How to file a privacy complaint with the OPC or a provincial commissioner

What to take away

Which commissioner handles your complaint: federal versus provincial jurisdiction

Jurisdiction is the first question, and getting it wrong wastes months. Canada has a federal private sector law plus provincial laws that apply in some provinces instead. The OPC publishes an overview of how these laws fit together, which is worth reading before you choose a form.

PIPEDA, the Personal Information Protection and Electronic Documents Act, covers private sector organizations in provinces without their own substantially similar private sector law. It also covers federally regulated businesses everywhere: banks, airlines, telecoms and shipping.

Quebec, British Columbia and Alberta have private sector laws the federal government has deemed substantially similar. For most private sector complaints in those provinces, you go to the provincial commissioner, not the OPC. That is a rule, not a preference.

Ontario is different. The IPC Ontario oversees provincial and municipal public bodies and health information custodians, but private sector privacy in Ontario still falls under PIPEDA and the OPC. Read the OPC's summary of privacy laws in Canada to see how federal and provincial statutes divide the field.

Public bodies are almost always provincial or territorial. A complaint about a provincial ministry, a municipal office, a school board or a hospital goes to that province's commissioner. A complaint about a federal department goes to the OPC.

Health information adds another layer. Ontario, BC, Alberta and Quebec each have health privacy statutes with their own regulators and timelines. If your complaint concerns a clinic, lab or hospital record, check the health statute before the general one.

One more distinction matters. Employment complaints about a provincially regulated employer usually go to the provincial commissioner. Complaints about a bank, airline or telecom go to the OPC even if you live in Vancouver or Montreal.

If your issue is really about exercising access, correction or deletion rights rather than a breach, start with the organization. This browser privacy checklist explains how to frame that request before it becomes a complaint.

Filing with the Office of the Privacy Commissioner using its report a concern form

The OPC accepts complaints about federal departments and about private sector organizations covered by PIPEDA. The entry point is the report a concern form, which explains eligibility and links to the online submission.

Before filing, complain to the organization directly. The OPC expects you to give the business a reasonable chance to fix the problem, and it may send you back if you have not. Keep proof of that attempt.

Here are the practical steps.

You do not need a lawyer to file. The process is free. That said, a clear written statement beats a long emotional account, and the OPC assesses whether the law was contravened, not whether you were treated rudely.

There are limits. The OPC generally will not investigate matters already before a court, matters better handled by another regulator, or complaints filed more than a year after the incident. It also cannot order compensation.

The OPC describes its wider mandate, including complaint handling and public education, on its what we do page. Read it once so your expectations match the process.

If your problem is a delayed or refused access request rather than a breach, the browser privacy guide covers the common stalls and how to document them before escalating.

Filing with the IPC Ontario, the OIPC BC, the Alberta commissioner and the CAI

Each provincial commissioner has its own form, its own rules and its own tone. The four you are most likely to need are Ontario, British Columbia, Alberta and Quebec.

IPC Ontario. The Office of the Information and Privacy Commissioner of Ontario handles complaints about provincial and municipal public bodies under the freedom of information and privacy statutes, and about health information custodians under the health privacy law. You file through the IPC's online complaint portal or by submitting the prescribed form. The IPC can review decisions, order disclosures and issue orders against institutions.

OIPC BC. The Office of the Information and Privacy Commissioner for British Columbia takes complaints under the provincial private sector privacy law and the freedom of information law. BC's private sector law is substantially similar to PIPEDA, so most private sector complaints from BC residents go here rather than to Ottawa. The OIPC BC publishes its own complaint forms and a mediation first approach for many files.

Alberta. The Office of the Privacy Commissioner of Alberta handles private sector complaints under Alberta's personal information protection law and public body complaints under its freedom of information law. Alberta requires you to complain to the organization first and to allow a reasonable response period before the commissioner will accept the file.

Quebec. The Office of the Privacy Commissioner of Quebec, known as the CAI, enforces Quebec's private sector privacy law as strengthened by Law 25 (Loi 25). Law 25 added obligations around consent, transparency and privacy impact assessments, and it gives the CAI stronger investigation and penalty powers. Quebec's justice and civil status portal is the official starting point for the province's legal framework. File through the CAI's complaint form, in French or English.

