If you run a business in Ontario, your main privacy law is PIPEDA, the federal Personal Information Protection and Electronic Documents Act, along with provincial rules for specific sectors. So why does the European Union’s General Data Protection Regulation, GDPR, keep coming up? Because it can reach beyond Europe, and because clients and partners sometimes ask about it.
This is a plain language overview of GDPR vs PIPEDA from an IT and security point of view. It is not legal advice, and your lawyer should confirm what applies to you.
When GDPR might apply to you
GDPR applies to organizations outside the EU in some situations, for example when they offer goods or services to people in the EU or monitor their behaviour. A Toronto business with an online shop that deliberately sells to customers in Europe, or that tracks European website visitors, may fall within its scope. A local firm serving only Canadian clients usually does not, though contracts with EU partners may still impose requirements.
How PIPEDA works
PIPEDA applies to private sector organizations that collect, use or disclose personal information in the course of commercial activity. It is built on fair information principles including accountability, consent, limiting collection, safeguards, openness and individual access. Of those, safeguards is the principle with the most direct IT impact: personal information must be protected by security measures appropriate to its sensitivity.
PIPEDA also has breach rules. Organizations must report breaches of security safeguards that pose a real risk of significant harm to the Office of the Privacy Commissioner and notify affected individuals, and they must keep records of breaches.
A simple comparison
| Topic | GDPR | PIPEDA |
|---|---|---|
| Where it applies | EU residents’ data, with extraterritorial reach | Private sector commercial activity in Canada |
| Consent | Specific legal bases, with strict rules | Meaningful consent, with some exceptions |
| Breach reporting | Short deadline to notify the regulator in most cases | Report breaches posing real risk of significant harm |
| Individual rights | Broad, including erasure and portability | Access and correction, with fewer rights |
| Penalties | Large fines | Lower penalties under current law |
The details are complex and evolving, so check current guidance from the Office of the Privacy Commissioner of Canada and your lawyer.
The security steps that help with both
Both regimes expect “appropriate” security. In practice, that means getting the fundamentals right, and they are the same ones covered throughout our guides:
- Know your data. List what personal information you hold, where it is and who can access it.
- Control access. Multi-factor authentication, least privilege and prompt removal of leavers.
- Protect devices and data. Encryption, patching and endpoint protection.
- Monitor and log. So you can detect and investigate problems.
- Back up and recover. Tested restores that are protected from tampering.
- Manage vendors. Know which suppliers process personal data and what their security looks like.
- Plan for incidents. A written incident response plan that names who decides, who notifies, and how evidence is preserved.
Using a recognized yardstick such as the CIS controls gives you something concrete to follow and to show. A provider of managed security services can run many of these controls day to day and produce records you can hand to a client or insurer. Our overview of data security and compliance lists the evidence to keep.
Breaches and insurance
Good data breach prevention is the best way to avoid the reporting question altogether. See our prevention guide. If you carry cyber insurance, check what the policy expects, because cyber insurance requirements often include multi-factor authentication, backups and incident response planning.
Privacy law differs by sector and situation. Talk to a lawyer about your obligations, and use your IT provider to implement the controls that support them.
Our team can review your controls and the evidence you would need to show a client or regulator.
Talk to our security teamFrequently asked questions
Does GDPR apply to my Toronto business?
Possibly, if you offer goods or services to people in the EU or monitor their behaviour. Ask your lawyer to assess it.
Is PIPEDA the only law I need to think about?
No. Provincial laws, sector rules and contracts may also apply, such as Ontario’s health privacy law for custodians.
What is the first technical step?
Map your personal data and secure access to it with multi-factor authentication.
Related service: Cyber Security Assessment
Last updated
