Is a postal code personal information?

How small a postal code is

Statistics Canada: "The average number of households served by a postal code is approximately 19, but the number can range from zero to 10,000 households." Canada Post: in urban areas the last three characters may indicate a "specific city block (one side of a street between two intersecting streets)" or a "single building".

Statistics Canada's own disclosure rule treats areas at that scale as too small to publish: no data is released for an area whose population is "less than 100", and individual block-faces "will be too small to meet the above-specified population size thresholds."

What about the first three characters?

The forward sortation area (FSA) is much larger. Statistics Canada: an FSA averages "approximately 8,000" households, "but the number can range from zero to more than 60,000." No Canadian authority we found sets a population threshold for keeping an FSA.

The deeper problem is what a partial code reveals. The EU's Article 29 Working Party showed that keeping the first digits of a postcode still places people: in its example, "750*" means every individual resides in Paris. An FSA does the same for a Canadian city, so a document that already hides the city gives it back through the FSA.

In a client document

A postal code rarely appears alone. It sits beside a street, a date of birth and an employer, which is exactly the combination de-identification guidance warns about. The practical rule for AI work: replace the full code, keep the province if the task needs it, and review codes that belong to government offices rather than the client.

• Replace full postal codes (A1A 1A1) wherever they are part of an address
• Do not keep the FSA as a compromise; it restores the city
• Province can usually stay: HIPAA, for comparison, removes only units smaller than a state
• Watch for codes inside other numbers, such as receipt or file numbers, which are not addresses