[Home](/)/[Resources](/resources)/Canada Privacy Law for Connected Devices

CanadaPrivacy & IoT

# Canada Privacy Law for Connected Devices: PIPEDA, Bill C-27, and IoT Obligations

Any connected device that collects data from Canadian users triggers PIPEDA — Canada's federal private-sector privacy law — regardless of where the company is based. With the CPPA reform under Bill C-27 on the horizon, the compliance bar is rising. This guide covers what hardware companies need to know: consent, data mapping, breach notification, and CPPA readiness.

Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Fcanada-privacy-law-connected-devices)

At a glance

Current law

PIPEDA

Incoming reform

Bill C-27 / CPPA

Regulator

OPC (Office of the Privacy Commissioner)

Breach notification

Mandatory under PIPEDA

## Canadian privacy law framework for IoT hardware

### PIPEDA and the 10 Fair Information Principles

The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's federal private-sector privacy law. It governs how organizations collect, use, and disclose personal information in the course of commercial activity. PIPEDA is built on 10 fair information principles drawn from the Canadian Standards Association Model Code: accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and challenging compliance. For connected device makers, every sensor reading, usage metric, location ping, and identifier that can be linked to an individual is personal information subject to these principles.

### Bill C-27 and the Consumer Privacy Protection Act (CPPA)

Bill C-27, introduced in 2022, proposes to replace PIPEDA's private-sector provisions with the Consumer Privacy Protection Act (CPPA). The CPPA introduces stronger rights (data portability, right to erasure, right to explanation for automated decisions), higher penalties (up to 5% of global revenue or CAD $25M), mandatory privacy impact assessments for high-risk processing, and a new data minimization standard. As of 2026, C-27 has not yet received Royal Assent, but its requirements are shaping best practice expectations. Hardware companies should design IoT data flows to meet CPPA requirements now rather than retrofitting later.

### Consent Obligations for Data-Collecting IoT Devices

Under PIPEDA, consent must be meaningful — individuals must understand what they are consenting to. For connected devices, this means the data collection purposes must be clearly disclosed at or before the point of collection, not buried in a terms-of-service document linked from a registration flow. Sensitive data categories (health information, precise location, biometric data) require express (opt-in) consent. Implied consent may be relied upon for less sensitive information where a reasonable person would expect the collection given the context. Consent must be re-obtained if a new use of data is materially different from what was originally disclosed.

### Breach of Security Safeguards Notification Requirements

PIPEDA's breach notification regulations (in force since November 2018) require organizations to: (1) notify the Office of the Privacy Commissioner of Canada (OPC) of any breach of security safeguards that creates a real risk of significant harm to an individual; (2) notify affected individuals directly; (3) notify other organizations when that notification could reduce harm. The risk-of-significant-harm threshold considers the sensitivity of the information, probability of misuse, and potential severity of harm. Records of all breaches (including those that do not meet the notification threshold) must be maintained and made available to the OPC on request.

## Privacy compliance process for connected device makers

01

Map all data collected by the connected device — both on-device (sensor readings, local logs, identifiers) and cloud-side (usage telemetry, account data, support interactions). Include data collected passively (ambient sensors, always-on microphones) and actively (user-entered information). This data inventory is the foundation of your privacy program.

02

Determine the consent model required for each data category. Express opt-in consent is required for sensitive data including health metrics, precise geolocation, and biometric identifiers. For less sensitive telemetry data, implied consent based on clear upfront disclosure may be adequate. Document your consent rationale for each category.

03

Prepare a publicly accessible privacy policy in English and French. The policy must describe: what data is collected, why, how long it is retained, who it is shared with (including cloud providers, analytics vendors, and affiliates), and how individuals can access, correct, or request deletion of their data. The OPC's Model Privacy Code and CPPA readiness guides provide useful drafting checklists.

04

Implement breach detection, internal assessment, and mandatory OPC notification procedures. Establish an internal threshold for what constitutes a real risk of significant harm, document your assessment process, and set a target notification timeline (PIPEDA does not specify a number of days, but the OPC expects notification as soon as feasible — treating 72 hours as a target aligns with international norms and anticipated CPPA requirements).

05

Prepare for CPPA/Bill C-27 requirements proactively. Implement privacy by design in device firmware and cloud architecture. Build in data minimization — collect only what is necessary for the stated purpose. Conduct Privacy Impact Assessments (PIAs) for high-risk processing activities. Establish a process for responding to data portability and erasure requests before they become legally mandatory.

