PIPEDA Penalties for Non-Compliance & Enforcement Details

The maximum fine under PIPEDA is CAD $100,000, and only the Federal Court can impose penalties. The Office of the Privacy Commissioner of Canada (OPC) can't fine a business for general non-compliance.

Instead, the OPC investigates non-compliance and raises concerns to the Federal Court. On application, the Federal Court can order a business to fix its practices and pay damages.

Bill C-36 would change that math, raising the ceiling to the higher of $25 million or 5% of global revenue.

PIPEDA's penalties look small today when compared to the hefty fines of the GDPR. Bill C-36 would change that, however, with its proposed ceiling of 5% of global revenue running higher than GDPR's 4%. 

What are the penalties for a PIPEDA violation?

PIPEDA violation penalties range between CAD $10,000 on the lower end to a maximum of $100,000. Specific offences are found in subsection 8(8), section 10.1,  subsection 10.3(1), and 27.1(1) of the law.

The headline number rarely lands. What a business usually faces is a warning from the Privacy Commissioner and, if it ignores the recommendations, a Federal Court order to fix its practices, publish the correction, and pay damages.

The section 28 offences are a short, specific list (section 28):

• knowingly destroying personal information that someone has asked to see, instead of keeping it while their request runs its course (section 8(8))
• knowingly failing to report a qualifying breach to the OPC, or to notify the people affected (section 10.1)
• knowingly failing to keep a record of every breach (section 10.3)
• punishing an employee who reported a violation in good faith, or who refused to take part in one (section 27.1)
• obstructing the Commissioner during an investigation or an audit

That knowing conduct threshold is why prosecutions are rare: a court has to be satisfied the business chose to do it, not that it slipped. Bill C-36 would narrow that clause, making PIPEDA stricter in its application. 

Who enforces PIPEDA?

The Office of the Privacy Commissioner of Canada (OPC), an Agent of Parliament, enforces PIPEDA, with the Federal Court behind it for binding orders and damages.

The Competition Bureau plays no part in PIPEDA enforcement, though the two are often confused. Its remit is the Competition Act, including misleading advertising, so it redirects privacy complaints to the Privacy Commissioner.

What happens during an OPC investigation?

An OPC investigation runs from complaint to a report of findings within one year (section 13), and the business spends that year producing records and answering questions. It begins with a complaint, which an individual files or the Commissioner starts directly (section 11). The Commissioner can compel documents, enter premises, and question staff under oath (section 12.1).

The Commissioner then issues a report of findings and recommendations. Ignoring it opens the door to the Federal Court.

The complainant has one year to apply to the Federal Court for a hearing (section 14), and the Commissioner can bring or join that application with the complainant's consent (section 15). The court holds the real remedial power: it can order a business to fix its practices, publish the correction, and pay damages (section 16).

When damages are awarded, they have stayed modest. The Federal Court awarded $5,000 in Nammo v. TransUnion for an inaccurate credit report, and $10,000 in damages plus $10,000 in exemplary damages in Chitrakar v. Bell TV for a credit check run without consent. Chitrakar's $20,000 award remains the largest the court has made under PIPEDA, a different order of magnitude from the fines Bill C-36 proposes.

A matter can also end earlier in a compliance agreement (section 17.1), a set of binding fixes a business agrees to instead of a court hearing.

What counts as a PIPEDA violation?

A PIPEDA violation is any failure to meet an obligation in Division 1 or 1.1 of the Act, or to follow a fair information principle in Schedule 1. Either one can be the basis of a complaint.

Collecting more data than what is required, keeping it past its purpose, refusing a valid access request, or missing a breach report all qualify as PIPEDA violations. 

PIPEDA breach notification: what happens if you fail to report?

Section 28 offences, which outline PIPEDA non-compliance, detail breach handling.  These include knowingly failing to report a qualifying breach to the OPC, failing to notify affected people, and failing to keep breach records. All three carry the same $100,000  fine ceiling.

A report to the Commissioner has to contain details:

• a description of the breach and its cause, as far as you know it
• when it happened, or the period over which it happened
• the personal information involved
• the number of people affected, or an estimate
• what you have done to reduce or mitigate the harm
• how you have notified, or will notify, the people affected
• the name and contact details of someone who can answer questions

The same section 28 offence covers breach records (section 10.3): every breach gets logged, reportable or not, and kept for 24 months for the Commissioner to inspect.

How would Bill C-36 change PIPEDA penalties?

Bill C-36 would replace PIPEDA's $100,000 ceiling with penalties on the GDPR's scale, set as a share of global revenue.

