PIPEDA privacy policy requirements for small business websites

Does PIPEDA apply to your business?

PIPEDA applies to private-sector organizations that collect, use, or disclose personal information in the course of commercial activity. That covers most small business websites — contact forms, newsletter signups, online stores, and booking systems all count.

Three provinces have their own substantially similar laws: Alberta, British Columbia, and Quebec. If you operate only in one of those provinces, the provincial law applies instead — but the requirements are close enough that a good PIPEDA-style policy is the right starting point everywhere. Quebec's Law 25 is stricter in several areas, covered below.

The 10 fair information principles

PIPEDA is built on ten principles. Your privacy policy should reflect each one:

• Accountability — someone in your business is responsible for privacy compliance.
• Identifying purposes — you state why you collect personal information before or when you collect it.
• Consent — you obtain meaningful consent for collection, use, and disclosure.
• Limiting collection — you collect only what you need for the stated purposes.
• Limiting use, disclosure, and retention — you use data only for those purposes and keep it only as long as necessary.
• Accuracy — personal information is as accurate and up to date as needed.
• Safeguards — you protect data with appropriate security measures.
• Openness — your policies and practices are readily available to the public.
• Individual access — people can request access to their information and challenge its accuracy.
• Challenging compliance — people can complain to you and to the Privacy Commissioner of Canada.

What your policy must actually say

Translate the principles into concrete sections. At a minimum, your policy should identify your business, list the types of personal information you collect (contact details, account data, payment confirmations, technical data like IP addresses), explain why you collect each type, describe who you share it with (payment processors, hosting providers), state how long you keep it, and explain how visitors can access, correct, or delete their information.

It must also give a contact point for privacy questions. Vague statements like "we take privacy seriously" without specifics do not satisfy the openness principle.

Consent: the part most sites get wrong

PIPEDA requires meaningful consent — the person must understand what they are agreeing to. Pre-ticked checkboxes do not count. For sensitive information, or when the use goes beyond what a person would reasonably expect, you need express opt-in consent rather than implied consent.

Review every form on your site: does each one explain what the information is for, and does the visitor take a clear affirmative action? Newsletter signups, in particular, need an unchecked box or a double opt-in.

Cookies and tracking

Analytics tools, advertising pixels, and social media embeds all collect personal information under PIPEDA. Your policy should disclose what tracking technologies you use, what they collect, and how visitors can control them.

A cookie banner that just says "we use cookies" without linking to a real policy explaining the details is not meaningful consent. List the categories — necessary, analytics, marketing — and give visitors a genuine choice on the non-essential ones.

Quebec's Law 25: stricter rules

If you have customers in Quebec, Law 25 (the Act respecting the protection of personal information in the private sector) adds requirements: you must designate a person responsible for privacy, conduct privacy impact assessments for certain projects, notify the Commission d'accès à l'information and affected individuals of serious privacy incidents, and meet stricter consent and transparency rules.

Businesses operating across Canada typically write one policy that meets the highest standard — which increasingly means Law 25.

When things go wrong: breach response

Every website owner should know the breach rules before a breach happens, because the clock starts fast. Under PIPEDA, if a breach of security safeguards creates a real risk of significant harm to an individual — identity theft, fraud, humiliation, damage to reputation or relationships — you must report it to the Office of the Privacy Commissioner and notify the affected individuals as soon as feasible. 'Significant harm' is judged by the sensitivity of the information and the probability of misuse, not by whether harm has already occurred.

You must also keep a record of every breach of security safeguards for 24 months, even ones that didn't meet the reporting threshold — the OPC can ask to see it. Quebec's Law 25 layers its own incident rules on top for Quebec residents, with notification to the Commission d'accès à l'information.

Your privacy policy should tell visitors what you'll do if their data is compromised: who you'll notify, how, and how fast. Writing the plan before you need it is the difference between a managed incident and a panic.

Access requests: what you must be ready for

PIPEDA gives individuals the right to request access to the personal information you hold about them and to challenge its accuracy — and your policy must explain how. In practice, this means having a process: a contact point (not just 'info@'), a way to verify the requester's identity without collecting more data than necessary, and a reasonable timeline to respond.

Most small businesses rarely get formal access requests — but the first one usually arrives right after a dispute with a customer or ex-employee, when your records are under the most scrutiny. Know where your data lives (forms, email, booking tools, analytics exports, backups) before you need to find it.

How enforcement actually works: the OPC complaint path

The Privacy Commissioner of Canada doesn't fine small businesses the way European regulators do — enforcement works through complaints and publicity. An individual who thinks you've mishandled their data can complain to you first, then to the OPC. The Commissioner investigates and can issue findings and recommendations, and may publicize them.

For a small business, a public finding of non-compliance is the real penalty: it lands in search results attached to your business name, and it tells every future customer exactly what went wrong. Most OPC cases settle through commitments to fix the practice — which is much easier to do before a complaint exists.

Employee data and business contacts

Two common blind spots. First, employee information: PIPEDA's employee-data rules are narrower than most owners assume, and Alberta, BC, and Quebec have their own employee-privacy frameworks — if your site doubles as your HR portal (job applications, staff logins), your policy should address that data separately from customer data. Second, business-contact information — a person's name, title, and work email or phone — has reduced protection under PIPEDA, but that doesn't mean zero: collect only what you need, say why, and keep it secure.

Job applicants deserve a line too: if you keep resumes on file, say how long you keep them and that applicants can ask for deletion.

Website privacy checklist

Before you publish your policy, walk through this list:

• Every form states what the information is for, at or before the point of collection
• Newsletter and marketing signups use unchecked boxes or double opt-in — no pre-ticked consent
• Your policy lists every tracking tool by category (necessary, analytics, marketing) with a genuine opt-out for non-essential ones
• A named privacy contact with a working email is published in the policy
• You know where personal data lives: forms, email, booking tools, analytics, backups
• You have a breach plan: who reports to the OPC, who notifies affected individuals, and how
• The policy is dated, versioned, and reviewed at least yearly — and visitors are told when it changes

Most small businesses fail on two of these: meaningful consent on signups, and having any breach plan at all. Fix those two and you're ahead of the field.

Keeping your policy current

A privacy policy is not a one-time document. Update it whenever you add a new tool, start collecting new data, or change how you use existing data — and tell your visitors when you do. PIPEDA's accountability principle means someone should own this: assign privacy responsibility to a named person, even in a one-person business.

Review the policy at least once a year, and keep a dated copy of each version so you can show what was in force at any given time.