Updated Checked by the Tax-Services.ca editorial team How we check
Data privacy laws affect Canadian accounting in one plain way: client files are personal information, so you have to protect them, use them only for the job, and report a serious breach. Federally that’s PIPEDA. Quebec, British Columbia and Alberta have their own private-sector laws that the federal privacy commissioner calls substantially similar.
Which privacy law applies to an accounting practice?
PIPEDA covers private-sector organizations that handle personal information in the course of commercial activity, and a tax or bookkeeping practice does exactly that. In Quebec, British Columbia and Alberta the provincial law generally replaces it for activity inside the province, but information that crosses a border can still bring PIPEDA back in.
The details of each provincial law go beyond this page, especially Quebec’s, which has its own incident rules. If you serve clients there, read the Commission d’accès à l’information’s material directly.
What does the law ask of you day to day?
PIPEDA rests on ten principles. Here they are in office terms.
| Principle | In an accounting office |
|---|---|
| Accountability | Someone is named as responsible |
| Identifying purposes | Tell clients why you collect each item |
| Consent | Get it for the use you describe |
| Limiting collection | Ask for what the file needs |
| Limiting use, disclosure, retention | Don’t reuse or keep data without a reason |
| Accuracy | Fix errors when you learn of them |
| Safeguards | Passwords, access limits, encryption, locked paper |
| Openness | Publish your policy in plain words |
| Individual access | Clients can ask to see their information |
| Challenging compliance | Have a way to take a complaint |
Most small offices already do half of this without calling it privacy. The gaps tend to be the written parts: who’s the named person, what the policy says, and what happens when a client asks for a copy of their file.
How do privacy rules fit with keeping records for the CRA?
They pull in two directions, and that’s where practices trip. The CRA expects a business to keep its records for six years from the end of the last tax year they relate to. PIPEDA’s principle on limiting retention says don’t hold personal information longer than you need it.
The way through is simple. Keep what the CRA rule and your client’s file require, for that period, and then dispose of it in a controlled way. Don’t keep old scans of driver’s licences in an inbox “just in case”.
What happens if client data leaks?
You have to report a breach of security safeguards to the Office of the Privacy Commissioner when it’s reasonable to believe it creates a real risk of significant harm. You also have to tell the people affected, as soon as feasible after you’ve decided that’s what happened. And you must keep records of every breach for two years, including the ones you didn’t report. The commissioner’s guidance on mandatory breach reporting spells out each step.
Knowingly ignoring the reporting, notification or record-keeping duties is an offence under PIPEDA and could lead to fines. A stolen laptop with unencrypted returns on it is the standard example. A misdirected email with a T4 attached is a smaller version.
What does a small breach look like in practice?
Say a bookkeeper in Winnipeg emails a T4 and a bank statement to the wrong client with a similar name. Nothing was hacked, and it took one wrong click. The office still has three jobs: work out whether the information could cause real harm (a bank statement and a social insurance number usually could), ask the recipient to delete it, and write the incident into the breach record with the reasoning.
If the answer to the harm question is no, the entry still goes in the record, along with a short note on why. That’s the part people skip, and it’s the one the law asks you to keep for two years.
Where does payroll and tax software come in?
It’s where most of the personal information sits. Payroll files hold social insurance numbers, addresses, bank details and pay. The payroll deductions calculator and the payroll remittance calculator on this site run in your browser, so you don’t need to enter a real employee’s name. Test with round numbers.
The same habit works for return work. Use the income tax calculator for a quick estimate with made-up figures, and keep real client data inside your practice software.
Mistakes practices make
Sending returns by ordinary email, especially at tax time when the volume spikes. Sharing one login among staff. Keeping a client’s file on a personal phone. Skipping the breach record because “nothing came of it”. Each is avoidable with a written rule and a ten-minute huddle over coffee.
Should you hire a lawyer to write your privacy policy? Only if you handle unusual data or work across several provinces. For a small office, the privacy commissioner’s own guidance is a fair place to start.
This site isn’t a law firm, and nothing here is legal advice on your situation.
Sources, and how they were checked
The principles, the breach reporting duty, the two-year breach record and the offence provision come from the Office of the Privacy Commissioner of Canada. The six year retention rule comes from the Canada Revenue Agency. No single official page lists every coming change to privacy law, so check both bodies for updates. This site is independent and has no tie to either one.
Frequently asked questions
Does PIPEDA apply to accountants?
It applies to private-sector organizations handling personal information in commercial activity, which includes an accounting or bookkeeping practice, unless a substantially similar provincial law applies.
Which provinces have their own private-sector privacy law?
The privacy commissioner names Quebec, British Columbia and Alberta as having laws that are substantially similar to PIPEDA.
When must a breach be reported?
When it is reasonable to believe it creates a real risk of significant harm. Report to the Privacy Commissioner and notify affected people as soon as feasible.
How long do I keep breach records?
Two years, for every breach of security safeguards, including ones you did not report.
Does the CRA six year rule conflict with privacy limits?
Keep records for the CRA period, then dispose of them in a controlled way. Do not hold personal information longer than you need it.
All family and benefits calculators
- Self-employed taxes in Canada: income, CPP and GST
How tax works when you are self-employed in Canada: reporting income and expenses, paying both halves of CPP, instalments and when to register for GST