PIPEDA (the Personal Information Protection and Electronic Documents Act) governs how Canadian private-sector organizations collect, use, and disclose personal information. Its proposed replacement, the Protecting Privacy and Consumer Data Act (PPCDA) in Bill C-36, was introduced in June 2026 after the earlier CPPA in Bill C-27 died. ThreeShield keeps you compliant with PIPEDA and ready for the PPCDA from one program.
PIPEDA's Principle 7 requires organizations to protect personal information with security safeguards appropriate to the sensitivity of the information. This directly drives cybersecurity control requirements.
Organizations must report breaches of security safeguards that pose a real risk of significant harm to the Office of the Privacy Commissioner (OPC) and notify affected individuals. Incident response plans are essential.
The proposed PPCDA would allow administrative monetary penalties of up to the greater of $10M or 3% of global revenue, and fines of up to the greater of $25M or 5% for offences, a sharp increase from PIPEDA's current limited enforcement powers. Bill C-27's CPPA proposed the same ceilings before it died.
New systems, processes, or technologies involving personal information should be assessed for privacy risk before deployment. PIAs identify security safeguard requirements before you build rather than after.
Organizations are responsible for personal information transferred to third-party processors. Vendor security assessments and contractual protections are required.
Bill C-36 would strengthen data minimization requirements and add a right to have information deleted on request: collect only what you need and keep it only as long as necessary. Security controls must support data deletion and segregation.
Under PIPEDA you stay accountable for information you send abroad. Bill C-36 would go further and require a privacy impact assessment and mitigations before personal information is disclosed or transferred outside Canada, including to cloud services and support desks hosted elsewhere.
PIPEDA is Canada's federal private-sector privacy law; GDPR is the EU's. Canadian organizations with EU customers must comply with both. GDPR has stricter consent requirements and higher penalties. Bill C-36 would move federal law closer to GDPR in some areas, including legitimate interest and transfer assessments. ThreeShield can assess your compliance with both in one engagement.
Most likely, yes. PIPEDA applies to most private-sector organizations in Canada that handle personal information in commercial activities, regardless of size. Some very small businesses may fall under provincial legislation instead (Quebec's Law 25, Alberta PIPA, BC PIPA). ThreeShield identifies which laws apply to your specific situation.
Any breach that poses a real risk of significant harm. Under current PIPEDA regulations, you must report it to the OPC. To judge the risk, consider the sensitivity of the information, the probability of misuse, the number of people affected, and the nature of the harm. ThreeShield helps you build breach assessment and notification workflows before you need them.
Not yet. Bill C-36, introduced on 15 June 2026, proposes the Protecting Privacy and Consumer Data Act (PPCDA) to replace the privacy part of PIPEDA on a date the government sets. It follows Bill C-27, whose Consumer Privacy Protection Act (CPPA) died in January 2025. Read about the PPCDA and what happened to the CPPA.
No. In Lavawall®, PIPEDA and the PPCDA are mapped to the same controls, so the work you do for PIPEDA today counts toward the PPCDA, and the readiness assessment shows only what Bill C-36 adds: assessments before transfers outside Canada and before relying on legitimate interest, deletion on request, review of automated decisions, and treating anyone under 18 as a child.
ThreeShield assesses your security safeguards against PIPEDA requirements and prepares you for the stronger federal obligations Bill C-36 proposes.
Book a Scoping CallDIY · Supported · Done-for-You · All engagement models available
Pick the level of help that fits your internal capacity: run it yourself in Lavawall®, work alongside our CISSP/CISA team, or hand ThreeShield the whole program.
For lean IT teams and cost-conscious organizations with internal security capacity
For MSPs, IT teams with some security resources, and organizations that need expert guidance but retain internal capacity
For organizations that want full compliance delivery without managing the process internally