Under PIPEDA, a person can ask an organization for the personal information it holds about them, and the organization must answer within a fixed deadline. In privacy shorthand that is a data subject access request, or DSAR. A privacy portal is the tool that lets you receive, verify, answer and record those requests without losing track of the clock.

This guide explains what PIPEDA requires, what it does not, and how to design a portal around the rules. For the wider legal context, see our guide to PIPEDA and cookies.

PIPEDA gives people four things that matter for a portal. They can ask for access to their information (principle 4.9 and section 8), challenge its accuracy and have it corrected (4.9.5), withdraw consent (4.3.8) and complain about how it is handled (4.10).

There is no general right to erasure and no general right to portability in PIPEDA. If your team uses a GDPR playbook, remove those two buttons from the Canadian flow unless you serve Quebec, where portability applies from 22 September 2024 under section 27 of the provincial law. Quebec's Law 25 sits beside PIPEDA, not inside it.

Do not leave a request unanswered because the law does not give the right. Reply in writing, explain what the law allows, and offer what you can. A clear refusal with reasons is part of how a good process looks to the regulator.

Section 8 of PIPEDA sets the clock, and the clock is where most programs fail. Build every one of these points into the portal.

1. The request must be made in writing (section 8(1)). Your portal form satisfies that.
2. You must respond within 30 days of receiving it (8(3)).
3. You may extend by up to 30 more days in specific cases, but only if you notify the person within the original 30 days, with the reason and their right to complain (8(4)).
4. If you do not respond in time, the law treats it as a refusal (8(5)).
5. You may charge only a minimal cost, and you must tell the person the approximate cost beforehand and get their agreement (8(6)).
6. If you refuse, you must do so in writing, with reasons and the recourse available (8(7)).
7. While a complaint or a court proceeding is pending, you must keep the information concerned (8(8)).

Section 9 lists the cases where an organization must or may refuse, such as information that would reveal personal information about another person, or that is subject to solicitor-client privilege. Each refusal should be logged with the section relied on and the reasoning.

You have to confirm who is asking before you release anything. Do it in proportion to the risk: for a low-sensitivity request, matching an email on file may be enough. For sensitive data, ask for more.

Collect only what you need for the check, and delete it when the request is closed. A portal that asks for a passport scan to answer a newsletter question creates its own privacy problem.

A portal is a front door and a back office. Both parts need a design decision.

Make the entry point easy to find, from the footer and from the privacy policy. Offer a form with clear options: access, correction, withdrawal of consent, complaint. Add a confirmation message with a reference number and the response deadline.

Behind the form you need a queue that starts a 30-day timer at receipt and warns before the extension window closes. Each case should hold the request, the identity check, the data sources searched, the response sent and the date. That record is your proof if a complaint arrives.

Our guide to data mapping and data inventory shows how to know where a person's data lives, which is the hardest part of answering in time.

Want a privacy portal that keeps the 30-day clock and the case record for you? Talk to our team.

Principle 4.3.8 lets people withdraw consent, subject to legal or contractual restrictions and reasonable notice. Your portal should treat withdrawal as a request type, and it should connect to the cookie banner so that a withdrawal also changes tracking.

A consent management platform such as AdOpt records each choice and each change in its Consent Log, with date and time and the tags and cookies accepted or refused. That gives the portal something to check when a person asks what they agreed to.

If a person is not satisfied, they can complain to the Office of the Privacy Commissioner of Canada (OPC) under section 11. For a refusal of access, section 11(3) sets a deadline of six months to file. The OPC then investigates and reports within one year under section 13(1).

After that report, the person may apply to the Federal Court under section 14, within one year of the report (14(2)). The Court can order a correction, order that practices change and award damages, including for humiliation, under section 16. The OPC itself cannot issue orders or administrative fines.

Quebec's Law 25 gives people more rights than PIPEDA, including portability, and its penalties are higher: administrative penalties up to CAD 10 million or 2%, and penal fines up to CAD 25 million or 4%. If you serve Quebec, run a separate track in your portal and check the provincial deadlines.

Alberta and British Columbia have their own private-sector laws, and organizations that operate there should check them. The federal rules still apply to cross-border flows and federal works.

Principle 4.1 requires a person accountable for compliance. That person, or a delegate, owns the portal and the response deadlines. Read about the responsibilities of a data protection officer, and consider outsourcing the DPO role if you lack a dedicated team.

If you also serve California, compare the deadlines with the CCPA DSAR privacy portal guide.

Thirty days from receipt, under section 8(3). Section 8(4) lets you extend by up to 30 more days in specific cases, but only if you send notice within the original 30 days, with the reason and the person's right to complain. If you stay silent past the deadline, section 8(5) treats it as a refusal.

Only a minimal cost, and only if you tell the person the approximate amount beforehand and they agree to proceed, under section 8(6). In most online programs the best approach is to answer at no cost, which also removes a common source of complaints.

Not a general one. PIPEDA lets people withdraw consent and challenge accuracy, and it requires you to destroy or anonymize information that is no longer needed. There is no GDPR-style right to erasure. Quebec's law adds rights of its own, so check the provincial text if you serve Quebec.

You must refuse in writing, give reasons and tell the person what recourse they have, under section 8(7). Keep the information while any complaint or court proceeding is pending (8(8)). Record the exemption from section 9 that you relied on, so you can defend the decision.

No. A banner records consent choices, but an access request asks for a copy of the personal information you hold and an explanation of how it is used. The two should connect, because the consent record is part of the data you may have to disclose, but one does not replace the other.

• PIPEDA cookies policy, with what the document must contain
• PIPEDA privacy policy, with the full outline of the document