Canadian research administrators handling personal information routinely ask which privacy law actually governs a given dataset: the federal Personal Information Protection and Electronic Documents Act (PIPEDA), a provincial “substantially similar” private-sector law, or provincial public-sector access-and-privacy legislation that applies to the university itself. The honest answer is that it depends on the activity, the institution type, and the province — and for most core academic research at a public university, PIPEDA often is not the operative statute at all. This guide sets out how the framework actually fits together, as a companion to CASRAI’s guide on the Tri-Agency Research Data Management Policy, which governs data-management planning obligations for federally funded Canadian research independently of which privacy statute applies.
What PIPEDA covers, and its limit at “commercial activity”
PIPEDA is federal private-sector legislation. It applies to organizations that collect, use, or disclose personal information in the course of commercial activity, and, separately, to the personal information of employees of federally regulated works, undertakings, and businesses (banks, telecommunications carriers, airlines, and similar). It does not, on its own terms, regulate government institutions, which are instead covered by the federal Privacy Act or by provincial public-sector access-and-privacy statutes.
That distinction matters directly for universities. The Office of the Privacy Commissioner of Canada (OPC) has stated plainly that PIPEDA does not apply to the core activities of municipalities, universities, schools, and hospitals, because these are primarily government-funded institutions carrying out public mandates rather than trade and commerce. A public university conducting a federally or provincially funded research study is, for that activity, generally operating under its provincial public-sector privacy regime (for example, a provincial Freedom of Information and Protection of Privacy Act) rather than PIPEDA.
PIPEDA re-enters the picture when a university engages in something the OPC would classify as commercial activity — its own guidance gives the example of selling or bartering an alumni list, and analogous logic extends to a university lab that sells research services, licenses a dataset to a commercial partner, or otherwise discloses personal information to generate revenue rather than to pursue the institution’s educational/research mandate. Research collaborations with private-sector partners — a contract research organization, a pharmaceutical sponsor, a private biobank, or a commercial genomic-sequencing vendor — can bring PIPEDA into play for that specific data flow even where the university’s own core research activity remains under provincial law. Private, non-public research institutes and companies conducting research (rather than public universities) are, by contrast, squarely commercial organizations and should generally assume PIPEDA applies to them directly.
The practical implication: before assuming PIPEDA is (or isn’t) the applicable statute, identify (1) the institution type — public university vs. private research entity — and (2) whether the specific data flow in question is a core research/education activity or a commercial one. A single research program can straddle both: publicly funded data collection under provincial law, paired with a data-sharing agreement to a commercial diagnostics partner that triggers PIPEDA for that disclosure.
PIPEDA’s research and statistical-study provisions
Where PIPEDA does apply, it does not require consent for every research use of personal information. Sections 7(2)(c) and 7(3)(f) create a narrow consent exception specifically for statistical, scholarly study, or research purposes:
- Use without consent — s. 7(2)(c): an organization may use personal information without the knowledge or consent of the individual if it is used for statistical, or scholarly study or research, purposes that cannot be achieved without using the information; the information is used in a manner that ensures its confidentiality; it is impracticable to obtain consent; and the organization informs the Privacy Commissioner of the use before the information is used.
- Disclosure without consent — s. 7(3)(f): an organization may disclose personal information without consent for statistical, or scholarly study or research, purposes that cannot be achieved without disclosing the information, where it is impracticable to obtain consent and the organization informs the Commissioner of the disclosure before it occurs.
Both provisions impose cumulative conditions, not alternatives — an organization relying on them needs all of the applicable elements satisfied, including the advance notification to the OPC. This is a genuinely distinct compliance step from the notice-and-consent obligations that dominate the rest of PIPEDA, and it is easy to miss in practice: the notification is to the Commissioner directly (not a public filing or a participant-facing disclosure), must happen before the use or disclosure, and does not substitute for the confidentiality safeguards the provision separately requires. Institutions relying on this exception should document, contemporaneously, why consent was impracticable and what confidentiality measures (de-identification, restricted access, data-use agreements) are in place — this is the record that would be produced if the OPC investigates a complaint. See CASRAI’s dictionary entries on de-identification and privacy by design for related safeguard concepts, and informed consent for how this interacts with research-ethics-board consent requirements, which are a separate obligation under the Tri-Council Policy Statement (TCPS 2) regardless of what PIPEDA itself requires.
