PIPEDA and Newsletter Subscriber Data: What Canadian Publishers Owe

What to take away

Who has jurisdiction over your list

The Personal Information Protection and Electronic Documents Act governs how private organisations handle personal information in commercial activity. A newsletter is commercial activity when money changes hands anywhere in the chain, whether through sponsorships, paid tiers or affiliate links. Running a free list funded by a sponsor still counts.

Federal jurisdiction covers federally regulated employers and every province without its own substantially similar law. The Office of the Privacy Commissioner of Canada, known as the OPC, enforces it and publishes guidance on consent and breach reporting. The statute sits at Justice Laws, and the regulator's plain-language summary is at the OPC PIPEDA overview.

Quebec, Alberta and British Columbia have private-sector laws the federal government has recognized as substantially similar. If you operate in one of those provinces, the provincial regulator usually handles complaints about your list. Ontario and New Brunswick apply their health-information laws instead. You can face one regulator in practice, but the duties look similar.

What a compliant disclosure contains

Email address, name, province, open and click events, and payment details are all personal information when tied to an identifiable subscriber. If you use a mailing platform, an analytics tool and a payment processor, each is a third party that receives data. List them by category, and name the ones that store data outside Canada.

Consent under PIPEDA must be informed and tied to a purpose a reasonable person would accept. Bundling consent for unrelated uses does not meet that bar.

A compliant form is short. It states the purpose, links to the full privacy page, and records the date and time of the opt-in. A pre-ticked box fails the test. So does a single consent line covering both the newsletter and the sale of data to advertisers.

Records to keep

The OPC expects you to demonstrate consent, not just claim it. Keep the signup source, the timestamp, the IP address where your platform captures it, and the exact wording the subscriber agreed to.

Retention is the record most publishers neglect. If you keep unsubscribed addresses for years without a reason, you are holding personal information you no longer need. Set a purge window and follow it. A subscriber can ask to see the data you hold and ask for corrections, and you must respond within 30 days.

What happens if you do not comply

The OPC can investigate a complaint, audit your practices, and publish findings that name your organisation. It can also apply to the Federal Court for an order forcing you to change practices or to pay damages to a complainant. Those findings are public.

The breach report is the sharper consequence. Since 2018, mandatory breach reporting rules require reporting any breach of security safeguards with a real risk of significant harm to the OPC as soon as feasible.

You must also notify affected subscribers and keep records of every breach for 24 months, even those you decide not to report. Failing to report is a violation, and it is the one most likely to draw a penalty.

Where the rules differ by place

Alberta's Personal Information Protection Act, Quebec's private-sector law and British Columbia's PIPA each set their own consent rules. Quebec's Law 25 added stricter requirements, including privacy impact assessments and a duty to report confidentiality incidents to the provincial commission.

Provincial rules can overlap with federal ones when data crosses borders. A publisher in Quebec that mails to subscribers across Canada should assume the strictest applicable rule governs the list. If you sell to American readers as well, the state rules differ again, and our guide to California and Colorado privacy rules explains where those thresholds fall.

Two more Canadian rules sit alongside PIPEDA. Canada's Anti-Spam Legislation governs the commercial messages themselves and requires express or implied consent plus a working unsubscribe. The CRA rules on tax are separate again, and GST/HST registration for a newsletter business covers when a Canadian publisher must register and collect.

Common questions

For the message-level rules that sit on top of these privacy duties, our CAN-SPAM compliance checklist is a useful comparison point even for Canadian senders.