Establishing secure connection…Loading editor…Preparing document…

PIPEDA Disclosure Form

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

PIPEDA DISCLOSURE FORM

This PIPEDA Disclosure Form is made effective as of between Organization Name: with a principal place of business at and Individual Name: residing at (each a "Party" and collectively the "Parties").

RECITALS

WHEREAS the Organization collects, uses and discloses personal information in the course of its commercial activities and is required to obtain consent and provide notice in accordance with the Personal Information Protection and Electronic Documents Act ("PIPEDA");

WHEREAS the Individual has been provided with information about the categories of personal information to be collected, the purposes for which the information will be used or disclosed, and the Organization's practices regarding retention, security and access;

WHEREAS the Parties wish to set out the terms upon which the Individual provides express consent to the collection, use and disclosure of personal information as described below.

NOW THEREFORE in consideration of the mutual covenants herein, the Parties agree as follows:

1. DEFINITIONS

In this Form, unless the context otherwise requires: "personal information" means information about an identifiable individual; "consent" means agreement to the collection, use or disclosure of personal information; "disclose" includes making personal information available to third parties.

2. CATEGORIES OF PERSONAL INFORMATION

The Organization may collect the following categories of personal information from the Individual:

Identifying information (name, date of birth)    Contact information (address, phone, email)    Financial information (bank details, payment history)    Employment or transactional information

Other categories (specify):

3. PURPOSES FOR COLLECTION, USE AND DISCLOSURE

The Organization will collect, use and disclose personal information only for the purposes reasonably required to:

  1. Administer the business relationship between the Parties, including billing and payments;
  2. Provide products, services and customer support;
  3. Comply with legal and regulatory obligations and investigations;
  4. Other specific purposes identified to the Individual:

The Organization will not use or disclose personal information for purposes other than those listed above without obtaining further consent unless authorized or required by law.

4. CONSENT

The Individual hereby provides express consent to the Organization to collect, use and disclose the personal information described in this Form for the purposes set out above. This consent is given:
By signing below, I expressly consent to the collection, use and disclosure as described.
I consent to the collection, use and disclosure only for the specific purposes indicated in the field below:

5. RETENTION AND DISPOSAL

The Organization will retain personal information only as long as necessary to fulfill the identified purposes and to satisfy legal, regulatory or business requirements. Standard retention period: . Secure disposal or anonymization practices will be applied when information is no longer required.

6. ACCESS, CORRECTION AND COMPLAINTS

The Individual has the right to request access to and correction of personal information held by the Organization. Such requests should be made in writing to the Organization's Privacy Contact identified below. The Organization will respond within a reasonable time and may require identification and a reasonable fee to process requests where authorized by law.

Privacy Contact Name:

7. THIRD-PARTY RECIPIENTS AND CROSS-BORDER TRANSFERS

The Organization may disclose personal information to third-party service providers, agents, contractors or other recipients for the purposes identified above. The Organization will take reasonable steps to ensure third parties provide a comparable level of protection.

Cross-border transfer of personal information may occur. I acknowledge that my personal information may be transferred to jurisdictions with different privacy laws. I acknowledge cross-border transfer.

8. SECURITY MEASURES

The Organization will protect personal information using administrative, technical and physical safeguards appropriate to the sensitivity of the information. Examples include access controls, encryption, secure storage and staff training. Additional measures specific to this relationship:

9. WITHDRAWAL OF CONSENT

The Individual may withdraw consent at any time by providing written notice to the Privacy Contact. Withdrawal does not affect the lawfulness of processing based on consent prior to withdrawal. I acknowledge that withdrawal may limit the Organization's ability to provide certain services.

I acknowledge the potential effects of withdrawal of consent.

10. NOTICES

Notices under this Form must be in writing and delivered to the Privacy Contact addresses provided. Preferred method of contact:

11. REMEDIES

The Parties acknowledge that violations of the terms of this Form may give rise to administrative or regulatory complaints. The Individual may pursue available remedies, including filing a complaint with the federal privacy authority or seeking other relief permitted by law.

