Help › Legal › Keep people’s information private
Keep people’s information private
Showing Manitoba. Select your province in settings.
Manitoba stands fully covered: its own filings and guidance stand in the books beside the federal ones.
A named person answers for privacy. Personal information is collected only with consent, for purposes a reasonable person would consider appropriate; the person it is about may see it and have it corrected; it is protected while it is held, and destroyed when its purpose is done.
The federal Act runs where a province’s own Act of the same kind does not. Named people answer for compliance, purposes are stated before anything is collected, consent comes first, and the person the information is about can see it, challenge it and have it corrected. Binds: Organizations the federal Act reaches (Personal Information Protection and Electronic Documents Act).
The law’s own words
“An organization is responsible for personal information under its control and shall designate an individual or individuals who are accountable for the organization’s compliance with the following principles.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.1 · Read it at Justice Laws · Verified 2026-11-10
“The identity of the individual(s) designated by the organization to oversee the organization’s compliance with the principles shall be made known upon request.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.1.2 · Read it at Justice Laws · Verified 2026-11-10
“The purposes for which personal information is collected shall be identified by the organization at or before the time the information is collected.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.2 · Read it at Justice Laws · Verified 2026-11-10
“The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.3 · Read it at Justice Laws · Verified 2026-11-10
“For the purposes of clause 4.3 of Schedule 1, the consent of an individual is only valid if it is reasonable to expect that an individual to whom the organization’s activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure of the personal information to which they are consenting.”
Personal Information Protection and Electronic Documents Act, s. 6.1 · Read it at Justice Laws · Verified 2026-11-10
“An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.”
Personal Information Protection and Electronic Documents Act, s. 5(3) · Read it at Justice Laws · Verified 2026-11-10
“The collection of personal information shall be limited to that which is necessary for the purposes identified by the organization. Information shall be collected by fair and lawful means.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.4 · Read it at Justice Laws · Verified 2026-11-10
“Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as necessary for the fulfilment of those purposes.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.5 · Read it at Justice Laws · Verified 2026-11-10
“Personal information that is no longer required to fulfil the identified purposes should be destroyed, erased, or made anonymous. Organizations shall develop guidelines and implement procedures to govern the destruction of personal information.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.5.3 · Read it at Justice Laws · Verified 2026-11-10
“Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.6 · Read it at Justice Laws · Verified 2026-11-10
“Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.7 · Read it at Justice Laws · Verified 2026-11-10
“The security safeguards shall protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. Organizations shall protect personal information regardless of the format in which it is held.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.7.1 · Read it at Justice Laws · Verified 2026-11-10
“An organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.8 · Read it at Justice Laws · Verified 2026-11-10
“Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.9 · Read it at Justice Laws · Verified 2026-11-10
“An organization shall assist any individual who informs the organization that they need assistance in preparing a request to the organization.”
Personal Information Protection and Electronic Documents Act, s. 8(2) · Read it at Justice Laws · Verified 2026-11-10
“An organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request.”
Personal Information Protection and Electronic Documents Act, s. 8(3) · Read it at Justice Laws · Verified 2026-11-10
“When an individual successfully demonstrates the inaccuracy or incompleteness of personal information, the organization shall amend the information as required.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.9.5 · Read it at Justice Laws · Verified 2026-11-10
“An individual shall be able to address a challenge concerning compliance with the above principles to the designated individual or individuals accountable for the organization’s compliance.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.10 · Read it at Justice Laws · Verified 2026-11-10
“An organization shall report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual.”
Personal Information Protection and Electronic Documents Act, s. 10.1(1) · Read it at Justice Laws · Verified 2026-11-10
“Unless otherwise prohibited by law, an organization shall notify an individual of any breach of security safeguards involving the individual’s personal information under the organization’s control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual.”
Personal Information Protection and Electronic Documents Act, s. 10.1(3) · Read it at Justice Laws · Verified 2026-11-10
“An organization shall, in accordance with any prescribed requirements, keep and maintain a record of every breach of security safeguards involving personal information under its control.”
Personal Information Protection and Electronic Documents Act, s. 10.3(1) · Read it at Justice Laws · Verified 2026-11-10
Manitoba has no privacy Act of its own reaching a society’s records: its freedom of information and protection of privacy Act governs public bodies, and its personal health information Act binds trustees of health information. The federal Act’s ground rules attach to personal information a society handles in the course of a commercial activity. Binds: Manitoba societies; organizations under the Personal Information Protection and Electronic Documents Act (Canada).
The law’s own words
“PIPEDA applies to private-sector organizations across Canada that collect, use, or disclose personal information in the course of a commercial activity. The law defines a commercial activity as any particular transaction, act, or conduct, or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists.”
Personal Information Protection and Electronic Documents Act (Canada) — Office of the Privacy Commissioner of Canada, PIPEDA requirements in brief · Read it at Office of the Privacy Commissioner of Canada · Verified 2026-11-11
“The Freedom of Information and Protection of Privacy Act (FIPPA) is an information rights law that gives an individual a legal right of access to records held by Manitoba public bodies, subject to specific and limited exceptions.”
The Freedom of Information and Protection of Privacy Act (Manitoba) — Manitoba Ombudsman, FIPPA frequently asked questions · Read it at Justice Laws · Verified 2026-11-11
The Freedom of Information and Protection of Privacy Act (Manitoba) — public bodies
“The Freedom of Information and Protection of Privacy Act (FIPPA) is an information rights law that gives an individual a legal right of access to records held by Manitoba public bodies, subject to specific and limited exceptions. The act also requires that public bodies protect the privacy of an individual’s personal information existing in records held by public bodies.”
Source: Manitoba Ombudsman — More about the Freedom of Information and Protection of Privacy Act (FIPPA), frequently asked questions · Checked 2026-11-11