Canada PIPEDA: Request Your Data and Ask for Deletion

PIPEDA is built around access, accuracy and consent. Its tools are real, and Quebec adds a separate de-indexing remedy.

By Siddharth ShankarUpdated October 11, 2026

Canadians often ask whether they have a "right to be forgotten". The honest answer is that Canada's private-sector privacy law is built differently from Europe's. It is about access, accuracy and consent. Still, it gives you real tools, and Quebec adds another.

The core idea of PIPEDA

The Personal Information Protection and Electronic Documents Act (PIPEDA) covers how private-sector organizations collect, use and disclose personal information in the course of commercial activity. One of its principles is that organizations should keep personal information only as long as it is needed to serve the purposes for which it was collected. The Office of the Privacy Commissioner (OPC) also publishes guidelines on retaining and destroying personal information.

Tools you can use

• Access: you can ask what personal information an organization holds about you. It must generally respond within 30 days and may extend by up to 30 more days. Fees should be minimal or free.
• Correction: you can challenge inaccurate or incomplete information and ask for it to be corrected.
• Withdrawing consent: you can withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice.
• Complaints: you can complain to the OPC. The OPC encourages you to try the organization first.

A sample approach

Search results and the OPC

The OPC's draft position on online reputation, which is undated, says PIPEDA gives people the right to withdraw consent, subject to limits. It says that de-indexing removes a page from name-search results but does not remove the content itself. It also says there is no unqualified right to remove other people's content, but you can challenge information that is inaccurate, incomplete or out of date. Canadian courts have held that Google is subject to PIPEDA, in a Federal Court decision in July 2021 and a Federal Court of Appeal decision in September 2023.

What Quebec adds

Quebec's privacy statute for the private sector lets a person ask a business to stop disseminating personal information or to de-index a hyperlink tied to their name, in certain cases. The conditions include that the dissemination contravenes the law or a court order, or that it causes serious injury to reputation or privacy that clearly outweighs the public interest and goes no further than necessary. Factors considered include whether the person is a public figure, whether they are a minor, the accuracy and sensitivity of the information, how much time has passed and any criminal pardon.

The Commission d'accès à l'information says you write to the business's privacy officer and prove your identity. The business has 30 days, and silence is treated as a refusal, after which you can take the matter to the Commission. The statute version we reviewed is dated September 2023, so check for later changes.

Credit and identity matters

Credit locks and fraud alerts are separate from privacy rights. Equifax Canada's lock is available only to residents of Quebec and Ontario, and TransUnion Canada's freeze only to Quebec residents. For detail, read credit freeze or fraud alert.