What Counts as Personal Information (and What Doesn't)

If you're running outreach for your business, you've probably paused mid-campaign and wondered: is this contact actually "personal information" under Canadian law? The line matters more than most people realize.

Under PIPEDA, the definition is broad. The Office of the Privacy Commissioner describes personal information as any factual or subjective information, recorded or not, about an identifiable individual. That covers obvious things like names, ID numbers, income, and medical or credit records — but also less obvious ones, such as opinions, employee files, and even intentions, like the intention to buy goods or change jobs.

So where does the protection stop? Not everything about a person triggers PIPEDA. The law carves out several clear exclusions, and knowing them changes how you can lawfully reach people:

• Business contact information — a name, title, business address, phone number, or work email collected solely to communicate about work is not treated as personal information.
• Information about organizations themselves, as opposed to the individuals inside them.
• Anonymized data that can no longer be linked back to an identifiable person.
• Details too far removed from any individual — a postal code on its own, for example.

The business contact exclusion is why B2B outreach has room to operate in Canada. Reaching a purchasing manager at their work email, about a work-relevant offer, sits outside the personal information definition entirely. But the moment you collect data beyond that — a prospect's personal mobile number, intent signals tied to them as an individual, or notes about them personally — you're back inside PIPEDA's territory, where consent, purpose limitation, and safeguards apply.

This is exactly where many lead generation programs get sloppy. A template blast to scraped lists treats every contact the same and ignores the line. A more careful approach keeps outreach permission-aware and relevant to the account being contacted. That's the standard Worqd applies to its own B2B outreach — personalized, permission-aware contact with relevant accounts rather than mass sends — and its booking process collects details only for the stated purpose of preparing for a call.

The distinction also matters because the rules are tightening. Proposed reforms under Bill C-36 would raise penalties to as much as CAD 25 million or 5% of global revenue for the most serious offences, and add deletion rights that don't exist under PIPEDA today. Providers whose data practices are already consent-first and minimal are better positioned for that future — and easier to trust with your pipeline today.

The 10 Fair Information Principles: Where Privacy Invasion Actually Happens

There's no vague gray zone here. In Canada's private sector, invasion of privacy has a concrete definition: it means violating one of the 10 fair information principles embedded in PIPEDA — Accountability, Identifying Purposes, Consent, Limiting Collection, Limiting Use/Disclosure/Retention, Accuracy, Safeguards, Openness, Individual Access, and Challenging Compliance.

While all ten matter, four of them account for most of the privacy invasions businesses actually commit. Here's what crossing each line looks like in practice.

Consent is where most violations start. Under PIPEDA, consent must be explicit, obtained directly from the individual, tied to a specific stated purpose, and written in plain language — "no legalese or technical jargon." As one compliance analysis puts it bluntly: "In short, no 'Accept All.'" Individuals can also withdraw consent at any time, and companies cannot obstruct that withdrawal. Crossing the line looks like pre-ticked boxes, bundled consent buried in terms of service, or making it easy to sign up but impossible to opt out.

Limiting collection means gathering only what you need for the stated purpose, and doing it "by fair and lawful means" — a standard explicitly intended to prevent manipulative tactics like dark patterns. A booking form that demands your date of birth, household income, and a phone number "for verification" when an email would do? That's an invasion, even if you technically clicked "submit."

Limiting use and disclosure means the data you collected for one purpose can't quietly be repurposed for another. Selling a customer list to a third party, or feeding inquiry details into an ad audience the person never agreed to join, violates this principle. PIPEDA's Section 5(3) caps purposes at what a reasonable person would find appropriate — a useful gut-check for any data practice.

Safeguards require protecting personal information against loss, theft, and unauthorized access. The stakes are real: PIPEDA mandates breach reporting wherever a breach creates a "real risk of significant harm," reported as soon as feasible. And the enforcement landscape is tightening — proposed reforms under Bill C-36 would raise penalties to as much as CAD 25 million or 5% of global revenue for the most serious offences.

