Personal data vault Canada/Guide
PIPEDA and personal data vaults — what Canadians should ask
PIPEDA is Canada’s federal private-sector privacy law. For a personal data vault it means the provider needs your meaningful consent, must safeguard your data with measures matching its sensitivity, must let you access, correct, and delete it, and must report breaches that create a real risk of significant harm. my-id.ca’s privacy practices are designed to comply with PIPEDA: Canadian hosting, encryption at rest and in transit, user rights via Data Requests, and an OPC-aligned breach process. No vault can honestly claim to be "PIPEDA certified" — no such consumer certification exists.
What PIPEDA actually requires of a vault provider
PIPEDA’s fair-information principles translate into concrete expectations for any service holding your identity documents: accountability (a named privacy officer and published practices), consent and limited collection, safeguards proportional to sensitivity (identity documents are about as sensitive as consumer data gets), openness about sub-processors, individual access and correction, and breach notification to you and the Office of the Privacy Commissioner when a breach creates a real risk of significant harm.
How my-id.ca aligns — stated honestly
my-id.ca’s Privacy Policy is designed to comply with PIPEDA, and the product safeguards support PIPEDA’s expectations: user data and backups hosted in Canada, AES-256-GCM encryption at rest, TLS in transit, self-hosted AI so vault content never goes to third-party AI providers, and a published sub-processor list.
You can exercise access, correction, export, and deletion through our Data Requests page. Our incident process commits to notifying affected users within 72 hours of confirming an incident and notifying the OPC when the PIPEDA threshold is met.
What we do not claim: my-id.ca holds no third-party privacy certification, no SOC 2 report, and no formal attestation — and we say so on the Trust page. Be wary of any vault that markets itself as "PIPEDA certified"; there is no standard consumer certification behind that phrase.
Questions to ask any vault about PIPEDA
Six questions separate marketing from practice:
- Is the Privacy Policy explicit that it is designed to comply with PIPEDA?
- Where is data hosted, and are backups in the same jurisdiction?
- How do you request access, correction, export, and deletion — is there an actual mechanism?
- What is the breach-notification commitment, and does it reference the OPC threshold?
- Is the sub-processor list published?
- Are any certifications claimed — and can the provider actually show them?
Frequently asked questions
Is my-id.ca PIPEDA compliant?
my-id.ca’s Privacy Policy and product safeguards are designed to comply with PIPEDA: Canadian hosting, encryption at rest and in transit, access/correction/export/deletion via Data Requests, and a breach process aligned with PIPEDA’s "real risk of significant harm" threshold. We do not claim a third-party "PIPEDA certification" badge and do not currently hold SOC 2.
What is "PIPEDA certified" and should I trust it?
There is no standard consumer "PIPEDA certification". PIPEDA compliance is an ongoing legal obligation, not a badge. Treat the phrase as a marketing signal to verify, not a guarantee.
How do I exercise my privacy rights with my-id.ca?
Use the Data Requests page for access, correction, export, or deletion under PIPEDA and other applicable laws. Account deletion is also available directly in Settings, and deleted records rotate out of encrypted backups within 30 days.
Does PIPEDA stop my data from leaving Canada?
Not by itself — PIPEDA permits cross-border processing with accountability and transparency. That is why residency matters as a product choice: my-id.ca keeps data, backups, and AI processing in Canada so the question rarely arises.
Verify everything on the Trust page
Every claim about my-id.ca in this guide — hosting, encryption, sub-processors, deletion, breach commitments — is documented on the Trust page, which is the source of truth. Related reading: personal data vault Canada.
Store it once. In Canada. For free.
Create a free my-id.ca account — no credit card — and build the vault that powers your family's forms, PDFs, and document sharing.