Personal Information Protection and Electronic Documents Act (PIPEDA)

Authentic statutory obligations decomposed into atomic machine-actionable conditions, actions, and verification standards.

Official Legal Text

Criticalobligation98% AI Match

Principle 3: Meaningful Consent

The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate (Schedule 1, 4.3).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "no_deceptive_patterns": true,
  "express_consent_for_sensitive_data": true
}

Highobligation98% AI Match

Principle 2: Identifying Purposes

The purposes for which personal information is collected shall be identified by the organization at or before the time the information is collected (Schedule 1, 4.2).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "purpose_identified_at_collection": true
}

Criticalobligation98% AI Match

Principle 7: Safeguards

Personal information shall be protected by security safeguards appropriate to the sensitivity of the information (Schedule 1, 4.7).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "physical_organizational_technical_safeguards": true
}

Criticalobligation98% AI Match

Mandatory Breach Reporting to Privacy Commissioner of Canada

An organization must report to the Privacy Commissioner of Canada any breach of security safeguards involving personal information that poses a real risk of significant harm (PIPEDA Section 10.1).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "prompt_opc_notification": true,
  "rosh_assessment_framework": true
}

Highobligation98% AI Match

Principle 4: Limiting Collection

The collection of personal information shall be limited to that which is necessary for the purposes identified by the organization (Schedule 1, 4.4).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "data_collection_boundary_enforced": true
}

Criticalobligation98% AI Match

Principle 1: Accountability

An organization is responsible for personal information under its control and shall designate an individual or individuals who are accountable for compliance (Schedule 1, 4.1).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "published_contact_channel": true,
  "privacy_officer_designated": true
}