When you're evaluating any provider that will touch your customer data, these four principles make a practical checklist:

• Does the provider collect explicit, purpose-specific consent — or rely on blanket "Accept All" mechanisms?
• Do their forms ask only for what the stated purpose requires?
• Is there a clear policy preventing collected data from being reused or disclosed beyond its original purpose?
• Are safeguards in place, such as keeping sensitive form fields out of public analytics tools?

Worqd's own data handling is built around these standards: its booking funnel requires explicit consent ("I agree to be contacted about my request") with details used only to prepare for the call, and its analytics policy keeps sensitive form fields out of public analytics. That's what staying on the right side of the principles looks like — not as a legal minimum, but as a baseline for trust. As the Office of the Privacy Commissioner notes, following these principles "will contribute to building trust in your business and in the digital economy."

Which Privacy Law Applies to Your Business

If you run a business in Canada, you might assume the privacy law that governs you depends entirely on where you're headquartered. In reality, the answer is more complicated — and for any company serving clients remotely, the federal law almost always applies.

Canada's private-sector privacy rules form a federal-provincial patchwork. Three provinces — Alberta, British Columbia, and Quebec — have their own private-sector laws deemed substantially similar to PIPEDA, which exempts organizations operating purely within those provinces. Four others, including Nova Scotia, have substantially similar health-information laws.

But there's a catch that catches many businesses off guard. According to the Office of the Privacy Commissioner of Canada, all businesses that handle personal information crossing provincial or national borders are subject to PIPEDA — regardless of which province they're based in. That includes virtually any business serving clients remotely, whether by email, phone, or online booking.

The OPC also cautions that more than one privacy law can apply at once — and if it does, you must comply with both. A company in Alberta serving customers in Ontario, for example, could face obligations under provincial law and PIPEDA simultaneously.

One obligation deserves special attention from anyone choosing a service provider: mandatory breach reporting. If a breach of security safeguards creates a "real risk of significant harm" to individuals, the organization must report it to the Privacy Commissioner and notify those affected as soon as feasible. When you share lead data, CRM contacts, or customer details with an outside partner, their breach-handling practices become part of your risk picture.

This patchwork is why compliance practices matter when evaluating any growth partner. Worqd, based in Halifax, Nova Scotia, serves clients remotely across the country — which means PIPEDA applies to its work by default. Its stated practices reflect that: the booking funnel requires explicit consent to be contacted, and details are used only to prepare for the call. When vetting a provider, it's worth asking which laws apply to them and how they handle a breach — because the answer shapes your own exposure.

The landscape is tightening, too. Proposed reforms under Bill C-36 would raise penalties to as much as CAD 25 million or 5% of global revenue for the most serious offences. Providers already aligned with PIPEDA's consent and minimization standards today are better positioned for whatever comes next.

The Rules Are Tightening: What Bill C-36 Means for You

If today's privacy enforcement feels like a stern warning letter, tomorrow's will feel like a courtroom verdict. Canada's privacy rules are shifting from recommendations to real penalties, and that changes the math for every business that collects personal information.

Right now, the Privacy Commissioner of Canada works as an ombudsperson — it investigates complaints, publishes findings, and makes recommendations, but it cannot issue binding orders or fines. Only the Federal Court can order corrective action and award damages, and current statutory penalties top out at $100,000 on indictment for a narrow set of offences, according to legal analysis of PIPEDA's enforcement model. Individuals hold just two statutory rights under the current law: access and correction.

Bill C-36, introduced in June 2026, would rewrite that model entirely. According to IAPP reporting on the proposed reforms, the bill would:

• Recognize privacy as a fundamental right in Canadian law
• Create a new Digital Safety and Data Protection Commission with binding enforcement powers
• Grant deletion rights, explicitly including AI-generated deepfakes
• Require privacy impact assessments and treat children's data as sensitive
• Mandate transparency for automated decision-making

The financial stakes jump dramatically. Proposed penalties reach up to CAD 10 million or 3% of global revenue for non-compliance, and up to CAD 25 million or 5% of global revenue for the most serious offences — a category that simply does not exist under today's law.