Bill C-36, the Protecting Privacy and Consumer Data Act, was introduced on June 15, 2026 and is before the House for second reading as of September 2026.

It sets administrative penalties for any contravention of the Act, capped per investigation at the higher of $10 million or 3% of global revenue, according to section 114. Offences prosecuted in court would carry fines of up to the higher of $25 million or 5% on indictment (section 145).

Bill C-27 and its Consumer Privacy Protection Act (CPPA) died when Parliament was prorogued in January 2025, so none of the CPPA's proposed penalties ever took effect. Bill C-36 is the third attempt at reform, after Bill C-11, introduced in 2020, and Bill C-27 in 2022.

Bill C-36 would also change who enforces the law. Private-sector oversight would pass from the OPC to a new body, the Digital Safety and Data Protection Commission of Canada, and unlike the OPC, it would have the power to impose penalties itself. 

Until C-36 passes and is brought into force, PIPEDA's current regulations apply including the $100,000 fine ceiling. 

Examples of PIPEDA enforcement

Recent OPC findings show what enforcement looks like without fines: investigations, public findings, and binding commitments.

• OpenAI (ChatGPT), May 2026. A joint investigation by the OPC and provincial regulators found the complaints about OpenAI's handling of Canadians' personal information well-founded and conditionally resolved, over issues including consent for scraped data, accuracy, and retention. OpenAI committed to filtering personal information from training data, formal retention policies, and quarterly compliance reports.
• X and xAI (Grok), 2026. The OPC opened its own complaints into X and xAI in January 2026. In June, it found them well-founded but not yet resolved, over consent for using Canadians' personal information to generate sexualized deepfakes. The respondents made commitments and the OPC is still monitoring, a reminder that a business doesn't need a complainant to draw an investigation.
• Google, August 2025. In finding #2025-002 the OPC recognized a limited right under PIPEDA to have outdated or misleading search results de-listed. Google declined to de-list, saying it wanted the courts to rule first, and in August 2026 the OPC asked the Federal Court to order it.

In 2025-26 the OPC received 696 breach reports affecting more than 20 million Canadians, and 3,044 PIPEDA complaints, so an investigation is a routine event, not a rare one.

Managing your PIPEDA exposure

Enzuzo's consent management platform keeps the consent records that show what each person agreed to and when, and its data request form logs each access request, so the evidence exists before anyone asks for it.

Talk to a PIPEDA compliance expert to see how Enzuzo can help. 

Frequently asked questions

How much is a PIPEDA fine?

A PIPEDA fine can reach $100,000 on indictment, or up to $10,000 on summary conviction, and only a court can impose it. It reaches only the five offences in section 28: knowingly destroying requested information, knowingly failing to report or log a breach, punishing a whistleblower, or obstructing the Commissioner. General mishandling carries no fine today, though Bill C-36 would add much larger ones.

Can the Privacy Commissioner fine a company under PIPEDA?

No, the Privacy Commissioner can't fine a company under the current law. The OPC investigates and makes recommendations, but only a court can impose a fine, and only for the section 28 offences. Bill C-36 would change this, letting a new Digital Safety and Data Protection Commission impose administrative penalties of up to the higher of $10 million or 3% of global revenue.

What is the penalty for a data breach under PIPEDA?

There's no automatic fine for suffering a breach. The offence is in the handling: a business that knows a breach meets the reporting threshold and still fails to report it, notify the people affected, or log it can be fined up to $100,000. The larger cost is usually the investigation and remediation that follow a mishandled breach.

What happened to Bill C-27 and the CPPA?

Bill C-27 and its Consumer Privacy Protection Act died when Parliament was prorogued in January 2025, so none of its proposed penalties took effect. Its successor, Bill C-36, was introduced in June 2026 and is now at second reading. PIPEDA stays in force, with its $100,000 maximum, until C-36 is passed and brought into force.

Is PIPEDA enforced by the Competition Bureau?

No, the Competition Bureau doesn't enforce PIPEDA. The Bureau handles competition and consumer-protection matters under the Competition Act, such as misleading advertising. The OPC enforces PIPEDA, so that's where a privacy complaint goes, with the Federal Court behind it for binding orders.

Has any company been penalized under PIPEDA?

Companies have paid damages ordered by the Federal Court, but never a regulatory fine, because the OPC can't levy one today. The court awarded $5,000 in Nammo v. TransUnion and $20,000 in Chitrakar v. Bell TV. Recent findings against OpenAI, X and xAI, and Google ended in commitments, not fines, with the Google matter now before the Federal Court. Bill C-36 would add monetary penalties.