PIPEDA and Fax.Plus

The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's federal privacy law for the private sector. It sets the rules for how organizations collect, use and disclose personal information in the course of commercial activities, and it applies whatever the format of that information, including faxed documents.

Fax.Plus replaces insecure hardware fax machines with an encrypted cloud fax platform, helping your organization protect the personal information you send and receive by fax.

What PIPEDA is and why it matters

PIPEDA is built on ten fair information principles, including accountability, consent, limiting use and disclosure, and safeguards. Two of them are especially relevant when you choose a fax provider:

• Accountability: your organization remains responsible for personal information it transfers to a third party for processing, such as a cloud fax provider. You must make sure that provider offers a comparable level of protection.
• Safeguards: personal information must be protected by security measures appropriate to its sensitivity, against loss, theft and unauthorized access, disclosure, copying, use or modification.

Organizations subject to PIPEDA must also report breaches of security safeguards that create a real risk of significant harm to the Office of the Privacy Commissioner of Canada, and notify the affected individuals.

Traditional fax machines make this difficult. Documents sit in an output tray where anyone nearby can read them, there is no encryption and there is no reliable record of who accessed what. Moving to a secure cloud fax platform is an important step in protecting personal information and staying on the right side of PIPEDA.

How Fax.Plus helps you comply

Fax.Plus encrypts your faxes from upload through storage and delivery within our infrastructure, gives you control over who can access them, and lets you choose to keep your data in Canada.

Encryption in transit

Data moving between our apps (web, mobile and API) and our servers is protected with TLS 1.2 or higher. Please note that the final leg of a fax, the call placed to the recipient's fax number, travels over the telecom carrier's network rather than Fax.Plus systems.

Encryption at rest

All stored faxes are encrypted with 256-bit AES, with a unique encryption key for each user.

Canadian data residency

Enterprise customers can choose to store their live data and backups in Canada, with Toronto and Montreal regions available, so personal information stays in the country.

Access control

Protect accounts with two-factor authentication, and use role-based permissions and dedicated fax numbers so only authorized staff handle personal information. Enterprise teams can also enforce 2FA for every member and sign in with SAML SSO.

Audit trails and delivery confirmation

Keep a searchable record of every fax sent and received, with timestamps and delivery confirmations, ready for privacy reviews and internal audits.

Retention controls

Set a document retention period so faxes are permanently purged after the number of days you choose, helping you keep personal information only as long as you need it.

Best practices for your team

• Use strong passwords and enable two-factor authentication for every user.
• Limit access to personal information to authorized staff through roles and permissions.
• Double-check the recipient's fax number before sending, and use a confidentiality cover sheet.
• Review your retention settings and delete documents you no longer need.
• Train staff on how to handle personal information by fax.

Related articles

• Alohi Suite security and data protection features
• PHIPA compliant fax for Ontario healthcare

Have questions about using Fax.Plus under PIPEDA? Contact our support team and we will be happy to help.

This article is for general information only and does not constitute legal advice. Please consult your own legal or privacy advisers about your obligations under PIPEDA.