act's breach reporting, notification, and record-keeping duties. For a SaaS company this means a designated privacy officer, documented purposes, meaningful consent, retention limits, safeguards, a public privacy policy, and working access and complaint procedures.

Does PIPEDA apply to US SaaS companies?

PIPEDA can apply to a US SaaS company. The OPC applies PIPEDA to organizations outside Canada that have a real and substantial connection to Canada, and a physical presence in Canada is not required. A Canadian target audience is one of the connecting factors the OPC weighs. A US company serving Quebec residents should also assess Quebec Law 25.

How long do you have to report a breach under PIPEDA?

PIPEDA sets no fixed number of hours. Section 10.1 requires the report to the Privacy Commissioner and the notification to affected individuals as soon as feasible after the organization determines a breach occurred, when the breach creates a real risk of significant harm. Every breach, reportable or not, must be recorded and kept for 24 months.

Is SOC 2 enough for PIPEDA compliance?

SOC 2 alone is not enough. SOC 2 is a voluntary attestation, and PIPEDA is a law. A Security-only SOC 2 report evidences the Safeguards principle and part of Accountability, but consent, identifying purposes, openness, individual access, and complaint handling need privacy controls, which the SOC 2 Privacy category or ISO 27701 can cover.

What is the difference between PIPEDA and GDPR?

PIPEDA and GDPR share principles such as accountability and safeguards. GDPR adds a 72-hour breach notification deadline, where feasible, and administrative fines up to EUR 20 million or 4% of worldwide annual turnover. PIPEDA uses a real risk of significant harm test, sets no fixed deadline, and fines only specific offences such as knowingly failing to report a breach.