The “substantially similar” provincial regimes
PIPEDA’s own architecture anticipates provincial private-sector privacy laws displacing it. Under PIPEDA, the Governor in Council may designate a provincial law as “substantially similar,” and organizations whose collection, use, or disclosure of personal information occurs entirely within that province are then exempt from PIPEDA for that in-province activity — PIPEDA continues to apply to interprovincial or international transfers, and always applies to federally regulated works and undertakings regardless of province.
Three provinces currently have comprehensive private-sector legislation designated substantially similar to PIPEDA:
- Alberta — the Personal Information Protection Act (PIPA), overseen by the Office of the Information and Privacy Commissioner of Alberta.
- British Columbia — its own Personal Information Protection Act (PIPA), overseen by the Office of the Information and Privacy Commissioner for British Columbia.
- Quebec — the Act respecting the protection of personal information in the private sector, overseen by the Commission d’accès à l’information du Québec, and substantially updated by Quebec’s Law 25 (formerly Bill 64) privacy modernization.
In addition, four provinces have health-information-specific legislation designated substantially similar for personal health information specifically (not general private-sector data): Ontario’s Personal Health Information Protection Act (PHIPA), New Brunswick’s Personal Health Information Privacy and Access Act, Newfoundland and Labrador’s Personal Health Information Act, and Nova Scotia’s Personal Health Information Act. A health researcher handling clinical data in one of these four provinces should generally look to that province’s health-privacy statute rather than PIPEDA for personal health information specifically, even though PIPEDA remains the applicable framework for that province’s general commercial personal information.
For research spanning multiple provinces or institutions, this creates real complexity: a multi-site study coordinated from Ontario, with a commercial-sector data-processing partner in Alberta and a participating hospital in Quebec, may need to satisfy PIPEDA, Alberta’s PIPA, and Quebec’s private-sector law simultaneously for different legs of the same data flow, on top of whatever provincial public-sector or health-information law governs the hospital and university sites themselves. There is no single unified Canadian data-protection statute equivalent to the EU’s GDPR — Canada’s model is explicitly federated, and “which law applies” has to be answered activity-by-activity and province-by-province rather than assumed institution-wide.
Practical checklist for research administrators
- Confirm institution type first: public university/hospital (provincial public-sector law generally governs core research) vs. private company or non-public research institute (PIPEDA or a substantially-similar provincial private-sector law generally governs directly).
- Flag any data flow to a commercial partner — sponsor, CRO, commercial biobank, data broker, cloud vendor outside the institution’s own infrastructure — as a point where PIPEDA (or the relevant substantially-similar provincial law) may apply even if the broader project is otherwise under public-sector or research-ethics governance.
- Where the s. 7(2)(c)/7(3)(f) research exception is being relied on to use or disclose personal information without consent, confirm and document: necessity (purpose cannot be achieved another way), impracticability of consent, confidentiality safeguards, and — critically — that the Privacy Commissioner was informed before the use or disclosure, not after.
- For any data leaving the province of collection, or moving to/from a federally regulated entity, treat PIPEDA as live regardless of provincial substantially-similar status.
- Treat REB/TCPS 2 consent requirements and PIPEDA/provincial privacy-law consent exceptions as separate, cumulative obligations — satisfying one does not satisfy the other.
Frequently asked questions
Does PIPEDA apply to a Canadian public university’s own research program?
Generally not to the university’s core research and educational activity — the OPC has stated PIPEDA does not apply to universities’ core activities, which instead fall under provincial public-sector access-and-privacy legislation. PIPEDA can still apply to specific commercial-activity data flows within a research program, such as a disclosure to a commercial partner for revenue-generating purposes.
Which provinces have privacy laws that are “substantially similar” to PIPEDA?
Alberta, British Columbia, and Quebec have comprehensive private-sector privacy laws designated substantially similar to PIPEDA, which exempts organizations from PIPEDA for personal information handled entirely within that province. Ontario, New Brunswick, Newfoundland and Labrador, and Nova Scotia have health-information-specific laws with the same designation, covering personal health information only.
Does the PIPEDA research exception mean researchers never need consent?
No. Sections 7(2)(c) and 7(3)(f) create a narrow exception for statistical, scholarly, or research use/disclosure where consent is impracticable, confidentiality is protected, and the Privacy Commissioner is informed in advance — it does not override research-ethics-board consent requirements under frameworks like Canada’s TCPS 2, which operate independently of PIPEDA.
If my data never leaves Alberta, BC, or Quebec, can I ignore PIPEDA entirely?
Only for the portion of collection, use, and disclosure that occurs wholly within that province by an organization covered by its substantially-similar law. PIPEDA still applies to interprovincial or cross-border transfers and to federally regulated organizations operating in that province regardless of the provincial designation.
