Yes — working alone doesn't create a privacy-law exemption; only a handful of provincial statutes do that, and only inside their own province.
Short answer
Yes. PIPEDA applies to any organization handling personal information "in the course of commercial activity," and a self-employed agent’s real estate trade is squarely commercial activity regardless of headcount. The only carve-outs are provincial: Alberta, British Columbia and Quebec each have their own substantially-similar privacy statute that displaces PIPEDA for activity handled entirely inside that province.
Per the Privacy Commissioner’s own PIPEDA brief, PIPEDA applies where two elements are present: personal information — "any factual or subjective information, recorded or not, about an identifiable individual" — and commercial activity, defined as "any particular transaction, act, or conduct, or any regular course of conduct that is of a commercial character." Nothing in that test turns on how many employees the organization has.
treadstonelaw’s own plain-language test puts the same test plainly for an Ontario owner-operator: "If your business fits both [elements], PIPEDA is very likely already part of your legal obligations, even if you’ve" never thought about it.
Alberta, British Columbia and Quebec each have their own private-sector privacy statute recognized as "substantially similar" to PIPEDA, and organizations in those provinces "are generally exempt from PIPEDA regarding information handled within their respective provinces" — but PIPEDA still governs any interprovincial or international handling of that same information, per the Commissioner’s brief.
In practice that means a BC agent using a US-hosted CRM, or referring a client’s file to a colleague in another province, keeps PIPEDA in play even though BC’s own statute otherwise covers their day-to-day activity. Once PIPEDA applies, ten fair-information principles follow — accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and challenging compliance.
See also: the consent standard for a specific disclosure and what that means for a vendor contract.
A 30-minute call is enough to map PIPEDA’s test onto how you actually run your files.
