Under PIPEDA, you can keep personal information only as long as you need it for the purposes you identified. The law sets no fixed periods: Principle 5 requires your own guidelines with minimum and maximum retention periods, and information you no longer need must be destroyed, erased or made anonymous. Principle 4 limits what you collect in the first place to what those purposes require.
Getting either rule wrong has consequences. In March 2026, the Office of the Privacy Commissioner of Canada (OPC) published findings against Loblaw for keeping data from closed PC Optimum loyalty accounts without showing it was properly anonymised. The case turned on Principle 4.5.3, and Loblaw agreed to a third-party assessment of its anonymisation.
What Principle 4 requires: limiting collection
Clause 4.4 of Schedule 1 to PIPEDA says the collection of personal information must be limited to what is necessary for the purposes the organisation identified, and that information must be collected by fair and lawful means. That carries three obligations.
First, a purpose limit: you must have identified a specific purpose under Principle 2 before collecting, so collecting speculatively or stockpiling for undefined future use is out. Second, minimisation: clause 4.4.1 says both the amount and the type of information must be limited to what the purposes need, and organisations must not collect indiscriminately. Third, fair and lawful means: clause 4.4.2 prohibits collecting information by misleading or deceiving people about why it is collected.
The OPC applies this in practice. In PIPEDA Findings #2023-001, Home Depot of Canada sent the hashed email addresses and in-store purchase details of customers who asked for e-receipts to Meta's Offline Conversions tool to measure ad performance, and the OPC found customers would not have expected it. The gap between the stated purpose and the actual use is exactly what Principles 4 and 5 are meant to prevent.
Principle 5: use, disclosure and retention limits
Principle 5 builds on Principle 4. Once data is collected for a purpose, it may be used or disclosed only for that purpose, unless the person consents to a new use or an exception in PIPEDA applies.
The retention rules are in clauses 4.5.2 and 4.5.3. Organisations should develop guidelines with minimum and maximum retention periods, and keep information used to make a decision about someone long enough for that person to access it. Information no longer needed for the identified purposes should be destroyed, erased or made anonymous, under procedures the organisation sets.
That last option carries weight. In PIPEDA Findings #2026-001 of 5 March 2026, when members closed their PC Optimum accounts, Loblaw deleted personal identifiers such as name, email and phone number but kept other data, which in the program includes transaction histories, loyalty data and usage data such as public IP addresses and browsing behaviour. Loblaw maintained the remaining data was no longer associated with an identifiable person. The OPC was not satisfied that it had been shown to be anonymous and found that aspect well-founded and conditionally resolved, after Loblaw agreed to a third-party assessment.
When anonymisation falls short
The Loblaw finding sets out what anonymisation under Principle 4.5.3 means. Where an organisation anonymises instead of deleting, the onus is on it to ensure and demonstrate that there is "no serious possibility" the retained information can be re-identified, alone or combined with other available information.
Removing direct identifiers is not enough if the rest of the dataset, such as IP addresses or detailed behaviour, still allows re-identification. And the assessment is not a one-off: the OPC says keeping the risk low is an ongoing process, because better re-identification techniques and new data can raise it over time.
Loblaw also breached Principle 4.10 by not responding to privacy challenges in time, a reminder that the complaints process is part of the same accountability.
Building a retention schedule
PIPEDA does not prescribe retention periods, so each organisation needs its own schedule, documented and reviewed regularly. The ten fair information principles give the framework, and the specifics are yours to set and justify.
| Data category | Typical purpose | Retention approach |
|---|---|---|
| Customer contact details | Service delivery | The length of the relationship plus a short wind-down |
| Transaction records | Orders, tax | The period tax and accounting law requires, then destroy |
| Analytics data | Website performance | Aggregate early, keep user-level data only as long as analysis needs |
| Consent records | Proof of valid consent | While you rely on the consent, plus a reasonable period to answer complaints |
| Employee records | Employment | The length of employment plus statutory requirements |
| Loyalty program data | Points and rewards | Delete or demonstrably anonymise when the account closes |
Does PIPEDA require you to keep customer data in Canada? No. PIPEDA has no data localisation rule. Personal information can be stored or processed by service providers outside Canada, but you remain accountable for it and should tell people their information may be handled in another country. Some provincial public-sector laws are stricter.