## Frequently asked questions

### Does PIPEDA apply to hardware companies based outside Canada?

Yes. PIPEDA applies to any organization that collects, uses, or discloses personal information of Canadian individuals in the course of commercial activity — regardless of where the organization is headquartered. A US or Asian hardware company whose connected device is sold in Canada and collects data from Canadian users is subject to PIPEDA. The practical reach of the OPC's enforcement is broader than it may appear: Canadian users can file complaints with the OPC against foreign organizations, and the OPC has investigated and published findings against companies without a Canadian office. The incoming CPPA is expected to maintain and potentially strengthen this extraterritorial application.

### What counts as 'personal information' for a connected device?

Personal information under PIPEDA is any information about an identifiable individual. For connected devices, this is broad: device identifiers (MAC addresses, serial numbers linked to accounts), IP addresses, precise GPS coordinates, usage patterns that can be linked to a person, health or biometric sensor readings, voice recordings, and any data that — alone or in combination — can identify or reasonably identify a specific person. Aggregated or de-identified data that cannot be re-identified falls outside the definition, but de-identification must be robust — tokenization or pseudonymization alone is generally not sufficient to remove PIPEDA obligations if re-identification is reasonably possible.

### When must you notify the OPC of a data breach?

Under PIPEDA's breach of security safeguards regulations, you must notify the OPC as soon as feasible after determining that a breach of security safeguards has occurred and that it creates a real risk of significant harm to an individual. There is no prescribed number of days in the regulation, but the OPC expects prompt notification. PIPEDA requires simultaneous notification to affected individuals when the risk-of-significant-harm threshold is met. You must also maintain a record of all security breaches — even those that do not meet the notification threshold — and provide those records to the OPC on request. Failure to notify or maintain records can result in summary conviction and fines.

### How will Bill C-27 change IoT product obligations?

The Consumer Privacy Protection Act (CPPA) proposed under Bill C-27 would introduce several changes relevant to IoT hardware companies: mandatory privacy impact assessments before deploying high-risk data processing activities; a data minimization standard requiring that only information necessary for the stated purpose be collected; expanded individual rights including portability (exporting data in a machine-readable format), erasure (deleting data on request, subject to legal exceptions), and the right to an explanation of automated decisions that affect them. Penalties under the CPPA would be significantly higher than under PIPEDA — up to 5% of global annual revenue or CAD $25 million, whichever is greater. Companies should treat CPPA readiness as a near-term design constraint, not a distant regulatory risk.

**Disclaimer:** Educational resource only. Regulatory requirements change and vary by product category. Consult an accredited test laboratory or qualified compliance engineer before making certification decisions.

🇨🇦 Canada roadmap for your product

Every standard, document, and test that applies — free, no account required.

See your free roadmap[

Want an expert to take your product through 🇨🇦 Canada compliance for you?

One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts.

See compliance services](/services)

Learn this properly

In-depth course that teaches the full process, not just this one answer.

[Start the course — $149](/courses/47-canada-ised-ic-certification-radio-equipment)[Prefer to read? Get the book — $24.99](/books/47-canada-ised-ic-certification-radio-equipment)

Related guides

*   [Canada Compliance OverviewComplete guide to Canada product compliance: ISED radio certification, Health Canada devices, CFIA food, and provincial electr…](/guides/canada-compliance-overview)
*   [UAE Personal Data Protection Law (PDPL)UAE Federal Decree-Law No. 45 of 2021 (PDPL) for connected product makers: data collection obligations, cross-border transfers, and Arabic privacy notices.](/guides/uae-data-protection-pdpl)
*   [Hong Kong PDPOHong Kong PDPO Cap. 486 for connected hardware: the six Data Protection Principles, direct marketing restrictions, and cross-border transfer obligations.](/guides/hong-kong-data-privacy-pdpo)
*   [Australia Privacy Act for Connected DevicesAustralia Privacy Act 1988 for connected devices: the 13 APPs, NDB 30-day breach notification, and 2024 reform obligations for IoT product makers.](/guides/australia-privacy-act-connected-devices)
*   [Canada Bill C-27 (CPPA and AIDA)Bill C-27's Consumer Privacy Protection Act and Artificial Intelligence and Data Act for IoT and connected hardware makers: consent and de-identification rules, high-impact AI system duties, and what to put in place before Royal Assent.](/guides/canada-digital-privacy-bill-c27)