PIPEDA

The Personal Information Protection and Electronic Documents Act, in force since 2000, does two jobs that usually get separate laws elsewhere. Part 1 is the privacy regime: consent-based collection, use limited to stated purposes, safeguards, and access rights for individuals. Part 2 is the less famous half, and it's the one that recognizes electronic documents and signatures as functional equivalents of paper for federal purposes.

The e-signature side

Part 2 defines an electronic signature as a signature in electronic form that's in, attached to, or associated with an electronic document. For most regulated contexts a standard electronic signature suffices; a 'secure electronic signature', a stricter category defined by regulation and based on asymmetric cryptography, is reserved for specific federal use cases like statutory declarations. Provinces have parallel statutes (like Ontario's Electronic Commerce Act) covering provincial-law contracts.

The privacy side, which signing tools must respect

When someone signs your form, you're collecting personal information, so PIPEDA's privacy half applies to you as the form owner: collect with consent, use it for the purpose you stated, protect it with appropriate safeguards, and don't keep it longer than needed. Your e-signature vendor is part of those safeguards.

How Sign Sail lines up

Sign Sail captures explicit signer consent, limits collection to what the form asks, encrypts data in transit, and enforces retention windows per plan, with submissions deleted on schedule and an export path so you can fulfil access requests. Servers run in Canada and the US, which the privacy policy discloses, with the US leg covered by standard contractual clauses for EU data.