The Personal Information Protection and Electronic Documents Act (PIPEDA) is a law that sets out guidelines for how private sector organizations can collect, use and disclose personal information.
PIPEDA applies to all commercial enterprises in Canada, including all private sector employers, except those that are federally regulated. That means that federal government departments, Crown corporations and agencies are not covered by PIPEDA.
There are some exceptions to the coverage of PIPEDA. For example, it does not apply to personal information held by charities (e.g., churches or religious organizations), educational institutions, professional associations or membership groups.
PIPEDA also does not apply to employees' personal information when they work outside of Canada or when they work in another country because they will be subject to the laws of the other country.
However, if an employee's place of employment is in Canada and he or she works outside of Canada for a short period of time (less than 24 hours), then their personal information may still be protected under PIPEDA. In addition, if an employer transfers an employee's personal information outside of Canada then this may also create privacy obligations under PIPEDA.
