- 18 Nov 2026 UK Have your directors and PSCs verified with Companies House?
- 1 Dec 2026 AU Will your onboarding accept private-sector Digital IDs?
- 10 Dec 2026 AU Does your privacy policy explain your automated KYC decisions?
- End 2026 EU Is your ID verification ready for EUDI Wallets?
- 1 Jan 2027 US Can your age checks keep up state by state?
- 1 Apr 2027 JP Is your eKYC ready for the IC-chip mandate?
- 10 Jul 2027 EU Is your CDD flow ready for the AMLR?
- 1 Jan 2028 US Are your adviser clients ready for FinCEN’s AML rule?
- 31 Mar 2029 AU Is your initial CDD on the new AUSTRAC model?
- Now AU Tranche 2 is live. Is your AML/CTF program running?
PIPEDA for firms doing KYC, and the Bill C-36 reform
PIPEDA governs how private-sector organisations collect, use and disclose personal information, including the ID documents and biometrics used in client checks. Bill C-36 would replace its privacy rules with a new Act and a new regulator.
- PIPEDA applies to private-sector organisations that collect, use or disclose personal information in the course of commercial activity, subject to substantially similar laws in Quebec, British Columbia and Alberta.
- The OPC treats biometric information that can uniquely identify a person as sensitive, and says express consent is generally the appropriate form for it.
- Bill C-36, the Protecting Privacy and Consumer Data Act, had its first reading on 15 June 2026. As at 5 November 2026 LEGISinfo shows no further stage completed.
- As introduced, C-36 would allow administrative penalties of up to the greater of C$10 million and 3% of global revenue.
What it is
The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's federal private-sector privacy law. It is built on ten fair information principles: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance.
KYC puts these principles under pressure. A firm verifying a client collects a government ID, often a selfie and a liveness check, and sometimes ownership details for a company or trust. The OPC's guidance for processing biometrics (last modified 11 August 2025) says to prefer one-to-one verification over identification, keep biometric data only as long as needed, and make sure service providers give comparable protection.
Bill C-36 is the third attempt in six years to replace PIPEDA's privacy rules, after Bills C-11 and C-27 died on the Order Paper. It would enact the Protecting Privacy and Consumer Data Act, move oversight to a Digital Safety and Data Protection Commission of Canada, and add a private right of action once a contravention is established (DLA Piper).
Who it applies to
PIPEDA covers most firms that run client checks in Canada:
- Private-sector organisations that collect, use or disclose personal information in the course of commercial activity.
- Federally regulated businesses, such as banks, airlines and telecommunications companies, for their employees' information too.
- Organisations whose personal information crosses provincial or national borders, wherever they are based.
Alberta, British Columbia and Quebec have private-sector laws deemed substantially similar, so activity within those provinces is generally governed by the provincial law. Accountants, real estate firms and BC notaries that are FINTRAC reporting entities collect identity information because the PCMLTFA requires it. PIPEDA still governs how that information is handled.
What you have to do
These are PIPEDA duties as they apply to a KYC process. How you meet them is set by your own privacy program.
- Identify the purpose and get the right consent
Tell clients why you are collecting their information at or before collection. For biometrics, the OPC says consent should be express and should name the biometric collection separately.
- Collect only what you need
Limit collection to what your stated purpose requires. The OPC's biometrics guidance asks whether a program meets four tests: legitimate need, effectiveness, minimal intrusiveness and proportionality.
- Protect data you share with providers
Use contracts or other means to make sure service providers give a comparable level of protection, and tell individuals about providers, including transfers outside Canada.
Vendor management - Report breaches that create a real risk of significant harm
Report to the OPC, notify affected individuals as soon as feasible, and keep a record of every breach for two years. Knowingly failing to do so is an offence with fines of up to $100,000 under section 28.
Reported to the OPC - Keep and destroy on schedule
Keep personal information only as long as needed for its purpose and any legal obligation, such as AML record keeping, then destroy it, including copies held by service providers.
Ongoing
What firms get wrong
Most errors come from treating an AML requirement as a privacy exemption, or a bill as law.
An AML law can require you to collect information. PIPEDA still governs purposes, safeguards, retention and breach reporting for it.
The OPC says consent to collect photos or video does not extend to extracting biometric information from them. Ask for that consent separately.
It is a bill. LEGISinfo shows first reading on 15 June 2026 and no later stage. PIPEDA applies until a replacement is passed and brought into force.
What happens when
- In force
OPC guidance for processing biometrics for businesses last modified Source
- Proposed
Bill C-36 introduced and read a first time in the House of Commons Source
- Not yet setProposed
Second reading of Bill C-36, then committee, Senate and Royal Assent; commencement to follow Source
Not yet confirmed. We will update this when the date is set.
Related guides
Questions people ask
What is PIPEDA?
The Personal Information Protection and Electronic Documents Act, Canada's federal privacy law for private-sector organisations handling personal information in commercial activity. The OPC oversees it.
Does PIPEDA apply to identity verification and KYC?
Yes. ID documents, selfies and biometric templates are personal information. Biometric information that can uniquely identify someone is sensitive, so the OPC expects express consent and strong safeguards.
What is Bill C-36?
The government bill introduced on 15 June 2026 to enact the Protecting Privacy and Consumer Data Act and replace PIPEDA's privacy rules. As at 5 November 2026 it is at second reading in the House of Commons.
What penalties would Bill C-36 bring?
As introduced: administrative penalties up to the greater of C$10 million and 3% of global revenue, and fines on indictment up to the greater of C$25 million and 5% of global revenue. Today PIPEDA's offence fines reach $100,000.
How does this sit with FINTRAC rules?
FINTRAC rules set what identity information reporting entities must collect and keep. PIPEDA sets how it is handled. See PCMLTFA and FINTRAC.
Primary sources
Checked 5 Nov 2026. We review this page every 90 days and when the rules change.
- Office of the Privacy Commissioner of Canada, PIPEDA requirements in brief
- Office of the Privacy Commissioner of Canada, Guidance for processing biometrics: for businesses
- Office of the Privacy Commissioner of Canada, What you need to know about mandatory reporting of breaches of security safeguards
- Justice Laws Website, PIPEDA (S.C. 2000, c. 5), section 28
- Parliament of Canada, LEGISinfo, Bill C-36 (45th Parliament, 1st session)
- DLA Piper, Canada tables Bill C-36: The Protecting Privacy and Consumer Data Act (Jun 2026) (secondary)
- Gowling WLG, Bill C-36: Timeline of developments (secondary)
Where StackGo fits
StackGo is compliance middleware. Your firm stays responsible for its own privacy program. IdentityCheck is built to keep identity data out of the systems where it does not need to live.
- Biometric identity verification: a photo of a government ID document plus a live selfie with liveness, covering 12,500 document types from 230+ countries and territories.
- Onboarding forms that collect only the fields your process asks for, including multi-entity forms for companies and trusts.
- Two-way integrations with Xero Practice Manager, Xero, Karbon and HubSpot; Salesforce via Zapier. By default no personal details are written back to the connected system, only a link to the result plus the outcome and status.
- It does not report breaches to the OPC or notify individuals for you.
- Government document verification (DVS) is an Australian add-on and does not check Canadian records.
- No legal advice on PIPEDA, provincial privacy laws or Bill C-36.
Ready to make onboarding minutes, not hours?
Start free and run your first check today, or book a demo and we will walk you through it.