The Personal Information Protection and Electronic Documents Act requires meaningful consent for collecting, using and disclosing personal information, limits use to identified purposes, and requires safeguards appropriate to sensitivity. It applies to commercial activity across Canada except where a province has substantially similar legislation.
Why it matters: it applies to most Canadian businesses handling customer data, including small ones, and includes mandatory breach reporting.