Most small business websites collect personal information, often without the owner thinking of it that way. A contact form collects names, email addresses and phone numbers. A booking system collects appointment details. Analytics tools gather information about visitors’ behaviour. An email newsletter sign-up builds a mailing list. A chat widget records conversations.
All of this touches privacy law. This post gives a plain-language overview of what Canadian businesses need to know about their websites. It’s general information, not legal advice; for your specific situation, speak to a qualified lawyer.
The main laws to know about
PIPEDA
The Personal Information Protection and Electronic Documents Act (PIPEDA) is the federal law that governs how private-sector organizations collect, use and disclose personal information in the course of commercial activities in most of Canada. Some provinces have their own laws that apply instead for activity within those provinces (Quebec, Alberta and British Columbia), but PIPEDA applies to private-sector businesses in Ontario.
PIPEDA is built around ten fair information principles. In plain terms, they ask businesses to:
- Be accountable for the personal information they handle.
- Identify why they’re collecting information.
- Get meaningful consent.
- Collect only what they need.
- Use and keep it only for the stated purposes, and only as long as needed.
- Keep it accurate.
- Protect it with appropriate safeguards.
- Be open about their practices.
- Let people access their information.
- Provide a way to raise concerns.
Breach reporting
Since November 2018, PIPEDA has required organizations to report breaches of security safeguards involving personal information to the Privacy Commissioner of Canada where there’s a real risk of significant harm, notify affected individuals and keep records of all breaches. A hacked website that exposes contact form submissions or customer records may trigger these obligations.
Quebec’s Law 25
If you serve customers in Quebec, be aware that Quebec has significantly strengthened its private-sector privacy law through Law 25, with requirements phased in from 2022 to 2024. These include a designated person in charge of personal information, privacy impact assessments in certain situations and specific rules about consent and technologies that identify, locate or profile people. If Quebec residents are a meaningful part of your audience, get specific advice.
CASL
Canada’s Anti-Spam Legislation (CASL) governs commercial electronic messages, such as marketing emails and texts. Generally, you need consent to send them, must identify yourself and must include a working unsubscribe mechanism. If your website has a newsletter sign-up, CASL matters.
Where your website touches privacy
Contact and quote forms
Collect only what you need. If you don’t need a home address to reply to an enquiry, don’t ask for it. Make sure form submissions are sent and stored securely, and decide how long you’ll keep them.
Newsletter sign-ups
Use clear, separate consent for marketing emails, rather than adding everyone who contacts you to your list. Keep records of when and how people subscribed.
Analytics
Tools like Google Analytics collect information about visitors. Explain this in your privacy policy, configure the tools sensibly and consider whether you need everything they collect.
Cookies and tracking
Advertising pixels and tracking tools can share information with third parties. Be transparent about what you use, and consider how you obtain consent, particularly if you serve Quebec residents or audiences in other jurisdictions with stricter rules.
Chat and booking tools
Third-party chat, booking and payment services may store personal information on their own systems, sometimes outside Canada. Know where data goes and make sure your privacy policy reflects it.
Your website’s security
Privacy law expects appropriate safeguards. For a website, that means the basics: HTTPS everywhere, software kept up to date, strong access controls, minimal plugins and secure handling of stored data. A neglected website is a privacy risk as well as a security one.
What your privacy policy should cover
A clear privacy policy, written in plain language, should explain:
- What personal information you collect through your website.
- Why you collect it and how you use it.
- Which third-party services receive it (for example, analytics, email or booking providers).
- Whether information is stored or processed outside Canada.
- How long you keep it.
- How you protect it.
- How people can access or correct their information, or withdraw consent.
- Who to contact with questions or concerns.
Copying a policy from another website is risky. It may describe practices you don’t follow, and an inaccurate privacy policy can be worse than a short, honest one.
A practical checklist
The takeaway
If your website has a form, analytics, a newsletter or a chat tool, privacy law applies to it. Collect only what you need, be open about what you do, protect it properly and keep your privacy policy accurate. Where your situation is complex, especially with Quebec customers, get professional legal advice.
We’re not lawyers, but we can make the technical side solid: secure forms, sensible data handling, up-to-date software and a clear picture of what your site collects. Get in touch if you’d like help.