Privacy and Information in Canada
Reviewed by the Commoner Law Editorial Team. Sourced from Canadian federal statutes and official sources. Provincial information reflects each province's own legislation and court rulings. Written in plain language for general understanding — this is educational content, not legal advice. Our editorial standards
What is this right?
The CRA's confidentiality duty is criminal, not aspirational. Section 241 of the Income Tax Act makes unauthorised disclosure of taxpayer information a criminal offence — and that has real teeth in cases of leaked data.
The Privacy Act and the Taxpayer Bill of Rights (Right #3) give you the right to have your information treated as confidential. No CRA employee may share your information without your written consent unless a specific provision of law authorises it.
You have the right to access your own information. Most of it is visible through My Account; for the rest, file an Access to Information and Privacy (ATIP) request. CRA owes a response within 30 days (extendable in narrow circumstances).
Errors in your file? Request corrections. Improper disclosure? File with the Privacy Commissioner of Canada.
When does it apply?
Applies to every person and business that files taxes or interacts with the CRA.
- The rights run whether you're filing, being audited, or receiving benefits.
- They cover every interaction channel — phone, mail, online, and in person.
What to Do If the CRA Improperly Discloses Your Tax Information in Canada
- Use My Account for the standard view: returns, assessments, benefit payments, correspondence.
- Submit an ATIP request if you need detailed internal CRA records about your file. They're often the smoking gun in disputes.
- File with the Privacy Commissioner if you believe your information was shared improperly.
- If someone else needs to access your information, authorise them with Form T1013 rather than handing over login details.
- Request corrections on any CRA record that's wrong about you.
What should you NOT do?
- Don't share My Account credentials. Use Form T1013 — that's the legal route.
- Don't hand out your SIN. CRA will never ask for it by email or text — anyone who does is a scammer.
- Don't assume CRA can share your data freely. They need legal authority or your written consent.
- Don't sleep on ATIP in a tax dispute. CRA's own internal notes can completely change a case.
Use the jurisdiction bar at the top of the page to pick your province — you'll see how provincial law differs from Canadian federal law.
6 provinces available
Common Questions
When does privacy and information apply?
Applies to every person and business that files taxes or interacts with the CRA.The rights run whether you're filing, being audited, or receiving benefits.They cover every interaction channel — phone, mail, online, and in person.
What should I do if I think the CRA in Canada shared my personal tax information without my consent?
Use My Account for the standard view: returns, assessments, benefit payments, correspondence.Submit an ATIP request if you need detailed internal CRA records about your file. They're often the smoking gun in disputes.File with the Privacy Commissioner if you believe your information was shared improperly.If someone else needs to access your information, authorise them with Form T1013 rather than handing over login details.Request corrections on any CRA record that's wrong about you.
What mistakes should I avoid with privacy and information?
Don't share My Account credentials. Use Form T1013 — that's the legal route.Don't hand out your SIN. CRA will never ask for it by email or text — anyone who does is a scammer.Don't assume CRA can share your data freely. They need legal authority or your written consent.Don't sleep on ATIP in a tax dispute. CRA's own internal notes can completely change a case.
Privacy and Information in other states
Same topic, different jurisdiction. Pick the one that applies to you.