What Keel scores in PIPEDA, and what it does not

Keel scores Part 1 and Schedule 1, and not all of Part 1. 23 provisions and ranges of the Act are out, 4 of them outside Part 1 entirely. This page is all of them by section, so you can disagree with a specific line instead of with a total.

104scored rows

56Schedule 1 clauses

19out, inside Part 1

4out, beyond Part 1

7near misses

The rule

A provision is scored where, read alone, it tells an organization to do something, not to do something, or to be able to demonstrate something. Out: interpretation and definitions; provisions addressed to the Privacy Commissioner, to a government institution, to the Governor in Council or to Parliament; and provisions that state only a legal consequence with no residual action.

Schedule 1 is scored whole. Every one of Schedule 1’s 56 numbered clauses is scored, including the cross-reference clauses and the clauses s.5(2) marks as recommendations by using "should". That is a deliberate choice against a tidier denominator. Section 5(1) incorporates Schedule 1 wholesale, so subtracting clauses would mean publishing a judgment about which clauses of the incorporated standard are not really obligations, on a standard whose own numbering is what practitioners and the Commissioner cite by. It also means anyone can count the numbered clauses and get 56 without taking Keel’s word for it.

Out of scope is not the same as inapplicable. Out of scope is not the same as inapplicable. An organization is subject to the whole Act, and a workspace scoring 100% here has not been told the remedies, the Commissioner’s audit power or the offence provision do not reach it. What Keel scores is the set of duties an organization can implement, mark and evidence, because those are the ones a readiness percentage can honestly be measured against.

The near misses

Each of these reads like a duty an organization owes, and is still out. They are the calls most worth checking first, which is why they are named rather than absorbed into the counts above.

s.28 States a legal consequence, with no separate action

Offence and punishment.

Makes knowingly contravening s.8(8), s.10.1, s.10.3(1) or s.27.1(1), or obstructing the Commissioner, an offence carrying a fine. A reader may reasonably expect the provision with the largest number attached to it to be scored. It is out because it is what happens after a breach of duties that are themselves scored, and adds no action of its own. Same call COPPA makes on §312.9.
s.5(1) Triggers a duty that is scored, and is carried in that row

Every organization shall comply with the obligations set out in Schedule 1.

The most duty-shaped sentence in the Act, and it is not a scored row. It is out because it is the hinge that makes Schedule 1 binding, and Schedule 1 is scored clause by clause: all 56 of them. Scoring the hinge as well would ask a customer once what the 56 rows already ask in full.
s.4(1) Says who the Act reaches, rather than what to do

Application to organizations collecting in the course of commercial activities.

Reads as the provision that binds an organization at all, which is exactly why it is not a row: it says who is inside the Act rather than what they must do. An organization cannot be more or less ready against it. What it says is stated in full on the framework page instead.
s.9(2.3) Binds the Commissioner, a court, a government institution or Parliament

The government institution’s thirty days.

A hard clock, and the organization is waiting on it, so it looks like something to track. It binds the institution. The organization-side consequence of the same clock is scored, at 9(2.2)(b), and this provision is stated in that row’s summary.
s.10.1(8) Defines a term, or says how the Act is to be read

The factors relevant to a real risk of significant harm.

The closest call in the register. It is a list an organization genuinely works through when it assesses a breach, so it feels like a duty. It is out because it defines the threshold in s.10.1(1) rather than adding an action; scoring both would ask a customer to implement the meaning of a phrase. The assessment duty it qualifies IS scored.
ss.31-51 Belongs to a Part of the Act outside this framework

Part 2, Electronic Documents.

Twenty-one sections of the same Act, unscored, which is the largest single omission here and the one least visible from the framework name. Keel models Part 1. Part 2 is about secure electronic signatures and electronic equivalents to statutory paper requirements, creates no personal-information duty, and binds federal departments rather than organizations generally.
Schedule 1 recommendation clauses Defines a term, or says how the Act is to be read

The clauses that say "should" rather than "shall".

Not an exclusion, and named here so its absence from this list is not read as an oversight. Section 5(2) says those clauses are recommendations, and they are scored anyway, marked as recommendations in their summaries. Dropping them would mean publishing a judgment about which clauses of an incorporated standard are not really obligations, and would break the property that anyone can count Schedule 1 and get 56.

