Skip to content
WP Doctor™
Book a call Emergency

Canadian compliance

PIPEDA compliance for your WordPress site

WP Doctor™ maps each PIPEDA obligation to the place it shows up on a WordPress site: a form, a plugin, a script or a database table.

Not legal advice. This page is technical information about how a WordPress site handles personal information. It is not a legal opinion. For your own obligations, consult a Canadian privacy lawyer.

[WPDOCTOR_LEGAL_REVIEW_COMPLIANCE]

What PIPEDA is and whether it applies to you

PIPEDA is the federal Personal Information Protection and Electronic Documents Act. Part 1 applies to every organization that collects, uses or discloses personal information in the course of commercial activities. Personal information means information about an identifiable individual. A WordPress site with a contact form, a store, a comment field or analytics collects it.

Alberta, British Columbia and Québec have private-sector laws declared substantially similar. Inside those provinces the provincial law generally governs. PIPEDA still applies to federal works and to personal information that crosses provincial or national borders. Québec's rules are on the Law 25 page.

A 2026 amendment adding data-mobility provisions (sections 10.4 to 10.6, enacted by S.C. 2026, c. 3) is on the books but not in force; it needs a commencement order and sector regulations before it operates. A replacement statute, Bill C-36 (the Protecting Privacy and Consumer Data Act), was introduced in June 2026 and is before the House of Commons. It is not law.

The ten fair information principles, translated to a website

Schedule 1 sets out ten principles: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance. On a website, each one maps to something that can be inspected: a named contact, a form field, a script tag, a database table or a deletion routine.

Three examples:

  • Accountability. Clause 4.1.3 keeps the organization responsible for information transferred to a third party for processing. On WordPress that means the host, the email platform, the SMTP relay and the off-site backup store.
  • Limiting collection. Every form field needs a purpose. A required phone number on a newsletter form is a finding.
  • Individual access. An organization has thirty days to respond to an access request. WordPress core's Export Personal Data tool covers only data that core and cooperating plugins register. Many form plugins keep entries in their own tables.

What your privacy policy must actually say

Clause 4.8.2 lists what must be made available: the name or title and address of the person accountable for privacy, how to gain access to personal information, a description of the type of information held and its use, and what is shared with related organizations. A generated template rarely matches the site it sits on.

The policy has to describe the site as it runs: forms, analytics, advertising pixels, video and map embeds, spam filtering, hosted fonts, the payment gateway and the email platform. The test is mechanical. Load the site with the browser's network panel open and list every third-party host that receives a request. If the policy names three services and the panel shows nine, the policy is inaccurate.

Consent: express vs implied, and where forms get it wrong

PIPEDA permits both forms. Clause 4.3.6 says an organization should generally seek express consent when information is likely to be considered sensitive, and that implied consent is generally appropriate when it is less sensitive. Section 6.1 adds a validity test: the person must reasonably be expected to understand the nature, purpose and consequences.

WordPress forms and banners fail in three recurring ways.

  1. Bundling. Under clause 4.3.3, consent to collection beyond what a service requires cannot be a condition of supplying it. A contact form that will not submit unless the marketing box is ticked is the standard example.
  2. Scripts that fire before any choice. A cookie banner can display a notice while gtag.js and the Meta Pixel have already loaded. Whether implied consent covers a given tracker is a legal question. Which scripts fire before a choice is measurable.
  3. No way back. Clause 4.3.8 lets an individual withdraw consent, subject to reasonable notice. A banner that cannot be reopened offers no withdrawal.

Commercial email consent is a separate regime, covered under CASL.

Retention — the obligation nobody implements

Clause 4.5.3 says personal information no longer required for its identified purposes should be destroyed, erased or made anonymous, and that organizations shall develop guidelines and procedures governing destruction. Clause 4.5.2 says retention guidelines should include minimum and maximum periods. WordPress has no retention setting. Nothing expires unless someone builds it.

It accumulates in predictable places:

  • form-entry tables created by the form plugin, or entries stored as posts with their fields in wp_postmeta;
  • notification emails sitting in a shared mailbox;
  • wp_comments, which stores commenter email and IP address;
  • backups.

Each backup is a full copy of the database. Deleting an entry from the live site leaves it in every earlier archive, so a retention rule has to state the backup rotation.

Safeguards, and why "we use SSL" isn't an answer

Principle 4.7 requires security safeguards appropriate to the sensitivity of the information, protecting against loss, theft, and unauthorized access, disclosure, copying, use or modification. Clause 4.7.3 names physical, organizational and technological measures. TLS covers data in transit only. It says nothing about the database, the administrator accounts or the backups.

On WordPress the question is answered by evidence: administrator accounts without two-factor authentication; accounts belonging to former developers; plugins with known unpatched vulnerabilities; form uploads in a browsable directory; backup archives inside the web root; staging copies holding production data. Clause 4.7.5 extends the duty to disposal.

Breach reporting: the clock, the threshold, the records

The threshold is a real risk of significant harm. When a breach of security safeguards meets it, section 10.1 requires a report to the Privacy Commissioner and notice to affected individuals, both as soon as feasible. Section 10.3 requires a record of every breach, including those below the threshold, kept for 24 months.

PIPEDA sets no fixed number of hours. The assessment turns on the sensitivity of the information and the probability of misuse. Knowingly failing to report, notify or keep the record is an offence, with fines up to $10,000 on summary conviction or $100,000 on indictment.

On WordPress, a compromised administrator account or an exposed backup file reaches the whole database. The assessment depends on knowing which tables held personal information.

A WordPress-specific checklist

A PIPEDA review of a WordPress site comes down to eight checks, listed below. Each one produces evidence: an inventory, a screenshot, a query result or a log. WP Doctor records these in the compliance section of a Health Report. The legal conclusions drawn from them belong to counsel.

  1. A named privacy contact is published, with an address.
  2. Every form field has a stated purpose, and optional fields are optional.
  3. The privacy policy matches the third-party requests the site makes.
  4. Non-essential scripts are blocked until a choice is made, and the choice can be changed.
  5. Form entries, logs and backups have a retention period and a deletion routine that runs.
  6. Administrator access is limited, current and protected by two-factor authentication.
  7. Access requests can be fulfilled across plugin tables, mailboxes and processors within thirty days.
  8. A breach record exists, with a named person responsible for the assessment.

Other regimes are indexed on the compliance hub.

---

Every one of these is checked in a Health Report

A paid, fixed-scope diagnosis of your WordPress site — technical, performance, security and Canadian compliance — delivered as a written report you own.

Book a Health Report Back to the compliance hub
UNRESOLVED TOKENS — not publishable: [WPDOCTOR_LEGAL_REVIEW_COMPLIANCE]