12. GOVERNING LAW; ENTIRE AGREEMENT; SEVERABILITY

Governing Law: This Form shall be governed by and construed in accordance with the laws of the jurisdiction in which the Organization is located as indicated by its principal place of business. The Parties submit to the exclusive jurisdiction of the courts of that jurisdiction.

Entire Agreement: This Form constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior agreements and understandings, whether written or oral, relating to such subject matter.

Severability: If any provision of this Form is held to be invalid, illegal or unenforceable in any respect, the validity, legality and enforceability of the remaining provisions shall not be affected or impaired.

13. AMENDMENT; WAIVER; COUNTERPARTS

Amendment: This Form may be amended only by a written instrument signed by both Parties.

Waiver: No waiver of any provision of this Form is effective unless made in writing and signed by the waiving Party. A waiver on one occasion shall not be construed as a waiver on any other occasion.

Counterparts: This Form may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one instrument.

Individual Name:

By:

Date:

Organization Name:

By:

Date:

Enter text✕

What the PIPEDA Disclosure Form Is and When It Applies

The PIPEDA Disclosure Form communicates how an organization collects, uses, discloses, and retains personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA). It is typically completed by organizations operating in or interacting with Canadian residents to document lawful purposes, obtain consent where required, and disclose rights. For U.S.-facing teams, this form is an operational privacy disclosure rather than a U.S. statutory filing; when signed electronically, e-signature validity should meet U.S. standards such as ESIGN (15 U.S.C. ch. 96) or applicable state UETA provisions.

Why a PIPEDA Disclosure Form Matters for Cross-Border Operations

A clear disclosure reduces legal risk, documents consent, and supports privacy program audits. It helps demonstrate accountability and transparency for regulators, customers, and partners while standardizing information practice across jurisdictions.

Why a PIPEDA Disclosure Form Matters for Cross-Border Operations

Which teams complete or rely on the form

Organizations use this form to document data handling where Canadian privacy rules apply and to show notice and consent to individuals.

  • Privacy and compliance teams ensuring lawful collection and retention of personal data.
  • HR and recruitment when employee or candidate data from Canadian residents is collected.
  • Vendors and service providers documenting permitted uses and onward transfers.

Use it as part of onboarding, third‑party contracting, marketing consent, and cross‑border transfer documentation to maintain consistent privacy records.

Primary signers and responsible roles

Data Protection Officer

The Data Protection Officer (or privacy lead) is responsible for approving disclosure language, ensuring legal bases for processing are documented, and serving as the organization’s point of contact for access requests and regulator inquiries.

Authorized Representative

A named company officer, counsel, or contract manager typically signs on behalf of the data controller to confirm organizational commitments, retention limits, and approved third‑party transfers described in the disclosure.

Security and compliance controls to reference on the form

Encryption: TLS 1.2/1.3 in transit, AES-256 at rest
Audit Trail: Full timestamped signing records
Access Controls: Role-based access, MFA available
Certifications: SOC 2 Type II, ISO 27001
PHI Handling: HIPAA BAA available where required
Accessibility: WCAG 2.0 Level AA support

Step-by-step: completing a PIPEDA Disclosure Form

Follow a consistent sequence to collect data, obtain consent, and retain records to reduce downstream questions and regulatory risk.

  • 01
    Prepare: Identify data elements, purpose, and retention period.
  • 02
    Notify: Present concise disclosure at point of collection.
  • 03
    Obtain Consent: Record affirmative consent when required by context.
  • 04
    Recordkeeping: Store signed disclosure and audit trail securely.

How to configure the online disclosure workflow

Map fields, authentication, and storage settings before sending to ensure secure collection and reliable audit evidence.

Field Configuration
Delivery Method Email link; optional SMS code for recipients
Authentication Email link by default; SMS or KBA for sensitive data
Storage Location Encrypted cloud storage with access controls
Audit Capture Record IP, timestamp, and action log

Where to send and how to record delivery

Define recipients, delivery channels, and archival locations so each signed disclosure is discoverable during audits or access requests.

  • To Individual: Send the signed disclosure copy to the individual on completion.
  • Internal Record: Archive a copy in the privacy team's secure records system.
  • Third Parties: Attach disclosure statements when sharing data with vendors.
  • Regulator Requests: Maintain retrievable records for regulator or access requests.

