Updated Checked by the Tax-Services.ca editorial team How we check
If you run an accounting practice or a bookkeeping business in Canada, PIPEDA applies to the personal information you collect in the course of commercial activity. Comply by following its ten fair information principles, protecting what you hold, and reporting any breach that creates a real risk of significant harm. Client files full of SINs and bank details make you a target, so this isn’t paperwork for its own sake.
Does PIPEDA apply to your accounting business?
Almost certainly, with one wrinkle. The federal law covers private-sector organizations that collect, use or disclose personal information in commercial activity. But Alberta, British Columbia and Quebec have their own private-sector laws that the federal commissioner regards as substantially similar, and those generally apply to in-province activity instead.
So work out which law covers each part of your business, and don’t assume one rulebook. Dana runs a three-person bookkeeping shop in Kelowna. Most of her clients are in BC, so BC’s act is the main rulebook for them, but the one client in Saskatoon and the payroll files that cross provincial lines bring PIPEDA back in. The Office of the Privacy Commissioner of Canada (OPC) has guidance for businesses on its site. Use it, since this page only covers the outline.
What are the ten principles in plain words?
| Principle | What it means in a practice |
|---|---|
| Accountability | Someone named is responsible for privacy |
| Identifying purposes | Tell clients why you collect each item |
| Consent | Get it, and record it |
| Limiting collection | Ask only for what the job needs |
| Limiting use, disclosure and retention | Use it for that job, then dispose of it on schedule |
| Accuracy | Keep it correct and current |
| Safeguards | Protect it in proportion to how sensitive it is |
| Openness | Publish your policy in plain language |
| Individual access | Let clients see and correct their data |
| Challenging compliance | Have a way to take complaints |
How do you build this into a firm’s daily routine?
Start with an inventory. List what personal information you hold, where it lives (email, cloud storage, a laptop, paper), who can open it and how long you keep it. Most firms discover copies they forgot about.
Then tighten the obvious. Give each staff member access only to the clients they work on. Use multi-factor sign-in on your accounting and email accounts. Send documents through a portal instead of attaching them to plain email. Encrypt laptops and phones, which is cheap insurance against a stolen bag.
Write a short privacy policy a client could read in two minutes. Name the person who handles questions. Keep client onboarding forms honest about what you collect and why. And teach the team, because a firm’s weakest spot is usually a hurried person and a convincing email.
What must you do after a breach?
A breach means loss of, unauthorized access to, or unauthorized disclosure of personal information because safeguards failed. You must report to the Privacy Commissioner any breach where it’s reasonable to believe it creates a real risk of significant harm. You must also tell the affected people as soon as feasible. Harm includes identity theft, financial loss and damage to reputation.
Whether the risk is real turns on two things: how sensitive the information is, and how likely it is to be misused. Tax slips and bank details rank high on both.
One duty catches people out. You must keep a record of every breach, including the ones you decided didn’t need reporting, for 24 months after you found out about it. The record needs enough detail to show how you assessed the risk.
The law requires you to keep breach records of all breaches of security safeguards for two years.
Mandatory reporting of breaches of security safeguards, Office of the Privacy Commissioner of Canada, priv.gc.ca
The same page says it’s an offence to knowingly contravene the breach reporting, notification and record-keeping requirements, and that doing so could lead to fines. It doesn’t give an amount, so check the page for the current position.
Where do accounting practices slip up?
Keeping everything forever is the big one. It feels safe and it isn’t. Records have to be kept for as long as tax law requires (for CRA purposes generally six years from the end of the last tax year they relate to), but a file older than that is a liability you’re holding for nothing. Any longer period you keep files should be one you can explain.
Other slips are shared logins, personal email for client work and no plan for a lost device. Vendors matter as well. If a cloud bookkeeping tool holds your clients’ data, you remain accountable, so ask where it’s stored and what protection it has.
Payroll data is personal information too, and it’s the same for the businesses you serve. If you prepare remittances, the payroll remittance calculator is a handy way to show a client the numbers without sending files back and forth. A client’s return details work the same way. The self-employed tax calculator and the corporate tax calculator let you talk through estimates with no personal data typed in at all.
What should you do this week?
- Name one person as the privacy contact, even if that’s you.
- Write the one-page list of where client data lives.
- Turn on two-step sign-in for email and accounting.
- Start a breach log, even if it’s empty. A blank log with a date is better than none.
- Find out which client files are past their retention date and schedule their deletion.
Where we got these figures
The principles, the scope of the law, the breach report duty and the 24 month record rule come from the Office of the Privacy Commissioner of Canada. The six year tax record period is from Canada Revenue Agency. This isn’t legal advice, and nothing here replaces reading the OPC guidance for your own case. This site has no connection with the OPC, the CRA or any government body.
Frequently asked questions
Does PIPEDA apply to a small accounting firm?
Yes, if it collects personal information in the course of commercial activity. Alberta, British Columbia and Quebec have their own similar laws that generally cover in-province activity.
What are the PIPEDA principles?
There are ten: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access and challenging compliance.
When must I report a breach?
When it is reasonable to believe the breach creates a real risk of significant harm. You report to the Privacy Commissioner and notify the people affected as soon as feasible.
How long do I keep breach records?
For 24 months after you determine that the breach occurred, including breaches you judged did not need reporting.
How long do I keep client tax records?
For CRA purposes generally six years from the end of the last tax year they relate to. Dispose of them securely after that.
All family and benefits calculators
- Self-employed taxes in Canada: income, CPP and GST
How tax works when you are self-employed in Canada: reporting income and expenses, paying both halves of CPP, instalments and when to register for GST