Start or fix 

Small Canadian Businesses: Copy Ready Privacy Policy and Checklist

CloudSprout team · October 2026 · 10 min read

Yes, if you handle customer data as part of your business in Canada, you generally need a privacy policy under PIPEDA, and in some provinces under provincial law. Start with three moves: appoint one person as your privacy contact, publish a short policy covering what you collect, why, and for how long, and check that your actual practices match what the policy says before you hit publish. If you operate only within Quebec, Alberta, or BC, their provincial laws may apply instead, but watch for any cross-border data transfers that pull PIPEDA back into play.

TL;DR:

  • Quebec, Alberta, and British Columbia businesses follow provincial rules for local activity, but PIPEDA applies when customer data crosses provincial or national borders.
  • Disclose each data category’s purpose, consent basis, recipients, storage location, retention period, and access or deletion process, including any U.S. cloud or payment provider.
  • Businesses serving even occasional Quebec customers should review their practices against Law 25 and consider applying its stricter consent standards across all provinces.
  • Report qualifying breaches and notify people at risk, but keep records of every incident, even those below the reporting threshold.

Table of Contents

When does PIPEDA or a provincial law apply to your business?

PIPEDA covers private-sector organizations engaged in “commercial activity,” a phrase that covers almost anything involving an exchange of money or data for a product or service. Selling a product through your website, running an email newsletter with a mailing list, or taking customer bookings across provincial lines all count. A plumber in Hamilton collecting names and addresses for service calls is doing commercial activity just as much as an online retailer shipping across Canada. If you use AI tools, read AI data privacy in Canada as well.

Federally regulated organizations, such as banks, airlines, and telecommunications companies, along with their employees, are always covered by PIPEDA regardless of province. That part never changes based on where you incorporate.

Provinces with privacy laws deemed “substantially similar” to PIPEDA, currently Quebec, Alberta, and British Columbia, handle private-sector data within their own borders under their own statutes instead of PIPEDA. But PIPEDA still applies the moment that data crosses a provincial or national border, which is common for any business using cloud software, payment processors, or shipping carriers based outside the province.

Quick triggers that put you under PIPEDA or a provincial equivalent:

  • You sell goods or services online to customers anywhere in Canada.
  • You collect emails, phone numbers, or addresses for marketing or service delivery.
  • You store customer data with a cloud provider or CRM hosted outside your home province.
  • You operate a loyalty program, booking system, or membership list.

What to include in a privacy policy for a small-business website

A workable policy does not need to be long. It needs to be accurate and specific enough that a customer can understand what happens to their information. The OPC’s Privacy Guide for Businesses walks through what a compliant program covers, and that structure translates directly into policy content. Review your policy once a year with the rest of your site; here is how to keep a small business site healthy.

  1. List every category of personal information you collect: name, email, phone, payment details, location data, browsing behaviour.
  2. State the specific purpose for each category, not a vague catch-all like “to improve our services.”
  3. Note the legal basis or consent type: implied consent for routine order processing, express consent for marketing emails or sensitive data.
  4. Disclose any third parties who receive the data, such as a payment processor, shipping carrier, or email marketing platform.
  5. Say where data is stored and whether it crosses into the United States or elsewhere, since cloud hosting often does.
  6. State how long you keep each category of data before deleting or anonymizing it.
  7. Explain how a customer can access, correct, or request deletion of their information.
  8. Name a contact person or role (not just a generic inbox) responsible for privacy questions and complaints.

Skipping the third-party and cross-border sections is the most common gap. Most small businesses use at least one American-based tool, whether that is a CRM, an email platform, or a payment gateway, and that detail belongs in the policy.

The 10 fair information principles, and what each one means for you

PIPEDA is built around 10 fair information principles that the OPC expects every covered organization to apply, not just reference. Each principle translates into a concrete task rather than a line of legal text.

  • Accountability: name one person internally who owns privacy decisions and can answer questions about your practices.
  • Identifying purposes: write a one-line purpose for every piece of data you collect before you collect it, and tell the customer at that moment.
  • Consent: use implied consent for routine transactions, but get clear, specific, express consent for marketing lists or anything sensitive.
  • Limiting collection: collect only what you need for the stated purpose, not every field a signup form could technically hold.
  • Limiting use, disclosure, and retention: set a retention schedule (such as deleting inactive customer records after a fixed period) and stick to it.
  • Accuracy: give customers an easy way to update their own information.
  • Safeguards: use encryption for stored data and train staff on basic handling rules, especially anyone answering phones or emails.
  • Openness: post your policy somewhere a visitor finds it without searching, and keep it current.
  • Individual access: respond to a customer’s request to see their own data within a reasonable timeframe, and have a process ready before someone asks.
  • Challenging compliance: give customers a named contact for complaints, and actually respond when they use it.

The OPC’s own compliance guidance stresses this repeatedly: privacy is a program you run, not a document you publish and forget.

Pro Tip: Before you publish anything, walk through your own checkout or signup form as a customer would and write down every piece of data it collects. That list becomes the backbone of your policy.

Provincial differences and Law 25: when to adopt higher standards

Quebec’s Law 25 raises the bar well above PIPEDA’s baseline, with stricter consent requirements, mandatory privacy impact assessments for certain projects, and significantly higher penalties for non-compliance. If you have any customers in Quebec, even occasional ones, it is worth reviewing your practices against Law 25 rather than assuming PIPEDA alone covers you.