Other provinces and territories have commissioners too, including Nova Scotia, Manitoba, Saskatchewan and Newfoundland and Labrador. Their forms differ, but the pattern is the same: identify the organization, describe the incident, attach evidence, state the remedy.

Whichever route you take, keep the same disciplined record. A browser privacy problems guide helps you track what you asked for, when the clock started and when a response is due.

Timelines, acknowledgements and how OPC investigations proceed

The OPC's investigations page sets out the general flow, and it is worth reading before you file so you know what silence means.

After you submit, the OPC screens the complaint for jurisdiction and completeness. It may contact you for clarification. If it accepts the file, it notifies the organization and asks for a response.

Most files are resolved through early resolution or conciliation rather than a full investigation. An officer talks to both sides, narrows the issues and tries to settle the matter with commitments from the organization.

If early resolution fails, the file moves to investigation. The investigator can request documents, interview staff and examine the organization's practices. You may be asked for further written submissions.

At the end, the Commissioner issues a finding: well founded, well founded and resolved, not well founded, or discontinued. Findings are published in a redacted form, and the reasoning often matters more than the label.

Timelines vary widely. Simple early resolution files can close in weeks. Contested investigations can run a year or more. The OPC does not guarantee a deadline, so keep your own record of every acknowledgement and request.

Provincial timelines differ. The IPC Ontario, the OIPC BC, the Alberta commissioner and the CAI each publish their own service standards and process notes. Check the one that applies to you rather than assuming the federal pace.

The one year filing limit is the hard constraint across most regimes. If you are close to it, file first with what you have and supplement later. Do not wait for a perfect file.

Evidence to gather: notices, screenshots, correspondence and dates

Evidence decides complaints. A precise, dated record is far more persuasive than a long narrative, and it lets an investigator verify your account quickly.

Gather these items before you fill in any form.

Keep the original files. Do not edit screenshots beyond cropping, and do not delete the emails. If you used a web form, save the confirmation page and the reference number.

Write your chronology as a numbered list with one line per event. Investigators work from dates. A tidy timeline often shortens the process because it removes the need for back and forth clarification.

If a breach involved a scam, report it to the Canadian Anti-Fraud Centre as well, and if it involved a telecom or broadcast issue, the CRTC has its own complaint route. Those reports sit alongside, not instead of, your privacy complaint. For suspected cyber incidents, the Canadian Centre for Cyber Security publishes guidance for individuals and small organizations.

One caution: do not send your full social insurance number, banking passwords or identity documents to a regulator by email. Redact what is not needed. If identity proof is demanded and feels excessive, the data broker privacy guide explains how far an organization can reasonably go.

What happens after a finding, and when to escalate to Federal Court

A finding is not the end of the road, and it is not a payout. The OPC can find a complaint well founded and recommend that the organization change its practices, delete information or apologize. Most organizations comply, because the findings are public.

If the organization does not comply, the Commissioner can apply to the Federal Court for a hearing. The Court can order the organization to take specific steps and, in some cases, award damages to the complainant. This is the main escalation path for federal files.

You can also go to Federal Court yourself. Under PIPEDA, a complainant may apply to the Court within the set period after receiving the Commissioner's report, even if the Commissioner declined to investigate or discontinued the file. Deadlines are strict and the paperwork is formal, so legal advice is sensible at this stage.

Provincial routes differ. The IPC Ontario can issue orders that bind institutions, with a right of appeal to the Divisional Court. The OIPC BC can issue orders enforceable in the courts. The Alberta commissioner can make orders against private sector organizations. The CAI can impose administrative penalties under Law 25 and bring proceedings before Quebec's courts.

If your complaint is really about a refund, a contract dispute or rude service, a privacy complaint is the wrong tool. Regulators assess compliance with privacy law, not customer satisfaction. Ask yourself which legal duty was breached before you escalate.

Finally, keep the paper trail intact through every stage. If you later go to court or to a provincial tribunal, your original complaint, the investigator's correspondence and the final finding become the record. A complete file is the strongest thing you can bring.

Common questions