--- title: "PIPEDA and employee surveys - compliance guide | Sparkbay" description: "What Canada's PIPEDA, and Alberta's and British Columbia's PIPA, require when you survey employees, and how Sparkbay helps you meet each obligation." url: "https://sparkbay.com/en/pipeda-compliance" language: "en" --- Compliance # Employee surveys and PIPEDA ## What the Personal Information Protection and Electronic Documents Act (PIPEDA) asks when you survey your employees in Canada, and how Sparkbay helps you meet each obligation. - ISO/IEC 27001 certified - Hosted in Quebec - Hosted in Canada - Hosted in Europe - Hosted in Canada or Europe - Results by group, never by person [Schedule a demo](https://sparkbay.com/en/request-demo) [Talk to our team](https://sparkbay.com/en/contact-form) ![Sparkbay heatmap with participation, attrition risk and driver scores for each group](https://sparkbay.com/content/images/feature-heatmap-bg.png) [Which law applies](https://sparkbay.com/en/pipeda-compliance#which-law) · [Principles](https://sparkbay.com/en/pipeda-compliance#principles) · [How Sparkbay helps](https://sparkbay.com/en/pipeda-compliance#sparkbay) · [Breaches](https://sparkbay.com/en/pipeda-compliance#breaches) · [FAQ](https://sparkbay.com/en/pipeda-compliance#faq) Which law applies ## Which law covers your employees' data ### In Canada, the law that protects employee information depends on who regulates your organization and where. Public bodies follow their own public-sector laws. Federally regulated employers PIPEDA covers the employee information of banks, airlines, railways, telecommunications companies and other federally regulated businesses, wherever they operate in Canada. Alberta and British Columbia Each province's Personal Information Protection Act (PIPA) covers the employee information of provincially regulated private employers. Quebec Quebec's private-sector act, as amended by Law 25, applies instead. [Law 25 compliance →](https://sparkbay.com/en/law-25-compliance) Other provinces and territories No general privacy statute covers the employee information of provincially regulated private employers. PIPEDA's principles remain a sound reference for a survey program. Principles ## What PIPEDA asks of an employee survey ### PIPEDA's ten fair information principles, read for a survey program ### Name someone accountable Designate a person accountable for compliance. When a provider processes data for you, you remain responsible for it and must protect it by contract. ### Say why you ask Tell employees why the survey collects their information, at or before the time you collect it, and make your privacy practices easy to find. ### Obtain meaningful consent Employees must understand what they agree to. For a survey, that means a clear notice and voluntary participation. ### Collect and keep only what you need Collect only what the survey's purpose requires, use it only for that purpose, and destroy or anonymize what you no longer need. ### Protect it Protect personal information with safeguards suited to its sensitivity: physical, organizational and technical. ### Answer employees' requests Employees can ask to see their personal information, have it corrected, and challenge how you comply. How Sparkbay helps ## How Sparkbay meets each obligation ### Confidentiality and security built into the platform, and commitments in our contract ### Built into the platform - **A minimum for every score.** Scores appear only for groups that reach your anonymity minimum, 5 respondents by default and set per organization. - **Comments without names.** Comments appear without names, and only when enough different people have commented to reach your anonymity minimum. - **Same thresholds in exports.** PowerPoint decks and printable reports apply the same thresholds as the dashboard. - **Encrypted and protected.** Employee personal data is pseudonymized, encrypted in transit and at rest, and access is role-based. - **Access you control.** You decide who sees what. Managers can be limited to their own teams, and you choose who sees the whole organization. Access can follow your org chart automatically and be adjusted by hand. - **Activity log.** Your administrators can review an activity log of key actions taken in your account. ### Our commitments - **ISO/IEC 27001.** Sparkbay's information security management system is certified to ISO/IEC 27001:2022 and audited by an independent certification body. - **Hosting.** Your data is hosted on Microsoft Azure, in Quebec. - **Hosting.** Your data is hosted on Microsoft Azure, in Canada. - **Hosting.** Your data is hosted on Microsoft Azure, in Europe. - **Hosting.** Your data is hosted on Microsoft Azure. - **Hosting.** Your data is hosted on Microsoft Azure: in Quebec (Canada) for our Quebec and Canadian customers, and in the European Union for our European customers. - **Data processing agreement.** Sparkbay processes your employees' data on your behalf, and our data processing agreement sets out the obligations of each party. - **Never sold.** Sparkbay will not sell, rent or trade personal information to any third party. - **Deletion when your contract ends.** When your contract ends, we delete your organization's data from our production systems on request. - **Rights for every employee.** Employees can ask to access, correct or delete their personal information. Certification, hosting, encryption, sign-in and the documents for your security review: [Security and privacy →](https://sparkbay.com/en/security) [Schedule a demo](https://sparkbay.com/en/request-demo) Breaches ## If a breach happens ### What PIPEDA requires, and how Sparkbay watches over your data ### What PIPEDA requires - Report to the Privacy Commissioner of Canada any breach of security safeguards involving personal information that creates a real risk of significant harm. - Notify the people affected, and any organization that can reduce the harm. - Keep a record of every breach for 24 months, whatever the risk. - In Alberta, PIPA also requires a report to the province's commissioner when there is a real risk of significant harm. ### How Sparkbay watches over your data - **Monitored continuously.** Automatic alerts reach our team by push notification and email when something needs attention. - **Automated backups.** The database is backed up automatically, with point-in-time restore if something goes wrong. - **Encrypted at rest.** Our production database is encrypted at rest with transparent data encryption (AES-256). - **A protected network.** Customer traffic reaches Sparkbay through Cloudflare's network, web application firewall and bot protection. Our application uses a private connection to its database, with managed identities instead of passwords. FAQ ## Frequently asked questions ### Which privacy law covers our employee survey? It depends on who regulates your organization. PIPEDA covers federally regulated employers, such as banks, airlines and telecommunications companies. Provincially regulated private employers follow PIPA in Alberta and British Columbia, and Law 25 in Quebec. In the other provinces and territories, no general privacy statute covers their employee information, and PIPEDA's principles remain a sound reference. ### When is employee consent needed? When the information goes beyond what you need to establish, manage or end the employment relationship. For that need, PIPEDA lets a federally regulated employer collect employee information without consent as long as employees are told, and Alberta's and British Columbia's PIPA have similar rules. Either way, tell employees what the survey collects and why, and keep participation voluntary. ### Who is accountable for the survey data? Your organization. Under PIPEDA, an organization stays responsible for personal information it transfers to a service provider for processing, and must protect it by contract. Sparkbay processes your employees' data on your behalf, and our data processing agreement sets out the obligations of each party. ### Can survey data be stored outside Canada? Yes. PIPEDA does not prohibit it: you stay accountable for the information, must protect it by contract, and should tell employees it may be processed in another country. Sparkbay hosts its Canadian customers' data in Canada. Service providers such as SendGrid (email), Twilio (text messages), OpenAI (AI comment summaries) and Cloudflare (network) also handle some data: ask us for the full list. ### How long can we keep survey answers? As long as you need them for the purposes you stated. PIPEDA asks organizations to set minimum and maximum retention periods, and to destroy or anonymize information they no longer need. Sparkbay keeps answers while your account is active, and deletes your data on request when your contract ends. #### Need an employee survey that meets PIPEDA? [Schedule a demo](https://sparkbay.com/en/request-demo)