The Privacy Act (Canada): Federal Public-Sector Privacy Law

The Privacy Act, RSC 1985, c P-21, is the federal law that governs how Government of Canada institutions collect, use, disclose, and protect your personal information, and it is a completely different statute from PIPEDA, which governs the private sector.

What the Privacy Act actually covers

The Privacy Act, RSC 1985, c P-21, sets out the rules for how the federal government itself handles personal information. It gives Canadians and permanent residents (and, for the access provisions, foreign nationals physically present in Canada) rights over information that federal institutions hold about them, and it places obligations on those institutions for collection, retention, use, disclosure, and disposal.

The Act came into force in 1983, alongside the Access to Information Act. It has not been substantially rewritten since, and both the Office of the Privacy Commissioner (OPC) and the Treasury Board of Canada Secretariat have publicly described it as out of step with a digital government that routinely shares data between departments and with outside partners.

Privacy Act vs. PIPEDA: the distinction that matters most

The single most important thing to understand about the Privacy Act is what it does not cover. It has no authority over a bank, an airline, a retailer, an employer, or any other private business. That is the job of the Personal Information Protection and Electronic Documents Act (PIPEDA), SC 2000, c 5, which governs the collection, use, and disclosure of personal information by private-sector organizations in the course of commercial activity.

People who search for "the Privacy Act" are frequently trying to understand a problem with a company, in which case PIPEDA (or a substantially similar provincial law in Quebec, Alberta, or British Columbia) is almost always the relevant statute, not this one. For a full breakdown of the private-sector rules, see PIPEDA Explained.

Both statutes are overseen by the same official, the Privacy Commissioner of Canada, which adds to the confusion. But the Commissioner wears two different hats depending on which Act is engaged, and the rules that apply are not interchangeable.

Which institutions are covered

The Privacy Act applies to the federal government institutions listed in the schedule to the Act. This includes federal departments and ministries of state, most federal agencies, and a large number of Crown corporations and other bodies added to the schedule over time. Institutions have to publish an annual index called Info Source describing the personal information banks they maintain, which is the practical starting point for figuring out which department to contact.

The Act does not apply to:

• Private businesses and individuals (PIPEDA's territory, or a provincial private-sector law)
• Provincial and municipal governments (each province has its own public-sector privacy statute)
• Courts, and, with narrow exceptions, Parliament and its officers
• Political parties

If you are trying to reach a provincial government body, such as a hospital network or a provincial licensing agency, you need that province's own access-and-privacy law, not the federal Privacy Act.

The rules on collecting your information

Section 4 of the Act restricts a federal institution to collecting only personal information that relates directly to an operating program or activity of that institution. A department cannot gather personal data simply because it might be useful someday; there has to be a direct connection to something the department is actually running, such as processing a benefit application or administering a regulatory scheme.

Wherever reasonably possible, the institution must collect the information directly from the individual it concerns, and it must inform that person of the purpose for which the information is being collected, unless an exception applies (for example, where doing so could compromise the accuracy of the information or interfere with a lawful investigation).

Use and disclosure: the section 8(2) exceptions

As a default rule, a federal institution cannot use or disclose your personal information for any purpose other than the one for which it was collected, or a use consistent with that purpose, without your consent. Section 8(2) then lists a defined set of exceptions where disclosure without consent is permitted, including (among others):

• Disclosure for the purpose it was originally obtained or a consistent use
• Disclosure required by an Act of Parliament or its regulations
• Disclosure to comply with a subpoena, warrant, or court order
• Disclosure to a government investigative body for law enforcement purposes
• Disclosure under an information-sharing agreement with a provincial government, another country, or an international organization
• Disclosure to a Member of Parliament to assist the individual in resolving a problem
• Disclosure for research or statistical purposes, subject to safeguards
• Disclosure to the National Archives (Library and Archives Canada) for archival purposes
• Disclosure where the public interest in disclosure clearly outweighs any invasion of privacy that could result

This exception list is deliberately narrow and specific. A government institution cannot rely on a vague "business need" the way section 8(2) is sometimes assumed to work; it has to fit one of the enumerated grounds.

Your right of access to your own information

Any Canadian citizen or permanent resident, and any other individual present in Canada, can request access to the personal information a federal institution holds about them. This is separate from, and works differently than, a general Access to Information Act (ATIA) request.

Privacy Act request vs. Access to Information Act request:

To make a Privacy Act request, you identify the federal institution likely to hold the information (Info Source is the directory), complete a Personal Information Request form or written request confirming your identity, and send it to that institution's Access to Information and Privacy (ATIP) coordinator. There is no fee. The institution must respond within 30 days of receiving a proper request, though it can extend that deadline in defined circumstances, such as a large volume of records or the need to consult another institution.

