Website privacy policies in Canada: what small businesses should know

A privacy policy is a plain explanation of what personal information your business collects, why you collect it, what you do with it, and how people can contact you about it. Even a small website usually collects something: a name and email from a contact form, an address for a delivery, or visitor data through analytics. Being open about this builds trust, and in Canada it is part of how privacy law expects businesses to behave.

This article is general information, not legal advice. Privacy obligations depend on your business, what you collect, and where you operate, so speak with a lawyer or your industry association if you have specific questions.

Which Canadian law applies

The federal Personal Information Protection and Electronic Documents Act, known as PIPEDA, sets rules for how private-sector organizations collect, use, and disclose personal information in the course of commercial activity. Some provinces, including Quebec, Alberta, and British Columbia, have their own private-sector privacy laws. Businesses in Nova Scotia are generally covered by PIPEDA for their commercial activities, though sector-specific rules, such as health privacy legislation, may also apply to some professions. The Office of the Privacy Commissioner of Canada publishes guidance written for small businesses, and it is a good place to start.

The ten principles in plain language

PIPEDA is built around ten fair information principles: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance. You do not need to memorize them, but they explain what a good policy covers. In practice, they mean you should collect only what you need, tell people why you need it, get their consent, protect it, keep it only as long as necessary, and let people see and question what you hold about them.

What a privacy policy should explain

• What you collect. Contact form details, email sign-ups, order or booking information, and any data gathered by cookies or analytics tools.
• Why you collect it. State the purposes in specific terms, such as responding to enquiries or delivering an order.
• Who you share it with. Service providers like email platforms, payment processors, and hosting companies, and the circumstances in which you disclose information.
• How long you keep it and how you protect it. Describe general safeguards without listing technical detail that could help an attacker.
• How people can access or correct their information, or withdraw consent.
• Who to contact. Name a person or role responsible for privacy and give a working email address.
• When the policy was last updated.

Write it so people can read it

The Privacy Commissioner has noted that many privacy policies are lengthy and full of legal jargon, and encourages businesses to provide information in a way that is understandable and user-friendly. Use short paragraphs, clear headings, and everyday words. Link to the policy in your website footer and next to any form that collects personal details, so visitors can find it before they submit anything.

Forms, email lists, and consent

If you collect email addresses to send marketing, you also have to follow Canada's anti-spam legislation, which has its own consent and unsubscribe requirements. We cover the essentials in our post on email marketing and CASL. Do not pre-tick consent boxes, do not add people to a list just because they sent an enquiry, and keep a record of when and how someone agreed.

Analytics, cookies, and third-party tools

Tools like analytics, advertising pixels, live chat, embedded maps, and social media widgets can collect visitor information. Make a list of every third-party tool on your site, check what each one collects, and describe them honestly in your policy. If you use Google Analytics or advertising pixels, mention them. Think carefully about which tools you really need, because each one adds privacy responsibility as well as page weight.

Security belongs in the conversation

A privacy policy promises that you protect information, so make sure the basics are in place: an up-to-date website, secure hosting, HTTPS, strong passwords, and limited access. Our guide to website security basics covers the essentials, and you should know what to do if personal information is ever lost or accessed without authorization. The Privacy Commissioner's guidance explains breach obligations under PIPEDA.

Common mistakes to avoid

• Copying another company's policy. Their practices are not yours, and a mismatch can cause problems.
• Using a generic template without editing. Remove sections that do not apply and add what is missing.
• Forgetting to update it. When you add a new tool or change how you use information, revise the policy.
• Burying it. A link no one can find defeats the purpose.

A starter checklist

• List every form, sign-up, booking tool, and checkout on your website and note what each collects.
• List every third-party tool that loads on your pages, from analytics to chat to maps.
• Decide who in your business is responsible for privacy questions.
• Write your policy in plain language and link it in your footer and next to forms.
• Set a reminder to review it at least once a year, and whenever you add a new tool.

When someone asks about their information

Under Canadian privacy principles, people can ask what personal information you hold about them and challenge its accuracy. Decide in advance how you will handle those requests: who receives them, how you will verify the person's identity, and where the information is stored. Keep a simple record of requests and responses. If you ever suspect that personal information has been lost or accessed without authorization, get advice quickly, since there may be obligations to notify affected people and report to the Privacy Commissioner. Preparing before it happens makes any incident far easier to handle.

A clear policy, a simple contact form, and sensible habits go a long way. If you are building or updating a website and want privacy, accessibility, and design handled together, you can read about our website design and development services or book a free consultation.