Privacy Commissioner Philippe Dufresne welcomed the direction, saying he was "pleased to see many of my recommendations reflected in the new Bill," including the stronger enforcement tools he has publicly requested. Industry reaction has been measured: IAPP's Canada country leader notes the new agency "completely re-writes the model of enforcement for privacy in the private sector," while predicting most organizations have already evolved their practices enough to comply with minor modifications.

That last point carries the practical lesson. The businesses best positioned for this tightening landscape are the ones already operating as if the stricter rules exist — collecting only what they need, getting explicit purpose-specific consent, and being transparent about how data moves. This is also worth remembering: the reform path has been bumpy, with two prior attempts (Bill C-11 and Bill C-27) failing before C-36 arrived, as IAPP's overview of Canada's reform efforts details. Nothing is guaranteed, but the direction is unmistakable.

When you evaluate any marketing or growth partner, their data practices are your compliance exposure. A provider that runs permission-aware outreach, asks for explicit consent before contacting you, limits how your details are used, and keeps sensitive form fields out of public analytics is building for the law that's coming — not just the one on the books today. That's the standard Worqd holds itself to, from its consent-first booking process to its minimization-focused analytics policy.

The safest path forward isn't scrambling to retrofit compliance after new penalties take effect. It's choosing providers whose consent and data-minimization practices are already there — so when the rules tighten, nothing about your funnel has to change.

How to Vet a Provider's Data Handling (and How Worqd Does It)

Knowing what PIPEDA forbids is only half the job. The other half is asking the right questions before you hand your customer data to any marketing or growth partner — and with proposed reforms threatening penalties of up to CAD 25 million or 5% of global revenue for the most serious offences, "we take privacy seriously" is no longer a good enough answer.

Here is a practical checklist, built directly from PIPEDA's fair information principles, that you can run against any provider:

• Explicit consent language. PIPEDA requires consent that is explicit, purpose-specific, and written in plain language — as one compliance guide puts it, "no 'Accept All.'" Look for a clear opt-in statement on every form, not a buried pre-checked box.
• Stated purpose limitation. The provider should tell you exactly what they will do with the details you submit — and nothing more. Collection must be limited to what is needed for the stated purpose.
• Permission-aware outreach. Business contact information used solely for work communication is not treated as personal information under PIPEDA, but that is not a license for template blasts. Ask how outreach lists are built and whether messages are personalized to relevant accounts.
• No sensitive form fields in public analytics. Names, emails, and inquiry details should never flow into third-party analytics tools. This maps to PIPEDA's safeguards and limiting-disclosure principles.
• Cross-border awareness. PIPEDA applies to any business handling personal information that crosses provincial or national borders, regardless of where the company is based. A remote-serving partner must know this.

Worqd's stated practices map cleanly onto this checklist. Its booking funnel requires explicit consent — "I agree to be contacted about my request" — and states that your details are used only to prepare for the call, which is purpose limitation in plain language. Its B2B outreach is described as personalized, permission-aware outreach to relevant accounts — the opposite of a template blast — and its analytics policy keeps sensitive form fields out of public analytics entirely.

That alignment matters more every year. Two federal reform attempts have already failed, and industry observers expect the landscape to keep tightening, with deletion rights, privacy impact assessments, and transparency rules for automated decision-making on the table. A provider whose consent and minimization habits are already baked in — rather than bolted on — is simply a safer bet.

The simplest test is still the first one on the list: watch how a company asks for your information before it earns your business. If the consent is clear, the purpose is narrow, and the outreach is respectful, you are looking at a partner that understands where the legal line sits.

Ready to work with a growth partner that treats your data — and your customers' data — with that level of care? Book a Growth Call and see what more demand, faster follow-up, and better creative look like when compliance comes first.