When does PIPEDA apply to employee training records?

Which employers does PIPEDA cover for employee information?

Part 1 of the Act has two doors. Section 4(1)(a) applies it to every organization for personal information it collects, uses or discloses in the course of commercial activities. Section 4(1)(b) applies it to information about an employee, or a job applicant, when the organization collects, uses or discloses it in connection with the operation of a federal work, undertaking or business.

A training record is information about an employee. For a provincially regulated employer, it is not collected in the course of a commercial activity, so it does not pass through the first door, and it does not pass through the second. That boundary is the point counsel should confirm for your organization, because the answer turns on which level of government regulates the employer, not on where the data sits.

Section 4(2)(a) excludes government institutions covered by the Privacy Act.

How long may training records be kept under PIPEDA?

Schedule 1 sets the fair information principles. Clause 4.5 states the retention rule. Personal information may be used or disclosed for the purposes it was collected for, unless the individual consents or the law requires otherwise. It is retained no longer than necessary for those purposes.

Clause 4.5.2 asks organizations to develop guidelines and procedures for retention. Those guidelines should include minimum and maximum retention periods. Personal information that has been used to make a decision about an individual is retained long enough for that person to access it after the decision. Clause 4.5.2 also notes that other legislation may impose retention periods.

Clause 4.5.3 covers the end of the record's life. Personal information that is no longer required is destroyed, erased or made anonymous.

Applied to training: a completion that fed a decision, such as a certification, a promotion or a disciplinary step, is kept long enough for the employee to see it. No fixed number of years is set by the Act.

Is PIPEDA being replaced?

On June 15, 2026 the federal government tabled Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act. It would replace Part 1 of PIPEDA. On the access date it was at first reading in the House of Commons, so nothing on this page changes until the bill is passed and brought into force.

What does this mean for a Quebec employer?

A provincially regulated employer in Quebec follows the Act respecting the protection of personal information in the private sector, as amended by Law 25, for employee training data. A federally regulated employer in Quebec, such as a federal work, undertaking or business, follows PIPEDA for the same data under s. 4(1)(b). The provincial statute still applies to it for other matters. Which regime governs is a question of jurisdiction, and it is the first thing to settle.

How does EmbayLMS handle this?

EmbayLMS keeps learning data at rest in AWS ca-central-1, the Montréal region, and the training history exports by person, by course or by period, which is the form an access request takes. Completion records survive account deactivation, which supports keeping a decision record available for the period clause 4.5.2 describes without keeping an account active. Deleting a learner removes their personal data on request.

This page summarizes statutory provisions in general terms as they read on the access date given for each source. It is not legal advice, and it does not state what the law requires of your organization. Consult a lawyer about your own obligations before you rely on it.