How this applies to cookies and online tracking
Cookies and tracking technologies fall under the same collection and retention principles as any other personal information. If a cookie collects information about an identifiable person, as most analytics and marketing cookies do through IP addresses, device identifiers or behavioural profiles, Principles 4 and 5 apply in full.
For analytics cookies such as _ga, collect only what performance analysis needs and do not keep raw user-level data indefinitely. Google Analytics 4 lets standard properties keep user-level data for 2 or 14 months, according to Google's data retention settings, and the 2-month option is the shorter default. Choose the period your purpose actually needs.
Marketing cookies raise harder questions. The Home Depot finding showed that sharing data with third parties for advertising needs express consent when it falls outside people's reasonable expectations. A consent banner that explains which categories are active, who receives the data and how long it is kept makes those purposes clear to visitors.
Enforcement and consequences
The OPC investigates complaints, publishes findings and can take matters to the Federal Court, which can order changes and award damages, as described in PIPEDA enforcement. Criminal fines of up to CAD 100,000 apply only to specific offences, such as knowingly breaking the breach reporting rules.
According to the OPC's 2024-2025 annual report, it accepted 446 PIPEDA complaints, closed 331 through early resolution and 107 through standard investigations, and received 686 breach reports. Retention, as the Loblaw case shows, sits alongside breach reporting and consent among its priorities. The joint OPC and UK ICO investigation into 23andMe (PIPEDA Findings #2025-001) looked at safeguards and breach notification for genetic information, among the most sensitive data there is.
Bill C-27 and its Consumer Privacy Protection Act died in January 2025. Its successor, Bill C-36, introduced on 15 June 2026 and at second reading as of October 2026, would replace Part 1 of PIPEDA and add administrative penalties of up to CAD 10 million or 3% of gross global revenue. Canada sits alongside other countries on the privacy laws by region overview.
Questions about PIPEDA retention and collection
Does PIPEDA specify exact retention periods for personal data?
No. Principle 5 requires organisations to set their own guidelines with minimum and maximum periods tied to the purpose of collection. Other laws, such as tax and employment law, may require specific periods for particular records.
Can I keep personal data indefinitely if I anonymise it?
Only if the anonymisation holds. The OPC's 2026 Loblaw finding says the organisation must ensure and demonstrate there is no serious possibility of re-identification, alone or combined with other available information, and keep reassessing that risk.
Do analytics cookies fall under PIPEDA's retention rules?
Yes, if they collect information about an identifiable individual. Most analytics cookies capture IP addresses or build behavioural profiles that meet this threshold, so the data needs defined retention periods.
What happens if I collect more personal data than I need?
Collecting more than your purposes need breaches Principle 4, which limits both the amount and the type of information. If you find you have collected unnecessary data, dispose of it securely.
How does PIPEDA's data minimisation compare to the GDPR?
The ideas are closely aligned. GDPR Article 5(1)(c) requires data to be adequate, relevant and limited to what is necessary, and PIPEDA's Principle 4 limits collection to what the identified purposes need.
Does PIPEDA require me to keep customer data in Canada?
No. PIPEDA has no data localisation rule. You can use service providers abroad, but you stay accountable for the data and should tell people it may be processed in another country.
Is implied consent enough for collecting cookie data under PIPEDA?
It depends on context. For strictly necessary cookies the question rarely arises. For analytics and marketing cookies, especially where data is shared with third parties, the OPC expects express consent when the use falls outside visitors' reasonable expectations.
Know what your cookies collect and for how long
A retention schedule starts with an inventory. Kukie.io scans your site, lists each cookie with its category and duration, and gives visitors a documented choice about the optional ones, stored as a consent record.
