PIPEDA and CASL: Canada's Privacy and Anti-Spam Laws Explained

Canada has two major federal laws that businesses handling personal data and commercial messaging must understand: the Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL). Both carry significant penalties for non-compliance and apply to many businesses outside Canada that target Canadian residents.

PIPEDA - Canada's federal privacy law

PIPEDA governs how private-sector organisations collect, use and disclose personal information in the course of commercial activities. It applies to federally regulated businesses (banks, telecoms, airlines, broadcasters) operating anywhere in Canada, and to all organisations operating in provinces that have not enacted substantially similar legislation (currently only Quebec, Alberta and British Columbia have their own laws).

PIPEDA also applies to organisations outside Canada that process personal information of Canadian residents in the course of commercial activities. If you sell goods or services to Canadians and collect their personal data in doing so, PIPEDA applies to you.

• PIPEDA is based on ten fair information principles (see below)
• Consent is central - organisations must generally obtain meaningful consent before collecting, using or disclosing personal information
• Individuals have rights of access, correction and complaint
• The Office of the Privacy Commissioner of Canada (OPC) oversees compliance

The ten fair information principles

PIPEDA is structured around ten principles, each creating concrete obligations:

• Accountability: designate someone responsible for compliance
• Identifying purposes: identify the purposes for collection before or at the time of collection
• Consent: obtain meaningful consent - express or implied depending on sensitivity
• Limiting collection: collect only what is necessary
• Limiting use, disclosure and retention: use data only for the identified purpose
• Accuracy: keep personal information accurate, complete and up to date
• Safeguards: implement security safeguards appropriate to the sensitivity
• Openness: make your policies and practices readily available
• Individual access: respond to access requests promptly (30 days)
• Challenging compliance: establish a process for individuals to challenge your compliance

Bill C-27 - the successor to PIPEDA

Canada has been working on a comprehensive reform of its federal privacy framework through Bill C-27, which introduces the Consumer Privacy Protection Act (CPPA). When enacted, the CPPA will replace PIPEDA for most private-sector organisations, introduce higher penalties (up to 5% of global revenue or C$25 million), and create new rights including a right to data portability and the right to disposal.

Bill C-27 has not yet received Royal Assent as of mid-2025, but is expected to pass. Businesses should monitor its progress and begin assessing gap against its requirements now - in particular around consent mechanisms and the new individual rights.

CASL - Canada's Anti-Spam Legislation

CASL regulates the sending of commercial electronic messages (CEMs) - any email, text, or instant message sent to an electronic address that encourages participation in a commercial activity. CASL is one of the strictest anti-spam laws in the world.

CASL's core requirement: you must have express or implied consent before sending a CEM to a Canadian recipient.

• Express consent: the recipient has explicitly agreed to receive messages from you - this must be opt-in, not pre-checked boxes
• Implied consent: applies in limited circumstances, including where the recipient has a recent (within 2 years) business relationship with you, or where their email is published and you are messaging about relevant professional matters
• Every CEM must include: the sender's name and contact information, a working unsubscribe mechanism, and the unsubscribe request must be honoured within 10 business days
• Penalties for CASL violations can reach C$10 million per violation for organisations

CASL applies to messages sent from Canada and messages sent to electronic addresses in Canada - if you are emailing Canadian consumers from any country, CASL applies.

Practical compliance steps

• Audit your email marketing lists to verify you have valid express or implied consent for each recipient
• Implement a clear opt-in mechanism for new subscribers - pre-checked boxes do not create valid consent
• Ensure every commercial email includes an unsubscribe mechanism that works and is honoured within 10 business days
• Maintain records of consent - when it was obtained, the method, and what the person consented to
• If you are sending to business contacts who have published their email, document your implied consent basis
• Appoint someone responsible for PIPEDA compliance and review your privacy notice against PIPEDA's ten principles
• Assess your gap against Bill C-27 requirements before it is enacted

Back to all guides