Canada's Personal Information Protection and Electronics Document Act is in place to assure individuals that their personal information is safeguarded by private sector companies with whom they conduct business. All organizations must comply with principles of the Act that specify limits and constraints for businesses and the rights of individuals. These principles involve the collection, consent, use, distribution, safeguards to protect, transmittal and complaint procedures of personal information.

Accountability: be responsible for the information which is collected

Identify the Purpose: identify reasons before or at collection

Obtain Consent: before or at collection and if the use changes

Limit Collection: to only what is needed to conduct business or the specific activity

Limit Use, Disclosure, and Retention: control access, consider third parties and outline limits for retention time

Be Accurate: minimize the risk of inaccuracies

Safeguard Appropriately: protect from loss, theft and misuse

Be Open: inform people of your policies and procedures

Grant Access: respond to requests within limited and stated time frames

Provide Recourse: provide a complaint procedure and process