Data Protection Officer Foundation (Canada): free course

How it works

1. Work through the six modules below, at your own pace. There is no sign-up.
2. When you are ready, take the exam: 20 multiple-choice questions, drawn at random from a larger bank, with no time limit.
3. Pass with 16 or more correct and your certificate is issued straight away, with a unique number. Employers can confirm it on our certificate check page.

If you do not pass, you can review the modules and try again after a short wait.

Contents

1. The privacy officer role in Canada
2. Which law applies?
3. PIPEDA’s ten fair information principles
4. Quebec’s Law 25
5. Breaches, safeguards and third parties
6. Running a privacy programme, and what is changing

Module 1: The privacy officer role in Canada

Canadian law does not use the European title “Data Protection Officer”. It asks for someone to be accountable instead.

• PIPEDA, the federal private-sector law, says an organisation is responsible for the personal information under its control and must designate one or more individuals who are accountable for its compliance. Their identity must be available on request.
• Quebec’s Law 25 goes further. The person with the highest authority in the business, usually the chief executive, is the person in charge of the protection of personal information by default. They can delegate the role in writing, in whole or in part, and the title and contact details of the person in charge must be published on the organisation’s website, or made known by other appropriate means if there is no website.

Whatever the title, the job is broadly the same: know what personal information the organisation holds and why, make sure there are policies and controls that match the law, handle access requests and complaints, lead the response to privacy incidents, advise on new projects, train staff, and report to senior management.

Accountability stays with the organisation. Designating a privacy officer does not transfer legal responsibility to that person, and an organisation remains accountable for personal information it hands to a service provider for processing.

Module 2: Which law applies?

Canada has a patchwork of privacy laws. The first job of a privacy officer is to work out which ones apply.

Private sector

• PIPEDA (the Personal Information Protection and Electronic Documents Act) applies to personal information collected, used or disclosed in the course of commercial activity, and to the employee information of federally regulated businesses such as banks, airlines and telecoms companies. It also applies when personal information crosses provincial or national borders in commercial activity.
• Alberta, British Columbia and Quebec have their own private-sector laws that the federal government has recognised as substantially similar. Where one of those applies, it generally replaces PIPEDA for activity inside that province.

Health information

Several provinces have health-specific laws, for example Ontario’s Personal Health Information Protection Act (PHIPA). Health custodians in those provinces follow the health law, which can sit alongside or in place of PIPEDA.

Public sector

Federal government institutions follow the Privacy Act. Provincial and municipal bodies follow their own provincial access and privacy laws. PIPEDA does not cover them.

Who oversees what

The Office of the Privacy Commissioner of Canada (OPC) oversees PIPEDA and the Privacy Act. Provinces have their own commissioners, and in Quebec the regulator is the Commission d’accès à l’information (CAI). Under PIPEDA the OPC investigates complaints and makes recommendations but cannot fine. A complainant, or the Commissioner, can take certain matters to the Federal Court.

What counts as personal information

Under PIPEDA, personal information is information about an identifiable individual. That is broader than names and contact details: it includes opinions, evaluations, identification numbers, purchase history and online identifiers where they can be linked to a person. Business contact information used to communicate with someone about their job is generally outside PIPEDA.

Module 3: PIPEDA’s ten fair information principles

Schedule 1 of PIPEDA sets out ten principles. They are the backbone of most Canadian privacy programmes.

1. Accountability. The organisation is responsible for personal information under its control and designates someone accountable for compliance.
2. Identifying purposes. Purposes are identified at or before the time of collection.
3. Consent. The knowledge and consent of the individual are required, except where the law allows otherwise. Consent must be meaningful: people should understand what they are agreeing to. The form of consent, express or implied, depends on the sensitivity of the information and the person’s reasonable expectations.
4. Limiting collection. Collect only what is necessary for the identified purposes, by fair and lawful means.
5. Limiting use, disclosure and retention. Use or disclose information only for the purposes it was collected for, unless the person consents or the law requires it, and keep it only as long as needed.
6. Accuracy. Keep information as accurate, complete and up to date as its purpose requires.
7. Safeguards. Protect information with security safeguards appropriate to its sensitivity: physical, organisational and technological.
8. Openness. Make information about policies and practices readily available.
9. Individual access. On request, tell people about the existence, use and disclosure of their information and give them access to it. They can challenge its accuracy and have it amended. Organisations must generally respond within 30 days, which can be extended in limited circumstances.
10. Challenging compliance. People can complain to the designated individual, and organisations need a simple, accessible complaint procedure.

Alongside the principles, PIPEDA limits purposes to those a reasonable person would consider appropriate in the circumstances. Even with consent, some purposes are off-limits.

