PIPEDA Schedule 1, Principle 5 and clauses 4.5.2 to 4.5.3: retain only as long as necessary, then destroy, erase or make anonymous (Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, Schedule 1, cl. 4.5, 4.5.2, 4.5.3)
Under PIPEDA personal information is kept only while its purposes need it, within the periods other laws require, and then destroyed, erased or made anonymous. Making it anonymous is one of the three permitted endings.
Dated 31 Oct 2026Source checked 31 Oct 2026Basis: primary text
Selling a company's data? This is one of the rules a sale has to meet, and the guide beside the button reads it in plain words.
- No data upload
- About two minutes
- No email needed
In the source's own words
“Personal information shall be retained only as long as necessary for the fulfilment of those purposes. ... 4.5.2 Organizations should develop guidelines and implement procedures with respect to the retention of personal information. These guidelines should include minimum and maximum retention periods. ... An organization may be subject to legislative requirements with respect to retention periods. 4.5.3 Personal information that is no longer required to fulfil the identified purposes should be destroyed, erased, or made anonymous. Organizations shall develop guidelines and implement procedures to govern the destruction of personal information.”
Where it was read
Also read from the same source
- For customers or staff in Canada, has each person consented to this new use, or will the data be anonymised to the Canadian standard before it leaves? For Quebec, is the privacy impact assessment done and the written agreement ready?
- PIPEDA Schedule 1, clause 4.2.4: a purpose not previously identified needs the individual's consent (Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, Schedule 1, cl. 4.2.4)
- PIPEDA Schedule 1, clause 4.5: no use or disclosure for other purposes without consent (Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, Schedule 1, cl. 4.5)
- PIPEDA section 5(3): only purposes a reasonable person would consider appropriate (Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, s. 5(3))
- PIPEDA section 7.2(4): the business transaction exception excludes the sale or lease of personal information itself (Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, s. 7.2(4))
- PIPEDA section 7(3)(f): disclosure without consent for statistical or scholarly research (Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, s. 7(3)(f))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide