A privacy complaint in Canada is not a single form. Which office takes it depends on who mishandled the information, and the federal regulator expects the steps in a particular order. Filing in the wrong place, or in the wrong sequence, mostly costs you time.
Step one is the organization, not the regulator
The Office of the Privacy Commissioner of Canada (OPC) states the sequence plainly on its Report a concern page: always try to resolve the issue with the organization first, because "if you do not take this step first, we may not be able to accept your complaint."
In practice that means writing to the organization's privacy officer — a role PIPEDA requires organizations to designate — and keeping the correspondence. State what information is involved, what you believe was done wrong (collected without consent, used for a different purpose, disclosed, kept inaccurately, or access refused), and what outcome you want. If the organization does not respond, or the response does not resolve it, that record becomes the foundation of the formal complaint.
Decide which law and which office apply
Two federal laws cover two different worlds:
PIPEDA covers private-sector organizations' handling of personal information in commercial activity, and federally regulated industries (banks, telecommunications, interprovincial transport) everywhere in Canada.
The Privacy Act covers federal government institutions. A complaint about a department or agency goes to the OPC under that Act instead.
British Columbia, Alberta, and Quebec have their own private-sector privacy laws that the federal government has deemed substantially similar to PIPEDA. For a local business in one of those provinces, the provincial commissioner is usually the right door: the OIPC in British Columbia, the OIPC in Alberta, and the Commission d'accès à l'information in Quebec. Health information is a frequent exception, with its own provincial legislation and oversight in several provinces.
Filing the formal complaint
If the organization has not resolved the concern, the OPC's formal complaint page walks through intake for both PIPEDA and Privacy Act complaints. There is no fee, and you do not need a lawyer. The OPC is direct about timelines: it is dealing with a high volume of complaints and warns of processing delays of several months.
A complaint that states facts rather than conclusions moves faster: the organization's legal name, dates, what information was involved, the correspondence with its privacy officer, and the specific remedy sought.
Know what the Commissioner can and cannot do
The OPC is an ombudsman-style regulator under PIPEDA. It can investigate, attempt early resolution, and issue a report with findings and recommendations. It cannot issue fines or binding orders under the current Act, and a recommendation is not self-enforcing.
That limit has a defined next step. If the Commissioner's report does not resolve a PIPEDA complaint, the complainant can apply to the Federal Court for a hearing — within one year of the report. The court, unlike the Commissioner, can order an organization to correct its practices and can award damages in some circumstances.
None of this is a reason to skip the process. Findings are public accountability: the OPC's published investigations and compliance agreements — including the recent Loblaw commitments covered in our report on the October notification commitments — exist because complaints and investigations put the facts on the record. A well-documented complaint is what starts that record.