Alberta and British Columbia also have their own substantially similar private-sector laws, which means businesses operating purely within those provinces follow provincial rules instead of PIPEDA for in-province activity. The moment data moves across a provincial line, which happens constantly with cloud storage and national shipping, PIPEDA re-enters the picture.

Practical steps for a business serving customers in more than one province:

  • Treat Law 25 as a practical floor if you have any Quebec customers, since it is currently the strictest regime in the country.
  • Document which provinces your customers are in and which law applies to each relationship.
  • When in doubt, apply the stricter standard across your whole policy rather than maintaining separate versions.
  • Review your policy again whenever you expand into a new province or add a new cloud tool.

An Ottawa consulting firm serving clients in both Ontario and Quebec, for example, would be wise to apply Law 25’s consent standards company-wide rather than trying to split practices by client location.

Small-business checklist and copy-ready privacy policy template

Here is a short sequence that turns the principles above into action, followed by a template short enough to adapt in one sitting.

  1. Assign: name a privacy contact in writing, even if that person wears several hats.
  2. Document: list every data field you collect and its purpose in a simple internal spreadsheet.
  3. Protect: confirm your website host, CRM, and email tool use encryption and have reasonable security practices.
  4. Train: walk any staff handling customer data through the basics in under 30 minutes.
  5. Review: revisit the policy every time you add a new tool, province, or type of data collection.

A short template for a service-based Ontario business might read:

“We collect your name, email, phone number, and address to schedule and deliver services you request. We use your payment details, processed securely through [payment provider], only to complete transactions. We do not sell your information. We retain customer records for [period] after your last interaction, then delete them. Your data may be stored on servers located outside Canada through our hosting provider. Contact [name/role] at [email] to access, correct, or request deletion of your information.”

Before publishing, confirm every bracketed detail matches what actually happens in your business. A mismatch between the posted policy and real practice is one of the more common triggers for OPC complaints.

Pro Tip: Run through your checkout, booking form, and contact form once more after you publish the policy, confirming each field matches a sentence in the text.

Website form fields matched to privacy policy sections

How and where to publish your privacy policy so it meets openness expectations

A policy that exists but hides in a forgotten page does not satisfy the openness principle. The OPC expects the policy to be “readily available,” which in practice means more than one point of access.

  • Link it in your website footer so it is reachable from every page.
  • Surface it again at checkout and on any signup or contact form where data collection happens.
  • For businesses with a physical location, post a short version in-store or offer a printed copy for customers who are not online.

The PIPEDA Self-Assessment Tool from the Office of the Privacy Commissioner of Canada lays out openness as one of the 10 fair information principles your practices need to satisfy, not just a line item to check off. Write the policy in plain language rather than dense legal phrasing, since a customer who cannot understand it has not really been informed.

Date the policy and keep a version history. When you make a material change, such as adding a new third-party tool or changing your retention period, notify customers directly rather than quietly updating the page.

Breach reporting and recordkeeping: what to do if data is exposed

If personal information is lost, stolen, or accessed without authorization, your first job is containment, not paperwork. Shut off the exposed system or account, change credentials, and figure out what was accessed before anything else.

  1. Assess the risk: PIPEDA requires reporting a breach only when there is a real risk of significant harm to an affected individual, such as exposure of financial or health information.
  2. Notify the OPC: report qualifying breaches as soon as feasible, including what happened, what data was involved, and what you are doing about it.
  3. Notify affected individuals: tell anyone at real risk of harm directly, in plain language, with steps they can take to protect themselves.
  4. Keep records: log every breach, even ones that do not meet the reporting threshold, since the OPC expects organizations to maintain records of all incidents.

A documented, reasonable response, even to a minor incident, is what protects you if a complaint or investigation follows later.

How we help Ontario businesses close the gap between policy and practice

Working with owner-operators across Ontario, we see the same gap again and again: a privacy policy copied from a template years ago that no longer matches what the business actually does. The new booking tool, the switched payment processor, the added newsletter signup, none of it made it back into the policy.

When building or rebuilding a website, it is important to walk through every form and data point first, then write the policy to match what is really happening, not what sounded good in a generic template. We also check hosting and provider choices, since where your customer data physically sits affects what the policy needs to say.

If you want a quick second opinion on whether your current site handles this correctly, our free SEO audit includes a look at how your site is structured, which is often where these gaps first show up.

FAQ

For most Canadian businesses engaged in commercial activity, yes, PIPEDA requires organizations to be transparent about their data practices, and publishing a privacy policy is the standard way to meet that obligation. Businesses covered only by a provincial law like Quebec’s Law 25 follow that law’s specific publication requirements instead.

What are the 10 privacy principles of PIPEDA?

The 10 fair information principles are accountability, identifying purposes, consent, limiting collection, limiting use and disclosure, accuracy, safeguards, openness, individual access, and challenging compliance. Each one maps to a specific practice a business needs to follow, not just a line in a policy document.

Does PIPEDA require a privacy policy?

PIPEDA does not use the exact phrase “privacy policy” in its text, but it requires organizations to be open about their personal information practices and to make that information readily available, which in practice means publishing a policy. The OPC’s guidance treats a clear, accurate policy as the expected way to satisfy that openness obligation.

Is PIPEDA being replaced?

PIPEDA is still in force. Bill C-36, tabled in June 2026, would replace PIPEDA’s private-sector rules; until it passes and takes effect, PIPEDA applies. Businesses building their privacy practices today are better served by adopting stronger standards now rather than the current minimum.

Want a hand?

Tell us what is going on