Glossary term
PIPEDA
PIPEDA is Canada's federal private-sector privacy statute, governing the collection, use, and disclosure of personal information by organizations engaged in commercial activity, plus mandatory breach notification.
PIPEDA came into force in stages between 2001 and 2004 and now applies to every private-sector organization in Canada engaged in commercial activity, except where a substantially similar provincial statute applies (BC PIPA, Alberta PIPA, Quebec Law 25).
The statute's mandatory breach notification regime took effect November 1, 2018. Where a breach involves personal information and creates a "real risk of significant harm" to one or more individuals, the organization must notify the Office of the Privacy Commissioner of Canada, the affected individuals, and any other organization that may be able to mitigate the harm.
Organizations must also keep records of all breaches involving personal information, including breaches that do not require notification, for at least 24 months.
For forensic purposes, PIPEDA is the framework for most Canadian breach investigations. The forensic determination of what was accessed and what was exfiltrated is what supports the "real risk of significant harm" assessment.