PIPEDA is Canada's federal private-sector privacy law. It gives you a right of access, a right of correction, and a route to complain to the Office of the Privacy Commissioner. What it does not give you is a GDPR-style absolute right to erasure. Here is what you can realistically achieve, and how to go about it.
What PIPEDA actually covers
The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to private-sector organisations that collect, use or disclose personal information in the course of commercial activity. In practice that means it covers banks, telecoms, retailers, insurers, airlines, e-commerce platforms and most businesses operating across provincial or national borders. It does not cover the federal government (that is the Privacy Act) or purely provincial matters, and it does not cover individuals acting for personal or journalistic purposes.
One important limit: PIPEDA is built around consent, not around deletion. The law says an organisation may only use personal information for purposes a reasonable person would consider appropriate, and it must respect the choices you made when you gave consent. Withdrawing consent is your strongest lever — but it is not the same thing as a blanket right to have everything removed.
The 10 fair information principles that matter to you
PIPEDA is organised around ten fair information principles set out in Schedule 1. You do not need to memorise all of them, but four are directly relevant to a removal request:
Principles 4 and 3 together are what often make deletion possible in practice: if the information was collected for a purpose that has ended, or collected beyond what was needed, there is no lawful basis to keep it.
- Principle 3 – Consent: your knowledge and consent are required for collection, use or disclosure, and you may withdraw consent (with reasonable notice) subject to legal or contractual restrictions.
- Principle 4 – Limiting collection: an organisation may only collect what it actually needs for a stated purpose.
- Principle 8 – Accuracy: personal information must be accurate, complete and up to date as needed for the purpose.
- Principle 9 – Individual access: on request, you are entitled to be told whether the organisation holds information about you, and to be given access to it.
Step one: file a formal access request
The process starts with a written access request to the organisation's Privacy Officer. Be specific: name the organisation, state clearly that you are making a request under PIPEDA, describe the personal information you want, and ask for how it was collected, how it has been used and to whom it has been disclosed. If you intend to ask for deletion, say so in the same letter and explain why consent no longer applies — for example the account is closed, the purpose has been fulfilled, or the retention period has passed.
The organisation must respond within 30 days. It may extend that period in limited circumstances (for example if answering requires a large volume of work or consultation) but it must notify you in writing within the original 30 days. It may charge a minimal fee, but only if it gives you an estimate first. If you get no answer, a vague answer, or a refusal without real reasons, that itself is a compliance problem you can raise with the regulator.
Step two: complain to the Office of the Privacy Commissioner
If the organisation refuses or stalls, you can complain to the Office of the Privacy Commissioner of Canada (OPC). Complaints must generally be filed within one year of the act or omission you are complaining about, and the OPC expects you to have tried to resolve the matter directly first. You can file online or in writing, and you should attach the paper trail: your request, their response, dates, and a short statement of what you think was breached.
Be realistic about the outcome. The OPC investigates and issues findings — it does not issue court orders or fines directly. A finding that an organisation contravened PIPEDA is not legally binding on the organisation, but it is published, it is a public finding of non-compliance, and it is frequently enough pressure to change a company's behaviour. Where the OPC's recommendations are ignored, it can take the matter to Federal Court, which can order the organisation to correct its practices and, in some cases, award damages.
Step three: escalation to Federal Court
You can also take a matter to Federal Court yourself, usually after the OPC has completed its investigation, or in some cases instead of complaining. Federal Court can order an organisation to comply with PIPEDA, and since 2018 the Court can award damages in defined circumstances. This is a real route but it is slow, it is expensive, and the burden of building the record is on you — which is why most people use it as leverage after a documented OPC complaint rather than as a first step.
If the matter is actually defamation, harassment, or a breach of a non-privacy legal duty, PIPEDA is the wrong tool. Canadian defamation law, civil remedies and the specific provincial laws below may be more direct.
Provincial laws can be stronger — check which one applies to you
Three provinces have privacy legislation the federal government recognises as substantially similar to PIPEDA, meaning it applies instead of PIPEDA to intra-provincial commercial activity:
If you live in Quebec, or the organisation is based there and the processing happens there, read our companion guide on Quebec Law 25 before you send a PIPEDA request — the legal basis, the deadlines and the enforcement body are all different, and stronger.
- Alberta – Personal Information Protection Act (PIPA), enforced by the Office of the Information and Privacy Commissioner of Alberta, with a real ability to compel and to levy penalties.
- British Columbia – Personal Information Protection Act (PIPA), enforced by the Office of the Information and Privacy Commissioner for BC, including order-making powers.
- Quebec – Law 25 (formerly Bill 64), which goes considerably further than PIPEDA and grants an actual right to deletion and de-indexation.
What a removal campaign actually involves
Removing personal information from Canadian sources is rarely one letter. It is a scoping exercise followed by a prioritised campaign: identify every organisation and every public source that holds the information, work out which ones you have a lawful basis to challenge under PIPEDA or a provincial statute, and which ones hold the information for a reason you cannot displace (regulatory retention, court records, tax and employment obligations, journalism, public registers). Only then do you start sending requests in order of likely return.
That prioritisation is the hard part, and it is why a paid service exists at all. We can do the audit, map the sources, identify the legal hooks and run the correspondence — but no one, including us, can promise that a given data point will be removed. Some records are lawfully retained, some organisations will refuse and some will simply be slow. The honest version of this work is a documented, well-argued campaign, not a guarantee.