CANADA · PIPEDA·5 min·2026-04-22
PIPEDA / LPRPDE: Your Federal Credit Data Rights
Canada's Personal Information Protection and Electronic Documents Act governs how private-sector organizations — including credit bureaus and furnishers — collect, use and disclose personal information. It stacks with provincial regimes like Québec Law 25.
Your core rights under PIPEDA
- Access your personal information held by an organization (s. 4.9).
- Correct inaccurate information (s. 4.9.5).
- Withdraw consent at any time (s. 4.3.8) — with legal and business consequences.
- File a complaint with the OPC (Office of the Privacy Commissioner).
- Pursue damages in Federal Court after OPC report (s. 14).
Procedure for credit-data correction
- Request access in writing; organization has 30 days (extendable 30).
- If response unsatisfactory, file OPC complaint (free, 1 year window).
- OPC issues a report; non-compliance enables Federal Court suit.
- Court can award damages, declarations, injunctions.
Interaction with FCRA
- PIPEDA covers Canadian consumers' data held anywhere, including US-owned bureaus.
- FCRA applies when the data is processed or originates in the US.
- Dual-jurisdiction strategy: PIPEDA access request + FCRA dispute letter.
- Québec residents add Loi 25 on top.
PIPEDA · R.S.C. 1985, c. E-21 · OPC