CanadaDoes PIPEDA apply to my personal doctor or local business?
PIPEDA generally does not apply to your personal doctor’s medical practice or most local businesses unless they engage in commercial activities that involve collecting, using, or disclosing personal information across provincial or national borders — or if provincial health privacy law doesn’t apply.
What the Law Says
PIPEDA is Canada’s federal private-sector privacy law — but it doesn’t apply to everyone. Its reach depends on the nature of the activity, not just the type of organization.
PIPEDA applies only to organizations that collect, use, or disclose personal information in the course of 'commercial activities'. This means everyday medical care by your family doctor — which is typically a professional service regulated under provincial health legislation — usually falls outside PIPEDA’s scope.
Similarly, many local businesses (e.g., a corner store, hair salon, or independent contractor) are not subject to PIPEDA if their personal information handling is purely intraprovincial and governed by a substantially similar provincial privacy law — like Ontario’s Personal Health Information Protection Act (PHIPA) for health custodians, or Alberta’s Health Information Act.
However, PIPEDA *does* apply if a business engages in interprovincial or international commercial activity involving personal information — for example, an online retailer shipping across provinces or a clinic outsourcing medical transcription to another country.
Statutory TextPIPEDEA applies to organizations that collect, use or disclose personal information in the course of commercial activities.
— Personal Information Protection and Electronic Documents Act, s. 4 — Application
What to Do
Check whether your province has a 'substantially similar' health or privacy law (e.g., PHIPA in Ontario, HIA in Alberta, or BC’s EMA). If yes, it likely governs your doctor or local business instead of PIPEDA.
If the organization handles personal information across provincial or national borders (e.g., cloud storage in the U.S., billing through an out-of-province processor), PIPEDA may apply.
Ask your doctor or business how they protect your personal information — they should be able to tell you which law applies and how your data is safeguarded.
File a complaint with the Office of the Privacy Commissioner of Canada only if PIPEDA clearly applies and your concern isn’t resolved internally.
Sources
Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.