Requesting a correction

If you believe information the government holds about you is inaccurate, incomplete, or out of date, you can ask the institution to correct it. If the institution declines to make the correction you asked for, you are entitled to have a notation of the requested correction attached to the record, so your version of events travels with the file even if the institution disagrees.

Personal information banks

Federal institutions are required to describe, in the government's annual Info Source publication, the collections of personal information they maintain that are organized and retrievable by a person's name or an identifying number, called personal information banks. Each entry describes the type of information held, the purpose, and how to request access. Info Source is the practical tool for figuring out where to direct a request before you file it.

Oversight: the Privacy Commissioner of Canada

The Privacy Commissioner of Canada, an independent Agent of Parliament, investigates complaints that a federal institution has mishandled personal information, whether that is an improper collection, an unauthorized disclosure, a failure to safeguard information, or a refusal to grant access or make a correction. The OPC's usual practice is to encourage the complainant to raise the issue with the institution's own ATIP office first, then to investigate and issue findings and recommendations if the matter is not resolved.

Unlike some newer regulators, the Privacy Commissioner cannot issue binding compliance orders or impose monetary penalties under the Privacy Act. The Commissioner's core power is investigation and public reporting. For access refusals specifically, the Act provides a real backstop: under section 41, an individual who was refused access can apply to the Federal Court for a review after the Commissioner's investigation is reported, and under section 42, the Commissioner can also apply to the Federal Court, with the complainant's consent, or appear in a section 41 proceeding. The Federal Court's decision on these applications is binding.

Is the Privacy Act being modernized?

The Privacy Act has not been substantially rewritten since 1983, and both the OPC and the Treasury Board of Canada Secretariat have said publicly that it needs updating for a digital government era of shared services and cross-department data flows. The Treasury Board Secretariat launched a public consultation on modernization policy approaches in 2026, and the OPC has published its own priority recommendations for reform, including a clearer necessity-and-proportionality test for collection, mandatory privacy impact assessments for high-risk initiatives, and binding order-making power for the Commissioner.

As of this writing, these are proposals and consultations, not enacted law. The current Privacy Act, in its 1983 form (as amended), remains fully in force. Do not assume a new public-sector privacy regime has replaced it; check for a bill's actual passage before treating any reform proposal as current law.

How this connects to recording and surveillance law

The Privacy Act governs how the federal government handles information it already holds about you. It is a different question from whether you can lawfully record a conversation you are part of, which in Canada is governed by the one-party-consent rule in the Criminal Code, not the Privacy Act. See Canada Recording Laws for the full rule and its Supreme Court foundation.

If your question is instead about a private business, an employer, or a retailer handling your data, start with PIPEDA Explained. If you are dealing with a Quebec-based organization, Quebec's own private-sector law is stricter than PIPEDA on several points; see Quebec Law 25 Explained.

Disclaimer: This article provides general legal information about Canadian federal privacy law and is not legal advice. Laws and reform proposals change; confirm current requirements with the Office of the Privacy Commissioner of Canada or a qualified lawyer before acting on specific facts.

Frequently Asked Questions

Does the Privacy Act apply to private companies?

No. The Privacy Act only applies to federal government institutions. Private-sector companies operating in Canada are governed by PIPEDA, or by a substantially similar provincial law in Quebec, Alberta, or British Columbia.

How do I request my personal information from the federal government?

Identify the federal institution likely to hold the information using Info Source, then submit a Personal Information Request confirming your identity to that institution's Access to Information and Privacy coordinator. There is no fee, and the institution must respond within 30 days, subject to limited extensions.

What is the difference between a Privacy Act request and an Access to Information Act request?

A Privacy Act request is limited to your own personal information and is free. An Access to Information Act request can seek any federal government record regardless of subject, is open to any person or corporation present in Canada, and carries a nominal application fee.

Can the Privacy Commissioner order a federal institution to comply?

Not directly. The Commissioner investigates complaints and issues findings and recommendations but cannot impose binding orders or fines under the Privacy Act. For access refusals, the complainant or the Commissioner can apply to the Federal Court, whose decision is binding.

Is the Privacy Act being replaced?

Not yet. The federal government opened a public consultation on modernizing the Privacy Act, and the Privacy Commissioner has published reform recommendations, but no replacement statute has been passed. The 1983 Act, as amended, remains in force.

What is a personal information bank?

It is a collection of personal information that a federal institution organizes and retrieves by a person's name or an identifying number. Institutions must describe their personal information banks in the annual Info Source publication, which is the starting point for locating where to send an access request.