PIPEDA — Personal Information Protection and Electronic Documents Act

PIPEDA — Personal Information Protection and Electronic Documents Act — 92% of in-scope requirements covered.

6 requirements · 6 in scope (5 enforced · 1 designed). The 92% is weighted over the in-scope base.

PIPEDA: requirement → the KYE™ artefact that enforces it

Demo data

You learn: Which requirements KYE™ enforces at runtime and with which artefact. You can: Walk the requirements.

  1. 1 · enforced

    Schedule 1, Principle 1 (4.1) — Accountability: an organisation is responsible for personal information under…

    Audit events: kye.compliance.attestation.v1, kye.evidence.decision_map.v1 · Constitution: 12 purpose permission, 21 delegated auditability

  2. 3 · enforced

    Schedule 1, Principle 3 (4.3) — Consent: the knowledge and consent of the individual are required for the…

    Audit events: kye.purpose.request.v1, kye.purpose.admissibility.v1 · Constitution: 12 purpose permission

  3. 5 · enforced

    Schedule 1, Principle 5 (4.5) — Limiting use, disclosure and retention: personal information must not be used…

    Audit events: kye.purpose.admissibility.v1, kye.evidence.tool_call.v1 · Constitution: 12 purpose permission, 30 audit worm retention

  4. 7 · enforced

    Schedule 1, Principle 7 (4.7) — Safeguards: personal information must be protected by security safeguards…

    Audit events: kye.purpose.admissibility.v1, kye.evidence.tool_call.v1 · Constitution: 12 purpose permission, 30 audit worm retention

  5. 9 · enforced

    Schedule 1, Principle 9 (4.9) — Individual access: on request, an individual must be told of the existence…

    Audit events: kye.evidence.pack.v1, kye.evidence.decision_map.v1 · Constitution: 31 data governance pack

  6. 1 · designed

    Section 10.1 — Breach of security safeguards: report to the OPC and notify affected individuals where a…

    Audit events: kye.signal.incident.opened.v1, kye.compliance.attestation.v1 · Constitution: 13 resilience loop

How this widget is built
Demonstrates
KYE™ Compliance Mapping Rail™
Components
  • Framework requirement (clause)
  • Coverage status
  • KYE™ enforcement artefact (event, decision-record field, Evidence Pack™ entry)
Flow
Clause → status → the KYE™ artefact that enforces it, enforced requirements first. Architecture diagram
Used on

Source: Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5. Part 1 + Schedule 1 (the ten fair-information principles, originally CSA Model Code): accountability (4.1), identifying purposes (4.2), consent (4.3), limiting collection (4.4), limiting use/disclosure/retention (4.5), safeguards (4.7), openness (4.8), individual access (4.9). Breach-of-security-safeguards reporting under s.10.1 (in force since 2018).

By category

CategoryReqsEnforcedDesignedAdvisoryDeferredCoverage
Accountability + openness (Sch.1 4.1, 4.8)11000100%
Purpose + consent (Sch.1 4.2-4.3)11000100%
Limiting collection/use/retention (Sch.1 4.4-4.5)11000100%
Safeguards (Sch.1 4.7)11000100%
Individual access (Sch.1 4.9)11000100%
Breach reporting (s.10.1)1010050%

Every requirement → the KYE™ artefact that enforces it

IDTitleStatusKYE™ enforcement
pipeda.sch1-4.1Schedule 1, Principle 1 (4.1) — Accountability: an organisation is responsible for personal information under its control and must designate an individual accountable for complianceenforcedaudit_events: kye.compliance.attestation.v1, kye.evidence.decision_map.v1
engines: internal, internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/21-DELEGATED-AUDITABILITY.md
pipeda.sch1-4.3Schedule 1, Principle 3 (4.3) — Consent: the knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where inappropriateenforcedaudit_events: kye.purpose.request.v1, kye.purpose.admissibility.v1
engines: internal, internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
pipeda.sch1-4.5Schedule 1, Principle 5 (4.5) — Limiting use, disclosure and retention: personal information must not be used or disclosed for purposes other than those for which it was collected, and retained only as long as necessaryenforcedaudit_events: kye.purpose.admissibility.v1, kye.evidence.tool_call.v1
engines: internal, internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/30-AUDIT-WORM-RETENTION.md
pipeda.sch1-4.7Schedule 1, Principle 7 (4.7) — Safeguards: personal information must be protected by security safeguards appropriate to the sensitivity of the informationenforcedaudit_events: kye.purpose.admissibility.v1, kye.evidence.tool_call.v1
engines: internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/30-AUDIT-WORM-RETENTION.md
pipeda.sch1-4.9Schedule 1, Principle 9 (4.9) — Individual access: on request, an individual must be told of the existence, use and disclosure of their personal information and given access to itenforcedaudit_events: kye.evidence.pack.v1, kye.evidence.decision_map.v1
engines: internal, internal
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md
pipeda.s10.1Section 10.1 — Breach of security safeguards: report to the OPC and notify affected individuals where a breach creates a real risk of significant harmdesignedaudit_events: kye.signal.incident.opened.v1, kye.compliance.attestation.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md

Canonical KYE™ surfaces referenced on this page: KYE Protocol™.