PIPEDA Privacy Rights and Quebec Law 25, Explained

PIPEDA privacy rights sound technical, but the core idea is simple: a business that holds your personal information has to let you see it. This guide explains how that works in practice, how to make a request, where to complain, and what Quebec's Law 25 adds. We stick to what the regulators publish and point you to their pages for the details.

This is not legal advice. Privacy law changes, and your situation may be different. For anything important, read the official guidance or talk to a lawyer.

What is PIPEDA?

PIPEDA is the Personal Information Protection and Electronic Documents Act, Canada's federal privacy law for many private-sector organizations. The Office of the Privacy Commissioner of Canada (OPC) oversees it. Alberta, British Columbia and Quebec have their own private-sector privacy laws, which the OPC says may apply instead of PIPEDA. If you aren't sure which law covers a business, check the OPC's site.

How to request my personal information in Canada

The OPC's page on accessing your personal information held by businesses sets out the basics:

Point	What the OPC says
How to ask	Put your request in writing, ideally to the business's privacy or access contact
How long	The business is supposed to give you access within 30 calendar days. It can extend this by up to 30 more days in some cases, but must tell you within the first 30
Cost	Little or nothing. A minimal fee is allowed only if you were told the rough cost first and agreed
If you're unhappy	Try to sort it out with the business first, then you can file a complaint with the OPC

A simple request letter

Keep it short and specific. Say who you are, which account or service you mean, and what you want: a copy of the personal information they hold about you, how they use it and who they share it with. Narrow requests tend to get faster answers. Find the privacy contact in the business's privacy policy, usually linked in the website footer. Keep a copy and note the date you sent it.

Complaining to the Office of the Privacy Commissioner

If a business ignores you, refuses without a good reason, or you think it mishandled your data, you can file a complaint with the OPC. The OPC asks people to try to resolve the matter with the organization first. Its website explains how to file and what happens next, so follow the current steps there rather than any summary, including this one.

Is there a right to be forgotten in Canada?

PIPEDA does not spell out a broad "right to be forgotten" like the one people talk about in Europe. What you can do under PIPEDA is ask to see your information and challenge its accuracy. For removal from search engines and sites, the practical tools are the sites' own removal forms and opt-outs. For the latest position, check the OPC's site. Quebec is different, as the next section explains.

Quebec Law 25 privacy rights

Law 25 updated Quebec's private-sector privacy law in phases. The Commission d'accès à l'information du Québec (CAI) is the regulator. In general terms, it added:

• A right related to de-indexing. In some situations, a person can ask a business to stop spreading their personal information or to de-index a hyperlink attached to their name, when spreading it breaks the law or causes serious harm. The conditions are specific, so read the CAI's guidance before you rely on it.
• Data portability. Since September 2024, a person can ask for computerized personal information they provided to be given to them, or to someone they name, in a structured, commonly used format. It doesn't cover everything a business holds about you.
• More transparency. Businesses have more duties to explain how they use personal information and to report certain privacy incidents.

If you live in Quebec, the CAI's site is the place for the exact rules and how to file a complaint. You can also read our site in French at /fr/.

Find out what's out there first

A request works best when you know which companies hold your data. Two free checks help:

• Our free username search, powered by our own FreeUsername™ search engine, checks 3,450+ sites for accounts using your handles. Forgotten accounts are good candidates for an access or deletion request.
• Our email breach check (coming soon) will show which breaches your email appeared in and what leaked.

For a full walkthrough, see our digital footprint check for Canada. If a people search site lists you, see how to remove yourself from people search sites in Canada. You can also check one network at a time, for example with the LinkedIn username check.

On Android, the free FreeUsername: Username Checker app runs the username search on your phone. Our engine's home is FreeUsername.com.

FAQ

How long does a business have to answer my PIPEDA request?

The OPC says businesses are supposed to give you access within 30 calendar days, with a possible extension of up to 30 more days if they tell you within the first 30.

Does it cost money to get my personal information?

It should cost little or nothing. A business can charge a minimal fee only if it told you the approximate cost first and you agreed.

Does PIPEDA apply in Quebec?

Quebec has its own private-sector privacy law, which may apply instead of PIPEDA for many businesses there. Check the OPC's and the CAI's sites to see which law applies to your case.

Can I make Google forget me in Canada?

Google has its own removal tools for some personal information, such as contact details. Quebec's Law 25 adds a de-indexing related right in certain cases. Outside those tools, there is no simple general right to delete search results.

Is FreeUsername free?

It is. No sign-up, no stored searches. The site runs on ads.

Is the FreeUsername app free?

Yes. FreeUsername: Username Checker is free on Google Play for Android. An iPhone version is coming soon.