← All checklists
PIPEDA readiness checklist
Every PIPEDA obligation an organization has to act on, mapped to its fair information principle or section, with the evidence the Office of the Privacy Commissioner will ask for. Preview 10 of the 66 items below; the full checklist comes as a branded, fillable PDF.
Checklist v1.0Covers PIPEDA S.C. 2000, c. 5Reviewed 30 Oct 202666 items · 8 sections
Principle 1. Accountability
7 items
- s. 4
(1) Confirm PIPEDA applies: personal information collected, used or disclosed in commercial activity, or employee data of a federal work or business. Quebec, British Columbia and Alberta have their own private sector laws for activity inside those provinces.Evidence: Applicability memo covering provinces and activities.
Principles 2 and 4. Identifying purposes and limiting collection
8 items
- s. 5
(3) Collect, use and disclose personal information only for purposes a reasonable person would consider appropriate in the circumstances.Evidence: Purpose review for each processing activity.
Principle 3. Consent
8 items
- 4.3Get the knowledge and consent of the individual for collection, use or disclosure, except where the law allows otherwise.Evidence: Consent records per purpose.
Principles 5 and 6. Use, retention and accuracy
7 items
- 4.5Use and disclose personal information only for the purposes it was collected for, unless the individual consents or the law requires it.Evidence: Access controls and disclosure log aligned to purposes.
Principle 7. Safeguards
6 items
- 4.7Protect personal information with security safeguards appropriate to its sensitivity.Evidence: Information security policy covering personal information.
Principles 8 and 10. Openness and challenging compliance
8 items
- 4.8Make information about your privacy policies and practices readily available.Evidence: Published privacy policy.
Principle 9. Individual access
11 items
- 4.9On request, tell individuals whether you hold their personal information and give them access to it.Evidence: Access request procedure.
- 4.9.1Explain how their information has been and is being used, and to whom it has been disclosed.Evidence: Access response template covering use and disclosure.
Breaches of security safeguards
11 items
- s. 10.1
(1) Report to the Privacy Commissioner any breach of security safeguards involving personal information under your control where it is reasonable to believe it creates a real risk of significant harm.Evidence: Breach response plan and OPC report submissions. - s. 10.1
(8) Assess real risk of significant harm using the sensitivity of the information and the probability it will be misused. Significant harm includes humiliation, reputational or financial loss and identity theft.Evidence: Documented risk assessment for each breach.
Changelog
- v1.030 Oct 2026First release. Covers the ten fair information principles in Schedule 1, access deadlines, and the breach reporting and record keeping rules in PIPEDA and the Breach of Security Safeguards Regulations.
Take it to your team
Fillable PDF with owner and target date fields, your name on every page.