Personal Information Protection and Electronic Documents Act (PIPEDA)

Schedule 1 clause 4.1.3 makes an organisation responsible for personal information in its possession or custody, including information transferred to a third party for processing, and requires contractual or other means to provide a comparable level of protection during that processing. For Canadian data handed to a Chinese parent, offshore cloud or labelling vendor this means: purpose limitation and no-secondary-use clauses in the data processing agreement, sub-processor approval, a security control schedule, audit and inspection rights, incident notification timelines, a government access request and notification mechanism, and return or destruction on termination. On transparency, the OPC expects organisations to state in their privacy policy that personal information may be processed outside Canada and thereby become subject to local law.

Applies when

Any organisation transferring Canadian personal information to an offshore affiliate or vendor for processing, and any Chinese AI company that must give a Canadian customer those assurances as the recipient.

Evidence to retain

• · Data processing agreement with comparable-protection, sub-processor and audit clauses
• · Vendor security due diligence questionnaire and assessment conclusion
• · Privacy policy wording disclosing offshore processing
• · Evidence of data return or destruction on termination

Estimated first-time effort: 5–12 person-days (estimate, not a commitment)

Section 10.1(1) requires a report to the Commissioner where it is reasonable in the circumstances to believe that a breach of security safeguards creates a real risk of significant harm to an individual; section 10.1(2) requires the prescribed form and manner, as soon as feasible after the organisation determines the breach occurred; sections 10.1(3) and (6) require direct, conspicuous notification of affected individuals as soon as feasible (indirect notification in prescribed circumstances). Section 10.1(7) defines significant harm to include bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record, and damage to or loss of property. Section 10.1(8) lists the real-risk factors: the sensitivity of the information involved, the probability that it has been, is being or will be misused, and any other prescribed factor.

Applies when

All organisations subject to PIPEDA.

Deadline: As soon as feasible after the organisation determines that the breach occurred.

Evidence to retain

• · Methodology for assessing real risk of significant harm and the per-incident assessments
• · Report filed with the Commissioner and its acknowledgement
• · Individual notification text and proof of delivery method
• · Records of section 10.2 notifications to other organisations or government institutions

Estimated first-time effort: 4–10 person-days (estimate, not a commitment)

Section 10.3(1) requires an organisation to keep and maintain a record of every breach of security safeguards involving personal information under its control, in the prescribed form — not only those meeting the real-risk threshold — and the Commissioner may request access to it. So even where the assessment concludes that no report is required, the assessment itself must be retained, or the organisation cannot substantiate its decision in an investigation. Knowingly contravening section 10.3(1) is an offence under section 28.

Applies when

All organisations subject to PIPEDA, including for minor incidents assessed as not reportable.

Evidence to retain

• · Complete breach register, including incidents assessed as not reportable
• · Risk assessment conclusion and reasoning for each incident
• · Retention period and access control policy for the register
• · Procedure for producing the register to the Commissioner

Estimated first-time effort: 2–6 person-days (estimate, not a commitment)

The Schedule 1 principles require purposes to be identified at or before collection, knowledge and consent for collection, use and disclosure, collection limited to what is necessary for the identified purposes, and collection by fair and lawful means. The recurring AI flashpoint is whether using user input, conversation logs or uploads for model training falls within the original purpose; in practice, list the training use separately, explain it understandably, offer a choice, and re-obtain consent on a change of purpose. The limiting use, disclosure and retention principle also requires retention periods and destruction at expiry, which directly constrains how long prompt logs and training snapshots may be kept.

Applies when

Organisations collecting personal information in commercial activities in Canada, especially products that improve models using user content.

Evidence to retain

• · Purpose inventory and necessity analysis for each collection
• · Screenshots and version history of consent interfaces, including the separate training-use explanation
• · Retention matrix and evidence of destruction at expiry
• · Process and records for re-obtaining consent on a change of purpose

Estimated first-time effort: 5–12 person-days (estimate, not a commitment)

The individual access principle requires an organisation, on request, to inform an individual of the existence, use and disclosure of their personal information and give access, and to allow them to challenge its accuracy and completeness and have it amended. The challenging compliance principle requires a designated individual accountable for compliance and procedures for individuals to challenge it. Section 14 lets a complainant apply to the Federal Court for a hearing on matters covered by the Commissioner’s report after receiving it or being notified the investigation was discontinued. Define in advance: the search scope for access requests (whether prompt logs, vector stores and model outputs are included), identity verification, how third-party information is handled, and how refusals are documented.

Applies when

All organisations subject to PIPEDA.

Evidence to retain

• · Access request procedure and documented search scope
• · Access request log (receipt date, response date, what was provided or refused and why)
• · Designation of the individual accountable for compliance and the published channel
• · Records of compliance challenges received and how they were handled

Estimated first-time effort: 4–10 person-days (estimate, not a commitment)