- The law
- Personal Information Protection and Electronic Documents Act (PIPEDA), section 8 and Schedule 1, principle 4.9; in Quebec, the Act respecting the protection of personal information in the private sector
- Who enforces it
- Office of the Privacy Commissioner of Canada (OPC); in Quebec, the Commission d'accès à l'information (CAI)
- Penalties
- The Federal Court can order remedies and damages, and some offences under PIPEDA carry fines; Quebec's law allows much larger fines
What it means for your email
- A subscriber can ask for access to the personal information you hold about them, and to have it corrected.
- PIPEDA says you must respond with due diligence and within 30 days of receiving the request.
- You can extend by up to 30 more days if meeting the deadline would unreasonably interfere with your work or needs consultations, or for the time needed to convert the information into another format. Tell the person within the first 30 days, with the new deadline, the reason, and their right to complain to the Privacy Commissioner.
- If you don't respond in time, you're treated as having refused the request.
Do
- Log each request with a reference and its deadline when it arrives.
- Find the person's data in your email platform and anywhere else it's kept.
- If someone withdraws consent, stop emailing them and keep them on a suppression list.
- Check whether Quebec's law applies to you: it has its own access and correction rights.
Don't
- Don't let a request go past 30 days without either responding or sending a notice of extension.
- Don't put the person's details in tools that don't need them.
Good to know
- Unsubscribing from commercial emails is a separate rule under CASL: give effect to it within 10 business days.
Sources
- PIPEDA, section 8 (Justice Laws Website)
- Accessing your personal information (Office of the Privacy Commissioner of Canada)
- Act respecting the protection of personal information in the private sector (P-39.1) (LégisQuébec)
Researched by Mailfois · 2026/27 edition · checked 20 October 2026
Not legal advice. This is a plain-English summary. Check the sources for anything specific, or take professional advice. Spotted something out of date? Email [email protected] and we'll credit you if you'd like.