How to Complain to the Office of the Privacy Commissioner of Canada (OPC) — Canada
Sourced from Canadian federal statutes and official sources. Provincial information reflects each province's own legislation and court rulings. Written in plain language for general understanding — this is educational content, not legal advice. Our editorial standards
What is this right?
Canada's privacy enforcement architecture is split between federal and provincial regulators. The Office of the Privacy Commissioner of Canada (OPC) handles complaints under:
- PIPEDA — for federally-regulated private-sector organisations (banks, telecoms, airlines, federal Crown corporations) and for businesses in provinces without their own substantially-similar private-sector law (i.e. everywhere except BC, Alberta, Quebec).
- Privacy Act — for federal government departments.
For BC, Alberta, and Quebec private-sector businesses, the provincial commissioner has primary jurisdiction:
- British Columbia: Office of the Information and Privacy Commissioner (BC OIPC) under PIPA.
- Alberta: Office of the Information and Privacy Commissioner (Alberta OIPC) under PIPA Alberta.
- Quebec: Commission d'accès à l'information (CAI) under Law 25 (formerly Bill 64).
OPC findings are not directly binding — but the complainant can ask the Federal Court to grant a binding remedy after the OPC report. Most organisations comply with OPC findings voluntarily.
The proposed Consumer Privacy Protection Act (CPPA), part of Bill C-27, would give the OPC binding order-making power and significant financial penalties. As of May 2026 the Bill remains in legislative process — verify the current status before relying on CPPA provisions.
When does it apply?
- You have a privacy complaint against a federally-regulated private-sector organisation (PIPEDA) or a federal government department (Privacy Act).
- You first raised the issue with the organisation's Chief Privacy Officer where reasonable.
- The complaint is within 1 year of when you knew (or should have known) about the issue.
What should you do?
- Identify the correct regulator. Federally regulated = OPC. BC / Alberta / Quebec private sector = provincial commissioner. Provincial public sector (provincial government, municipalities) = provincial public-sector regulator.
- Raise the issue with the organisation's Privacy Officer first. Allow 30 days for a substantive response. PIPEDA requires every organisation to have a designated privacy officer.
- File the complaint on the OPC complaint form at priv.gc.ca. Online, mail, or fax. No fee.
- Engage with the investigation. OPC investigators may interview you, request documents, and ask for clarification.
- Receive the OPC report. Possible outcomes: well-founded, not well-founded, well-founded and resolved, or settled. Reports may include recommendations.
- If the organisation refuses to comply, apply to the Federal Court within 45 days under PIPEDA s. 14 for a binding remedy — damages, an order to do or stop doing something, or a public-interest order.
What should you NOT do?
- Don't file with the wrong regulator. A BC PIPA matter sent to OPC will be redirected, costing time. Confirm jurisdiction first.
- Don't skip the organisation-first step unless waiting is unreasonable (e.g., the breach is ongoing and the organisation refuses to engage).
- Don't sit on the 1-year limit. Late complaints are accepted only in exceptional circumstances.
- Don't expect OPC to award compensation directly. OPC issues findings and recommendations; financial compensation generally requires Federal Court application.
About Scams, Fraud & Money Recovery in Canada
Canada's scam-recovery system runs across three institutions. The Canadian Anti-Fraud Centre (CAFC) at antifraudcentre-centreantifraude.ca or 1-888-495-8501 is the central reporting hub — operated jointly by RCMP, Competition Bureau Canada, and the Ontario Provincial Police. Reports feed pattern intelligence and the Fraud Reporting System; local investigation by RCMP / provincial police / municipal police. For credit-card chargebacks, federal protection under the Bank Act + card-network rules. For bank disputes, the Ombudsman for Banking Services and Investments (OBSI) handles complaints free for consumers; OBSI award cap was raised to CAD 350,000 from 1 November 2021 (subject to OBSI Terms of Reference). The Financial Consumer Agency of Canada (FCAC) supervises federally-regulated banks on consumer protection.
Emergency: 911. CAFC: 1-888-495-8501.
Common Questions
Does the OPC handle complaints about provincial businesses?
Only where the province has not enacted substantially-similar private-sector privacy legislation. BC, Alberta, and Quebec have their own — those provinces' commissioners (BC OIPC, Alberta OIPC, CAI Quebec) have primary jurisdiction over provincial businesses there. Everywhere else (ON, MB, NB, NL, NS, PE, SK, plus territories) federal OPC under PIPEDA applies.
Are OPC findings binding on the organisation?
Not directly. The OPC issues recommendations. To get a binding order, the complainant applies to the Federal Court under PIPEDA s. 14. In practice most organisations comply with OPC findings to avoid the court route and reputational damage.
Can I get damages through the OPC?
The OPC itself cannot award damages — but after a well-founded finding, the Federal Court can award damages on an application. The court considers humiliation, actual damages from the breach, and conduct of the organisation.
Will CPPA / Bill C-27 change this?
If passed, yes — significantly. CPPA would give the OPC binding order-making power, administrative monetary penalties up to 3% of global revenue, and a private right of action for individuals. As of May 2026 Bill C-27 is still in legislative process; verify the current status before relying on CPPA provisions.
What is the how to complain to the office of the privacy commissioner of canada (opc) right in Canada?
Canada's privacy enforcement architecture is split between federal and provincial regulators. The Office of the Privacy Commissioner of Canada (OPC) handles complaints under:PIPEDA — for federally-regulated private-sector organisations (banks, telecoms, airlines, federal Crown corporations) and for businesses in provinces without their own substantially-similar private-sector law (i.e. everywhere except BC, Alberta, Quebec).Privacy Act — for federal government departments.For BC, Alberta, and Quebec private-sector businesses, the provincial commissioner has primary jurisdiction:British Columbi...
When does how to complain to the office of the privacy commissioner of canada (opc) apply?
You have a privacy complaint against a federally-regulated private-sector organisation (PIPEDA) or a federal government department (Privacy Act).You first raised the issue with the organisation's Chief Privacy Officer where reasonable.The complaint is within 1 year of when you knew (or should have known) about the issue.
What should I do about how to complain to the office of the privacy commissioner of canada (opc)?
Identify the correct regulator. Federally regulated = OPC. BC / Alberta / Quebec private sector = provincial commissioner. Provincial public sector (provincial government, municipalities) = provincial public-sector regulator.Raise the issue with the organisation's Privacy Officer first. Allow 30 days for a substantive response. PIPEDA requires every organisation to have a designated privacy officer.File the complaint on the OPC complaint form at priv.gc.ca. Online, mail, or fax. No fee.Engage with the investigation. OPC investigators may interview you, request documents, and ask for clarificat...
What mistakes should I avoid with how to complain to the office of the privacy commissioner of canada (opc)?
Don't file with the wrong regulator. A BC PIPA matter sent to OPC will be redirected, costing time. Confirm jurisdiction first.Don't skip the organisation-first step unless waiting is unreasonable (e.g., the breach is ongoing and the organisation refuses to engage).Don't sit on the 1-year limit. Late complaints are accepted only in exceptional circumstances.Don't expect OPC to award compensation directly. OPC issues findings and recommendations; financial compensation generally requires Federal Court application.