PIPEDA is Canada’s federal private-sector privacy law. It applies to immigration firms that collect personal information in commercial activity and is built on 10 fair information principles. Firms must report breaches posing a real risk of significant harm to the Office of the Privacy Commissioner, notify affected individuals, and keep records of all breaches for 24 months. ImmiPractice supports this with Canadian hosting, encryption, role-based access and incident notice without undue delay; accountability stays with your firm.
- PIPEDA generally applies to immigration firms collecting personal information in commercial activity.
- Your firm stays accountable for client information it entrusts to a processor like ImmiPractice.
- Breaches with a real risk of significant harm must be reported to the OPC and affected individuals notified.
- Records of every breach must be kept for 24 months.
- ImmiPractice notifies customers of incidents affecting their data without undue delay.
The Personal Information Protection and Electronic Documents Act (PIPEDA) is overseen by the Office of the Privacy Commissioner of Canada (OPC). For most RCICs and immigration consultancies, it is the privacy law that governs how client information is collected, used and disclosed. Using ImmiPractice does not make your firm compliant — no software can — but it can make several obligations easier to meet.
Does PIPEDA apply to my immigration practice?
Generally yes, if you are a private-sector organization collecting personal information in the course of commercial activity — and charging fees for immigration services is commercial activity. Alberta, British Columbia and Québec have their own private-sector privacy laws that apply instead of PIPEDA for activity within those provinces; PIPEDA still generally applies to personal information that crosses provincial or national borders in the course of commercial activity. If you practise in Québec, read Québec Law 25 as well. Federal privacy reform has been proposed in recent years, so check the OPC website for the law currently in force.
The 10 fair information principles, mapped to your practice
| Principle | What it asks of your firm | How ImmiPractice can help |
|---|---|---|
| 1. Accountability | Name a person responsible for privacy; stay accountable for information you give to service providers, using contracts | Clear processor role; DPA requests; published subprocessors |
| 2. Identifying purposes | Tell clients why you collect their information, at or before collection | Add purpose wording to intake forms and retainer templates |
| 3. Consent | Obtain meaningful consent; let people withdraw it | E-signed agreements with audit trail; opt-in WhatsApp broadcasts; email unsubscribe handling |
| 4. Limiting collection | Collect only what you need | Per-service document checklists and questionnaires |
| 5. Limiting use, disclosure and retention | Use information only for stated purposes; keep it only as long as needed | Role-based access; your own retention schedule; deletion on request |
| 6. Accuracy | Keep information accurate and complete for its purpose | One client record feeds every IRCC form; clients answer questionnaires themselves |
| 7. Safeguards | Protect information with safeguards suited to its sensitivity | Canadian hosting, encryption in transit and at rest, seven roles, branch isolation, private file storage, passwordless sign-in |
| 8. Openness | Make your privacy policies and practices readily available | Your own privacy notice; this Knowledge Center to explain your provider |
| 9. Individual access | Give people access to their information on request | Global search, ZIP document download, PDF agreements and invoices — see handling requests |
| 10. Challenging compliance | Have a simple way for people to complain, and investigate complaints | Your firm’s process; ImmiPractice helps you find the facts in the record |
What are the breach rules?
PIPEDA calls a breach a “breach of security safeguards”: loss of, unauthorized access to, or unauthorized disclosure of personal information. When a breach involving personal information under your control creates a real risk of significant harm to an individual, you must:
- Report it to the OPC as soon as feasible after you determine the breach has occurred;
- Notify the affected individuals as soon as feasible;
- Notify other organizations (or government institutions) that may be able to reduce the risk of harm, where appropriate; and
- Keep a record of every breach — including those that did not meet the threshold — for 24 months after you determine the breach occurred.
Assessing “real risk of significant harm” looks at the sensitivity of the information and the probability it will be misused. Passport scans, financial documents and immigration history are highly sensitive, so firms should assume a careful assessment will be needed. The OPC publishes guidance and a breach report form.
What does ImmiPractice do if there is an incident?
If an incident affects your data, ImmiPractice will detect and contain it, assess what data and which customers are affected, notify you without undue delay, and give you the facts you need for your own obligations, including PIPEDA breach reporting where required. The decision to report to the OPC and notify clients is yours, as the accountable organization. See incident response.
What should my firm do this month?
- Name your privacy officer and publish how clients can reach them.
- Review roles in ImmiPractice so each person sees only what their job needs.
- Create a breach log and a one-page response plan, including who calls whom.
- Update your privacy notice to describe your service providers and purposes.
- Set a retention schedule and a recurring review date.
This is general information, not legal advice.
General information about running an immigration practice — not legal advice. Rules change; confirm current requirements with official sources and your regulator.