Does Your Canadian Website Need a Privacy Policy? PIPEDA and Quebec's Law 25 Explained
Most small business owners think of privacy law as something for banks and tech giants. But the moment your website collects an email address, a phone number or a payment, you are handling personal information, and Canadian privacy law applies. A clear privacy policy is the most visible part of compliance, and it is often what customers, payment processors and advertising networks look for first. This guide explains the federal rules, the stricter regime in Quebec, and what your policy should actually say.
Which law applies to your business?
The Personal Information Protection and Electronic Documents Act, known as PIPEDA, governs how private-sector organisations collect, use and disclose personal information in the course of commercial activity across most of Canada. Alberta, British Columbia and Quebec have their own private-sector privacy laws that the federal government recognises as substantially similar, and those provincial laws apply to organisations operating within those provinces. PIPEDA still applies to personal information that crosses provincial or national borders.
In practice, most small businesses with customers in more than one province should build their privacy practices around PIPEDA's principles, and add Quebec-specific measures if they serve Quebec residents.
The ten fair information principles
PIPEDA is built on ten principles. Your privacy policy is where you explain to the public how you follow them:
- Accountability: name someone responsible for privacy compliance.
- Identifying purposes: explain why you collect each type of information.
- Consent: obtain meaningful consent, express or implied depending on the sensitivity of the information.
- Limiting collection: collect only what you need for the purposes you identified.
- Limiting use, disclosure and retention: use information only for those purposes and keep it only as long as needed.
- Accuracy: keep information accurate and up to date.
- Safeguards: protect information with security measures suited to its sensitivity.
- Openness: make your policies and practices readily available.
- Individual access: let people see and correct the information you hold about them.
- Challenging compliance: give people a way to complain and have their concerns addressed.
Quebec's Law 25 raises the bar
Quebec modernised its private-sector privacy law through what is commonly called Law 25, with requirements phased in between 2022 and 2024. Businesses that collect personal information from Quebec residents must designate a person in charge of protecting personal information, which by default is the most senior executive, and publish that person's title and contact information on their website.
Law 25 also requires privacy policies to be written in clear and simple terms, privacy impact assessments before certain projects and transfers of information outside Quebec, privacy-protective default settings for technology products, and specific disclosures when you use technology that can identify, locate or profile a person, such as certain cookies and tracking tools. Penalties for serious violations can be substantial.
What your website privacy policy should cover
- Who you are and how to contact your privacy officer.
- What personal information you collect, including information collected automatically through cookies, analytics and advertising tools.
- Why you collect it and how you use it.
- Who you share it with, such as payment processors, email providers, hosting companies and advertising partners, and whether it may be stored or processed outside Canada.
- How long you keep it and how it is securely destroyed.
- How people can access, correct or withdraw consent, and how to make a complaint, including their right to contact the Office of the Privacy Commissioner of Canada or the relevant provincial commissioner.
- How you will notify users when the policy changes.
Cookies, analytics and advertising
If your site uses analytics tools or displays ads through a network such as Google AdSense, third parties may place cookies on visitors' devices to measure traffic and personalise advertising. Your policy should say so plainly, name the categories of partners involved, and explain how visitors can manage cookies or opt out of personalised advertising. Many advertising networks require publishers to make these disclosures as a condition of using their service.
Breach reporting obligations
Since November 2018, PIPEDA has required organisations to report breaches of security safeguards involving personal information to the Office of the Privacy Commissioner when the breach creates a real risk of significant harm to individuals. You must also notify the affected individuals and keep a record of every breach, whether or not it was reportable, for 24 months. Quebec has a similar requirement to report confidentiality incidents to its Commission d'accès à l'information and to keep an incident register.
Getting started
Start by mapping what personal information your business actually collects, where it is stored and who can access it. Then write a policy that accurately describes those practices, because a policy that promises more than you do is worse than a simple, honest one. Revisit it whenever you add a new tool, such as a booking system, email platform or advertising network.
Skip the lawyer's bill
Create a Canadian-compliant document in minutes, from $19.99 — with bilingual output, e-signatures, and expiry tracking built in.
Frequently Asked Questions
Is a privacy policy legally required in Canada?
+
PIPEDA requires organisations to make information about their privacy policies and practices readily available. For a business with a website, a published privacy policy is the standard way to meet that obligation, and Quebec's Law 25 expressly requires one for organisations collecting information through technological means.
Does PIPEDA apply to a very small business?
+
Yes. PIPEDA has no minimum size threshold. It applies to any organisation that collects, uses or discloses personal information in the course of commercial activity, unless a substantially similar provincial law applies instead.
Do I need a separate cookie banner?
+
Canadian law does not prescribe a specific banner, but you must obtain meaningful consent for collection that people would not reasonably expect, such as tracking for personalised advertising. Quebec's Law 25 requires that tracking and profiling technologies be off by default unless the person turns them on.