Out of scope, by section

Inside Part 1 19

Provisions of the Part Keel does model, that are not scored rows.

s.1 Defines a term, or says how the Act is to be read

Short title. Names the Act; imposes nothing.
s.2(1) Defines a term, or says how the Act is to be read

Definitions. The defined terms are load-bearing and are used throughout the scored rows, including "commercial activity", "organization", "personal information" and "breach of security safeguards". They are simply not scored rows.
s.2(2) Defines a term, or says how the Act is to be read

Says a reference to clause 4.3 or 4.9 of Schedule 1 does not include the note accompanying it. Stated in the summaries of 4.3 and 4.9 rather than scored.
s.3 Says who the Act reaches, rather than what to do

Purpose of Part 1. States the balance Parliament struck; imposes no duty.
s.4(1), (1.1), (2), (3) Says who the Act reaches, rather than what to do

Application. Says who is bound and in respect of what. It is the gate on everything else rather than a duty of its own; an organization cannot implement s.4(1).
s.4.01 Says who the Act reaches, rather than what to do

Business contact information is out of Part 1 where collected, used or disclosed solely to communicate with the individual about their work. A carve-out from application, not a duty.
s.4.1(1)-(4) Binds the Commissioner, a court, a government institution or Parliament

Certificates under ss.38.13 and 38.41 of the Canada Evidence Act. (1) disapplies the access right; (2) to (4) direct the Commissioner.
s.5(1) Triggers a duty that is scored, and is carried in that row

Incorporates Schedule 1. Scoring it would ask a customer, once, the question the 56 Schedule 1 rows already ask in full.
s.5(2) Defines a term, or says how the Act is to be read

Says "should" in Schedule 1 is a recommendation. An interpretation rule, and the reason the recommendation clauses are marked as such in their summaries rather than dropped from the count.
s.7.1(1) Defines a term, or says how the Act is to be read

Definitions for s.7.1: "access", "computer program", "computer system", "electronic address".
s.8(5) States a legal consequence, with no separate action

Failure to respond in time is deemed a refusal. A consequence of breaching 8(3), with no separate action; stated in 8(3)’s summary.
s.9(2.1) Triggers a duty that is scored, and is carried in that row

States when an organization must comply with 9(2.2), and what the two kinds of request are. A pure trigger, carried in the summaries of 9(2.2)(a) and 9(2.2)(b).
s.9(2.3) Binds the Commissioner, a court, a government institution or Parliament

Directs the government institution to decide within thirty days whether it objects, and limits its grounds. Its clock is stated in 9(2.2)(b)’s summary, because that is the organization-side consequence of it.
s.10.1(7) Defines a term, or says how the Act is to be read

Defines "significant harm".
s.10.1(8) Defines a term, or says how the Act is to be read

Lists the factors relevant to whether a breach creates a real risk of significant harm. Definitional, like (7); both are stated in 10.1(1)’s summary, which is the duty the threshold test attaches to.
ss.11-17.1 Binds the Commissioner, a court, a government institution or Parliament

Division 2, Remedies. Complaint filing, the Commissioner’s investigations, discontinuance, reports, Federal Court hearings and orders, compliance agreements. s.16’s remedies are orders a court may make, not standing duties.
ss.18-19 Binds the Commissioner, a court, a government institution or Parliament

Division 3, Audits. The Commissioner’s audit power and audit report.
ss.20-29 Binds the Commissioner, a court, a government institution or Parliament

Division 4, General, except s.27.1(1), which IS scored. The rest binds the Commissioner (ss.20-25), the Governor in Council (s.26) or Parliament (s.29), or is an individual’s whistleblowing right (s.27), a saving clause (s.27.1(2)), a definition (s.27.1(3)), or the offence provision (s.28).
s.30 Transitional, and its period has elapsed

Division 5, Transitional. Time-limited displacement of Part 1 in provinces with their own legislation and for personal health information. Part 1 came into force 1 January 2001, and s.30(2) and s.30(2.1) gave those displacements three years and one year, so both had expired by 2004.

Outside Part 1 altogether 4

Keel models Part 1. These are the rest of the Act, and they are a different subject.

ss.31-51 Belongs to a Part of the Act outside this framework

Part 2, Electronic Documents. Secure electronic signatures, electronic alternatives to statutory paper requirements, and which federal Acts may be satisfied electronically. It creates no personal-information duty and binds federal departments and the Governor in Council rather than organizations generally.
ss.52-71 Belongs to a Part of the Act outside this framework

Parts 3 to 5, consequential amendments to the Canada Evidence Act, the Statutory Instruments Act and the Statute Revision Act.
s.72 Belongs to a Part of the Act outside this framework

Part 6, Coming into force.
Schedules 2, 3 and 4 Belongs to a Part of the Act outside this framework

Schedules 2 and 3 list Acts and instruments for Part 2’s purposes; Schedule 4 lists organizations to which Part 1 applies in respect of specified information under s.4(1.1). Lists, not duties.

Where the inventory came from

Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5), counted against the consolidated text published by the Department of Justice on the Justice Laws website, retrieved 2026-08-27, which states on its face "Act current to 2026-06-21 and last amended on 2025-03-04". The scope calls are Keel’s, applying the rule above to the published text, and they have had no external legal review.

Think one of these belongs in scope? That is the point of publishing it, so tell us which line. The full framework is at PIPEDA.