Your rights: caller data, privacy law and persistent callers

What you can demand from an organisation that holds your data, where federal law stops and provincial law starts, and the specific rules that bind debt collectors.

Last reviewed 2026-07-26. Written for readers in Canada.

When a company keeps calling, the useful question is usually not “can I make them stop” but “which law binds this particular caller”. Canada splits that answer across federal and provincial lines, and the split is where most advice on the internet goes wrong.

Finding out what an organisation holds about you

The Personal Information Protection and Electronic Documents Act — PIPEDA — is the federal private-sector privacy law, overseen by the Office of the Privacy Commissioner of Canada. It gives you a general right to ask a business what personal information it holds about you, how it is being used, and to whom it has been disclosed. You can also ask for corrections to information that is wrong or incomplete.

The mechanics are specific and worth knowing precisely:

• The organisation must respond within 30 calendar days of receiving your request. Acknowledging receipt does not count as responding.
• It must be at little or no cost to you. If you are quoted an unreasonable fee, that is itself grounds for a complaint.
• If it needs longer, it may take up to 30 additional days, but it must tell you within the first 30 — giving the new deadline, the reason, and your right to complain to the Privacy Commissioner.
• If it refuses, in whole or in part, it must explain in writing, give reasons, and tell you about your right to complain.

Start with the organisation’s privacy officer. Most refusals are misunderstandings and resolve faster directly than through a regulator. If that fails, complain to the OPC — and note the deadline: a complaint about a refused access request must be made within six months of the refusal.

The OPC works on an ombudsman model. It investigates and issues findings rather than levying fines directly, and matters can proceed to the Federal Court afterwards. Expect a process, not an instant remedy.

Which privacy law applies to you

PIPEDA is federal, but it is not the only game. Alberta, British Columbia and Quebec have their own private-sector privacy statutes that have been declared substantially similar to PIPEDA, and for organisations operating within those provinces the provincial law generally applies instead. The right of access exists in all of them, but the regulator you complain to and some of the procedural detail differ. If you live in one of those three, check your provincial commissioner first.

Debt collectors: provincial rules, and they are strict

Debt collection is regulated provincially, not federally. There is no national Canadian equivalent of the American FDCPA. Each province licenses collection agencies and sets its own conduct rules, so what is permitted in one province may be a violation in the next.

Ontario is a useful worked example, under the Collection and Debt Settlement Services Act. A licensed collection agency in Ontario:

• cannot call on a Sunday outside the window of 1:00 p.m. to 5:00 p.m.;
• cannot call on a statutory holiday at all;
• cannot call between 9:00 p.m. and 7:00 a.m. on any day;
• after making contact, cannot contact you more than three times in any seven-day period on behalf of the same creditor.

Two things you can do in Ontario that stop contact outright:

1. Direct them to your lawyer. Notify the agency, by a verifiable method, that it must communicate only with your lawyer or licensed paralegal, and provide the contact details.
2. Dispute the debt and require court. Send notice by a verifiable method — registered mail or email, so you can prove it was sent and when — stating that you dispute the debt and that you require the matter be taken to court.

Complaints about a collection agency in Ontario go to Consumer Protection Ontario. Other provinces have equivalent statutes and their own regulator, with different hours, contact limits and complaint routes — so confirm the rules for the province you live in rather than assuming Ontario’s apply.

One further distinction that catches people out: these rules govern licensed collection agencies. Whether they also bind an original creditor pursuing its own debt varies by province. If the caller is the company you originally dealt with rather than an agency acting for it, check your province’s statute before assuming the same limits apply.

Where each complaint actually goes

• A telemarketer breaking the calling rules — the CRTC, through the National DNCL website. See telemarketing rules and the National Do Not Call List.
• A business mishandling your personal information — the Office of the Privacy Commissioner of Canada, or your provincial commissioner in Alberta, British Columbia or Quebec.
• A collection agency — your provincial consumer protection regulator.
• Fraud, attempted or successful — your local police, and the Canadian Anti-Fraud Centre.

This page explains published regulatory rules and is not legal advice. For a specific dispute, particularly one involving a debt or a limitation period, consult a lawyer or licensed paralegal in your province.