Governance, risk & compliance

Canada Privacy Act (federal institutions) RSC 1985, c P-21 (current to 30 Sep 2026; amended 2 Jun 2025)

Read 24 Oct 2026.

The Privacy Act, R. S.

C. 1985, c.

P-21, was read in the Justice Laws consolidation, current to 30 September 2026 and last amended on 2 June 2025. It covers government institutions listed in the Schedule (departments, agencies and many Crown corporations).

It is separate from PIPEDA, which covers private-sector commercial activity. Duties: no collection unless it relates directly to an operating program or activity (s.

4); collect directly from the individual wherever possible and tell the person the purpose (s. 5); retain information used for an administrative purpose for the prescribed period, keep it as accurate, up to date and complete as possible, and dispose of it as the regulations direct (s.

6); use only for the purpose collected, a consistent use or with consent (s. 7); disclose only with consent or on a ground in s.

8(2); keep a record of uses and disclosures not in the published statement (s. 9); include personal information in personal information banks (s.

10) and publish an index at least yearly (s. 11); individuals can have access and correction (s.

12). The Privacy Commissioner receives and investigates complaints (s.

29), may audit compliance with ss. 4 to 8 (s.

37), and reports findings and recommendations to the head (s. 35); the Act gives no order-making power.

The Federal Court reviews refusals of access (s. 41), not breaches.

The only offence is obstructing the Commissioner, with a fine of up to $1,000 (s. 68).

The Act itself has no breach notification duty: federal institutions report material privacy breaches to the Treasury Board of Canada Secretariat and the Office of the Privacy Commissioner under the Treasury Board Policy on Privacy Protection (OPC page read; the policy text itself was not read). Not read: the Treasury Board privacy impact assessment directive and the Policy on Privacy Protection.

Private-sector note: contractors that handle a federal institution’s personal information are bound through their contract and the institution’s policies; their own commercial activity is under PIPEDA. General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Canada Privacy Act (federal institutions) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Canada Privacy Act (federal institutions) compliance

Most of Canada Privacy Act (federal institutions) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Canada Privacy Act (federal institutions), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Canada Privacy Act (federal institutions) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Canada Privacy Act (federal institutions) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.