PIPEDA

How it works

• Applies to private-sector organizations that handle personal information in the course of business.
• Covers why you collect information, how long you keep it, and how you protect it.
• People can ask what you hold about them.
• Check the Office of the Privacy Commissioner of Canada (priv.gc.ca) for current breach-reporting rules and any provincial law that applies.

What can go wrong (example scenario)

A four-person clinic lost a laptop holding patient contact and billing details, unencrypted. Nobody had decided whether that counted as a reportable breach, so nobody reported it. When a patient complained months later, the missing record and missing notice made it worse.

How WILDCARD handles it

A privacy policy, a breach response procedure and a breach log are vCIO outputs available today. Compliance documentation as its own card is still being shaped.

• A dental office names a privacy officer and writes down what patient data it collects and why.
• A law firm keeps a breach log and a decision procedure for whether an incident is reportable.
• A retailer's loyalty program states clearly what it collects and lets customers opt out.

Example scenario: A small bookkeeping firm's staff member emailed a client's tax file to the wrong address. They had a breach procedure: recall the email, confirm with the recipient it was deleted, assess the risk, record it in the log, and notify the client. The whole thing took an afternoon and the client stayed.

A question owners ask

Does PIPEDA apply to a one-person business?

Yes, if you handle personal information in the course of commercial activity. The expectations scale with your size, but consent, safeguards and breach reporting apply to everyone.