Updated Checked by the Tax-Services.ca editorial team How we check
Privacy law touches bookkeeping the moment you hold a name next to a dollar amount, and in most of Canada that means the federal PIPEDA. It covers private-sector organizations that collect, use or disclose personal information in the course of commercial activity. Alberta, British Columbia and Quebec have their own private-sector acts that are deemed substantially similar, so inside those provinces the provincial act usually takes over.
Your books are full of personal information. Customer names on invoices, employee SINs on payroll files, home addresses on expense claims, bank details for supplier payments. None of it is exotic. It’s just easy to forget that it counts.
Which privacy law applies to your books?
Start with where you operate and what you do. A bookkeeper working for a small Ontario business is normally under PIPEDA. One with clients in British Columbia, Alberta or Quebec has to look at the provincial act for activity that stays inside that province. Information that crosses a provincial or national border brings PIPEDA back in.
Health records are a separate matter. Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador have health-information laws that count as substantially similar, but that has little to do with ordinary bookkeeping. Bookkeepers for clinics should read the health rules on top of everything here.
And who is responsible, you or the client? Usually both, in different ways. The business that owns the customer relationship stays accountable for the data, even when a bookkeeper handles it. That’s why a written agreement with your bookkeeper, saying what they can do with the files and where they store them, is worth the ten minutes.
The ten principles, in bookkeeping terms
PIPEDA rests on ten fair information principles. They sound abstract until you attach them to a ledger.
| Principle | What it looks like in the books |
|---|---|
| Accountability | Someone named owns privacy, and you know who |
| Identifying purposes | You can say why you hold each piece of data (invoicing, payroll, tax filing) |
| Consent | Clients and staff know what you keep and why |
| Limiting collection | No SIN or birth date unless a form needs it |
| Limiting use, disclosure and retention | Data isn’t reused for marketing, and old files are deleted on a schedule |
| Accuracy | Addresses and account numbers are correct and updated |
| Safeguards | Passwords, access levels, encryption, locked cabinets |
| Openness | Your policy is written down and easy to find |
| Individual access | A person can ask what you hold about them |
| Challenging compliance | There’s a route for complaints |
What happens when a privacy law collides with tax record keeping?
This is the tension most people miss. Privacy law says don’t keep data longer than you need it. Tax law says keep it. The CRA’s rule is six years from the end of the last tax year the records relate to, unless it gives written permission to destroy them earlier. Corporate minutes, share records and general ledgers stay until two years after the corporation is dissolved.
So the sensible approach is to keep what the tax rules require, for as long as they require it, and delete the rest. A rejected job applicant’s file has no tax reason to survive. A payroll ledger does. The CRA also says records can be paper, electronic or both, but electronic ones must stay readable for the whole retention period. A backup nobody can open in year five doesn’t count.
What do you say when a client asks you to delete everything?
Take Marcus, a freelance photographer in Halifax who stops using his bookkeeper and writes, “Please erase all my files.” Fair request, and the answer is usually “some now, some later.” Marketing notes, spare copies of his ID and anything with no tax purpose can go. Invoices, ledgers and payroll records that support his returns have to stay for the tax retention period, and a short note saying so, with the date they’ll be destroyed, keeps everyone honest.
Put that in writing at the start of the job, in the engagement letter. Then nobody is surprised at the end.
What if you lose the data?
Under PIPEDA, if a breach of security safeguards creates a real risk of significant harm, you report it to the Privacy Commissioner and tell the people affected. The Commissioner’s page on mandatory reporting of breaches of security safeguards sets out the test. It looks at how sensitive the information is and how likely it is to be misused. A stolen laptop full of SINs and bank details is an obvious yes.
The record-keeping part surprises people. You have to log every breach, harmful or not, for 24 months after you decide it happened. A lost USB stick that turned out to be encrypted still goes in the log. The same page says it’s an offence to knowingly break the reporting, notification and record-keeping rules, though it doesn’t give a dollar amount.
A worked example with real payroll numbers
Take an Ontario employer paying one person $3,000 every two weeks. The payroll remittance calculator puts the amount held back from pay at $732.62 per period (income tax, CPP and EI), with $228.41 added by the employer, for $961.03 to remit each period. Every one of those figures rests on a person’s name, SIN and pay history sitting in your files.
Multiply that by twenty staff and you have a folder you can’t leave on a shared desktop. The payroll deductions calculator shows the same breakdown for a single employee, and it’s a useful thing to run with test numbers rather than a real person’s record when you’re checking a template.
Simple habits that cover most of the risk
Give each person access to only the ledgers they use. Turn on two-step sign-in for the accounting file and the bank. Send documents through a portal, not by email attachment. Delete scans of ID once the form is filed. Keep a one-page list of where personal data lives, so a request from a customer takes an hour instead of a week.
Check any cloud accounting product you use for where it stores data and who can see it. What a particular product actually does is something we couldn’t confirm, so ask the provider in writing.
Mistakes to watch for
Keeping everything forever is the common one. Emailing a spreadsheet with SINs to a personal account is the fastest. Also worth checking: do you charge sales tax correctly on services you sell? Privacy won’t save you from a wrong GST/HST calculation, and a tidy file with the wrong tax in it is still wrong.
Where the numbers come from
The retention periods come from the Canada Revenue Agency‘s guidance on keeping records and Information Circular IC78-10. The privacy principles, provincial coverage and breach rules come from the Office of the Privacy Commissioner of Canada. The payroll figures are a 2026 estimate from our calculator. Privacy law is changing at federal level, so recheck the Commissioner’s site before you rewrite a policy. This site isn’t affiliated with the CRA, the Commissioner or any government body, and none of it is legal advice.
Frequently asked questions
Does PIPEDA apply to a small bookkeeping business?
Yes, if it collects, uses or discloses personal information in the course of commercial activity. Alberta, British Columbia and Quebec have their own acts, which usually apply inside those provinces.
How long do I keep bookkeeping records?
The CRA's general rule is six years from the end of the last tax year the records relate to. Corporate minutes, share records and ledgers stay until two years after dissolution.
Do I have to report every data breach?
You report those that create a real risk of significant harm. You still record every breach for 24 months.
Can I keep records only in the cloud?
The CRA accepts electronic records, but they must stay readable through the retention period. Check where your provider stores the data.
Can a customer ask to see what I hold?
Yes. Individual access is one of the ten principles, so have a way to answer such a request.
- Self-employed taxes in Canada: income, CPP and GST
How tax works when you are self-employed in Canada: reporting income and expenses, paying both halves of CPP, instalments and when to register for GST