Technical requirements for eSubmission and distribution

Confirm that your eSignature platform supports the authentication, audit logging, and storage controls required for privacy disclosures.

  • Integrations: Salesforce | NetSuite | Google Workspace | Box
  • Formats: PDF, DOCX, HTML, Excel supported
  • Security: AES-256 at rest; TLS 1.2/1.3

Timing considerations and response expectations

Deadlines vary by jurisdiction and case type. Document when disclosures are provided and when individuals exercise rights to ensure timely responses.

At Collection:

Provide disclosure at or before the time personal information is collected.

Consent Effective Date:

Record date in MM/DD/YYYY format when consent is given.

Access Requests:

Respond per applicable law; operational practice often targets 30 days.

Record Retention:

Log retention start and expiry to support auditability.

Breach Notification:

Follow regulatory timelines for breach disclosures where applicable.

Common mistakes to avoid when preparing the form

  • Using vague purpose language that does not specify how and why personal data will be used, leading to ambiguous consent.
  • Failing to identify all data recipients and cross-border transfers, which complicates access responses and regulator reviews.
  • Not capturing signer authority or role for corporate signatories, which can raise enforceability questions.
  • Keeping only scanned copies without a secure audit trail showing signer identity, timestamp, and IP address.

Key risks and potential consequences of errors

Regulatory Action: Administrative orders or fines under privacy law
Legal Exposure: Contract disputes or invalid consent claims
Reputational Harm: Loss of customer trust and business impact
Operational Delay: Slower onboarding and increased support costs
Data Breach Risk: Inadequate controls increase breach likelihood
Cross-Border Compliance: Sanctions for improper international transfers

Representative eSignature pricing and capabilities for handling disclosure forms

Compare basic pricing and core capabilities for eSignature vendors commonly used for disclosure forms. Review plan details and compliance add-ons to confirm fit for privacy-sensitive workflows.

signNow DocuSign Adobe Sign PandaDoc HelloSign
Starting Price $8/user/mo $15/user/mo $14/user/mo $19/user/mo $15/user/mo
Free Trial Yes, 7-day free trial Varies by plan Varies by plan Varies by plan Varies by plan
Bulk Send Yes (Business Premium) Varies by plan Varies by plan Yes Varies by plan
Audit Trail Yes Yes Yes Yes Yes
HIPAA Compliant Yes (BAA available) Varies by plan Varies by plan Varies by plan Varies by plan
Envelope Cap No cap 100 envelopes/user/year Varies by plan Varies by plan Varies by plan

Real-world examples of disclosure use

Practical examples show how organizations integrate disclosure forms into workflows and the outcomes they track after implementation.

Optica Ventures LLC

The interface is simple and easy-to-use for our team; more importantly, it is just as easy for our customers.

  • The team documented consent workflows for investor onboarding.
  • By standardizing the disclosure form and storing signed records, Optica reduced follow-up requests and ensured consistent answers during compliance checks.

Fertility Centers of Illinois

The airSlate SignNow team has been exceptional, responsive, the API has been great, and we're extremely happy that we chose airSlate SignNow as a company.

  • They integrated disclosures into patient intake.
  • The organization now captures signed privacy disclosures at intake and retains audit trails to support access requests and regulatory reviews.

Practical tips for accurate, audit-ready disclosures

Apply consistent drafting, version control, and storage practices so disclosures remain defensible and easy to locate during audits.

Keep language concise
Write purpose and data categories in plain language to improve comprehension and reduce the risk of challenged consent or regulatory questions.
Record consent metadata
Capture signer identity, timestamp (MM/DD/YYYY HH:MM), IP address, and method of authentication for every signed disclosure.
Use templates and versioning
Manage disclosure templates centrally and tag each executed copy with template ID and version to simplify audits and access responses.
Align retention policy
Define retention tied to legal baselines and business needs; ensure automatic archival and defensible deletion processes are in place.

Frequently asked questions about PIPEDA disclosure forms

Answers to frequent operational and legal questions to help teams implement the disclosure form accurately and in compliance with applicable rules.


Need help? Contact support

be ready to get more
Join over 28 million airSlate SignNow users