Module 4: Quebec’s Law 25

Law 25 modernised Quebec’s private-sector privacy law in three phases, from September 2022 to September 2024. It applies to enterprises carrying on business in Quebec, and in practice it reaches many organisations outside the province that deal with people in Quebec. Its main obligations:

• Person in charge. The highest authority is the person in charge by default, may delegate in writing, and their title and contact details are published.
• Governance policies. Policies on retention and destruction, staff roles and responsibilities, and complaint handling, with plain-language information about them published on the website.
• Privacy impact assessments. Required for any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information, and before communicating personal information outside Quebec. Information may leave Quebec only if the assessment shows it would receive adequate protection.
• Consent. Consent must be manifest, free and enlightened, given for specific purposes, and requested separately for each purpose. Sensitive information needs express consent. For a minor under 14, consent comes from the person having parental authority or the tutor.
• Privacy by default. Technology products and services offered to the public must have the highest level of confidentiality as the default setting. This does not apply to cookies.
• Automated decisions. A person must be told when a decision about them is based exclusively on automated processing, and can ask about the information and reasons behind it and have it reviewed by a person.
• Rights. Access, correction, de-indexing and cessation of dissemination, and since September 2024, data portability in a structured, commonly used technological format.
• Confidentiality incidents. Covered in Module 5.

Penalties. The CAI can impose administrative monetary penalties of up to $10 million or 2% of worldwide turnover, whichever is greater. Penal fines reach $25 million or 4% of worldwide turnover. Individuals can also sue, and courts must award punitive damages of at least $1,000 where an infringement is intentional or results from gross fault.

Module 5: Breaches, safeguards and third parties

PIPEDA breach reporting

Since November 2018, an organisation that experiences a breach of security safeguards involving personal information under its control must:

• report it to the OPC as soon as feasible, if it is reasonable to believe the breach creates a real risk of significant harm to an individual;
• notify the affected individuals in the same circumstances, as soon as feasible;
• notify other organisations, such as the police or a card issuer, if they may be able to reduce the risk of harm; and
• keep a record of every breach, whether reportable or not, for at least 24 months, and provide it to the OPC on request.

“Significant harm” includes bodily harm, humiliation, damage to reputation or relationships, financial loss, identity theft, and negative effects on a person’s credit record. Whether the risk is “real” depends on the sensitivity of the information and the probability that it will be misused. Knowingly failing to report, notify or keep records is an offence, with fines of up to $100,000.

Quebec confidentiality incidents

Law 25 calls a breach a confidentiality incident. A business must act promptly to reduce the risk of injury and stop it happening again. If the incident presents a risk of serious injury, it must notify the CAI and the affected people promptly. Every incident goes in a register, which the CAI can ask to see.

Other regimes

Alberta’s private-sector law has its own breach-reporting duty to the Alberta Commissioner. Health and public-sector laws often have their own rules too. In a cross-border incident, a privacy officer may need to report to more than one regulator, on different tests.

Safeguards

Safeguards must match the sensitivity of the information. In practice that means access controls and least privilege, multi-factor authentication, encryption, logging, staff training, secure disposal, and testing that the controls work. Most breaches involve people and processes as much as technology.

Service providers and transfers outside Canada

Under PIPEDA, transferring personal information to a service provider for processing is a use, not a disclosure. The organisation remains accountable and must use contracts or other means to ensure a comparable level of protection. Transfers outside Canada are allowed, but people should be told their information may be processed in another country and may be accessible to that country’s authorities. Quebec requires a privacy impact assessment and a written agreement before personal information leaves the province.

Module 6: Running a privacy programme, and what is changing

A practical programme

The OPC and provincial commissioners expect organisations to be able to show a privacy management programme, not just a policy. The core building blocks:

• senior management support and a designated, resourced privacy officer;
• an inventory of the personal information held, why, where, and for how long;
• policies on collection, consent, retention, access requests, complaints and breaches;
• privacy impact assessments for new projects and systems, including AI;
• contracts and due diligence for service providers;
• training, with refreshers;
• a breach response plan that has been tested; and
• regular review, with reporting to the board or senior management.

Artificial intelligence

Existing privacy law already applies to AI. Personal information used to train or run an AI system must be collected and used for appropriate purposes, with valid consent or a lawful exception, and with appropriate safeguards. Law 25’s automated-decision transparency rules apply in Quebec today. Staff pasting personal information into public AI tools is now a common source of privacy incidents, so acceptable-use rules and training matter.

Federal reform: Bill C-36

On 15 June 2026 the federal government introduced Bill C-36, which would replace PIPEDA’s privacy rules with a new Protecting Privacy and Consumer Data Act. As introduced, it would:

• require a documented privacy management programme;
• tighten consent, with a narrow legitimate-interest exception;
• give people a right to have their information disposed of, and a data mobility right;
• move oversight to a new Digital Safety and Data Protection Commission, with order-making powers; and
• introduce administrative monetary penalties of up to $10 million or 3% of global revenue.

It is a bill, not law. It was awaiting second reading in the House of Commons when this course was last checked, and it may change before it passes, if it does. Its predecessors, Bills C-11 and C-27, both died on the order paper. Until anything changes, PIPEDA applies.

Ready for the exam?

Twenty questions, 80% to pass, no time limit. Your certificate shows your name, the course and the date, and anyone with its number can confirm it on this site.

Take the exam →

This is a free foundation course and certificate of completion from Canada Cyber-Safe. It is not an accredited professional qualification and it is not legal advice. Course content checked on 19 October 2026 against PIPEDA and its Breach of Security Safeguards Regulations, Quebec’s Act respecting the protection of personal information in the private sector as amended by Law 25, and Parliament’s record for Bill C-36.