PIPEDA (employee privacy)

PIPEDA is Canada's federal private-sector privacy law. Whether it covers your employee records depends on your industry and province.

Also called: Personal Information Protection and Electronic Documents Act, federal privacy law, employee privacy law

What PIPEDA (employee privacy) means

PIPEDA, the Personal Information Protection and Electronic Documents Act, is the federal law that sets rules for how private-sector organizations collect, use and share personal information. It is overseen by the Office of the Privacy Commissioner of Canada.

For employers, the key question is whether PIPEDA covers information about your own employees and job applicants. PIPEDA covers employee information only for federal works, undertakings or businesses, such as banks, telecommunications companies and transportation companies. It does not cover the employee information of other employers. In British Columbia and Alberta, each province's Personal Information Protection Act covers private-sector employee information, and in Quebec the private-sector privacy act applies. If you are not sure which law applies, check with the Office of the Privacy Commissioner or your provincial privacy office.

Even where PIPEDA does not apply to your employee records, its principles are a good guide to handling staff and candidate information, and they line up with what provincial privacy laws expect.

How it works

Collect only what you need. For a job application, that is what you need to assess the person for the job. For an employee, it is what you need to pay, manage and support them. Do not collect a diagnosis when functional limitations will do, or a social insurance number before you hire someone.

Be open about why. Tell candidates and employees what you collect, why, who will see it and how long you will keep it. For reference and background checks, get the person's consent and say what you will check.

Keep it secure. Limit access to people who need it, keep medical information separate from personnel files, lock paper records, and use passwords and access controls for digital files. Think about where cloud tools store data.

Do not keep it forever. Set retention periods. For unsuccessful applicants, decide how long you will keep their information and tell them. For employees, keep what employment standards, tax and payroll rules require, then dispose of it securely. Your copy of a Record of Employment, for example, must be kept for 6 years.

Let people see their own information. Employees and candidates can generally ask to see the personal information you hold about them and ask you to correct errors. Have a simple process for those requests.

Plan for a breach. If personal information is lost or accessed without permission, contain it, assess the risk to the people affected, and check what reporting your privacy law requires.

Is it the same in every province?

PIPEDA is a federal law, but it covers employee information only for federally regulated employers. British Columbia and Alberta have their own Personal Information Protection Acts, and Quebec has its own private-sector privacy law (see the Quebec Law 25 entry). PIPEDA can still apply to a provincially regulated business for some activities, such as personal information that crosses provincial or national borders.

Example: Tidying up candidate files at a Moncton IT firm

Gabriel runs a 19-person IT services firm in Moncton. While moving to a new file system, he finds three years of résumés from people he did not hire, plus reference notes and copies of driver's licences.

He decides on a rule: keep unsuccessful applicants' files for a set period after a hiring decision, then delete them securely. He adds that period to his job postings and rejection emails, stops asking for licence copies until after a conditional offer when driving is part of the job, and moves the remaining reference notes into a folder only he can open.

Reference checks in Staffkin

Staffkin reference checks have the candidate give consent online before referees answer a standard form, and you receive a PDF report.

Run a reference check

Free tools and guides for this

Questions about PIPEDA (employee privacy)

Does PIPEDA apply to employee information?

Only if your business is federally regulated, such as a bank, telecommunications company or transportation company. Other employers' employee information falls under provincial privacy laws where they exist.

How long can I keep job applicants' information?

Only as long as you need it. Set a retention period for unsuccessful applicants, tell them what it is, and delete their information securely afterwards.

Can an employee ask to see their personnel file?

Under Canadian privacy laws, people can generally ask to see the personal information an organization holds about them. Have a simple process for these requests.

Official sources

General information for Canadian employers, not legal advice. Rules differ by province and territory and change over time, so check with your provincial employment standards office (or the federal Labour Program if you are federally regulated) before you rely on it. See employment standards by province.

Checked against official sources on 5 November 2026.