Privacy Policy for Your Website or App | Canada (PIPEDA)

In Canadian practice, a website privacy policy is the outward-facing document required by Principle 4.8 (Openness) of Schedule 1 to PIPEDA. It must describe, in language a reasonable person can understand, the types of personal information the organization holds, the general use made of it, what is shared with related organizations, how individuals obtain access, and the name or title and address of the person accountable for compliance. It is distinct from the internal privacy management program (procedures, training records, breach logs) that the Office of the Privacy Commissioner of Canada (OPC) reviews during investigations, and from your terms of use, which govern the contract with users. Merging the three into one page weakens each of them.

The policy is not a substitute for consent either. Under section 6.1 of PIPEDA, consent is valid only if it is reasonable to expect the individual to understand the nature, purpose and consequences of the collection, use or disclosure. A footer link rarely meets that standard alone beyond expected uses, so the policy sits behind just-in-time notices, consent checkboxes and cookie settings, and supplies the detail they point to. For a company that already relies on Canadian business contract templates, the privacy policy is often the first legal document customers, regulators and payment processors actually read.

PIPEDA (S.C. 2000, c. 5) applies to private-sector organizations that collect, use or disclose personal information in the course of commercial activity, and to federal works and undertakings such as banks, airlines and telecommunications carriers. In Quebec, Alberta and British Columbia, provincial statutes declared substantially similar replace PIPEDA for activity inside the province, while PIPEDA keeps governing data that crosses provincial or national borders. The OPC publishes a plain-language guide to PIPEDA's ten fair information principles that its investigators cite routinely. The Digital Privacy Act added the valid consent test in section 6.1 and the breach regime in sections 10.1 to 10.3: any breach creating a real risk of significant harm must be reported to the Commissioner and notified to affected individuals as soon as feasible, and every breach must be recorded and the record kept for 24 months under the Breach of Security Safeguards Regulations. Knowingly failing to report or record a breach is an offence under section 28 of PIPEDA.

Marketing emails fall under a second statute. Canada's Anti-Spam Legislation (CASL, S.C. 2010, c. 23) prohibits sending a commercial electronic message without consent (section 6). Implied consent from an existing business relationship lasts two years after a purchase and six months after an inquiry (section 10), and every message needs sender identification and an unsubscribe mechanism honoured within 10 business days. The CRTC, which enforces CASL through heavy administrative penalties, has confirmed that a pre-checked box does not produce express consent.

Federal reform is pending. Bill C-36 proposes to replace Part 1 of PIPEDA with the Protecting Privacy and Consumer Data Act, but until it is enacted and in force, PIPEDA governs and our template is drafted to it.

The trigger most owners miss is that collection starts before anyone fills in a form. A site running an analytics script, an advertising pixel or a chat widget already collects IP addresses and device identifiers, which the OPC treats as personal information when they can be linked to an individual. E-commerce stores, SaaS platforms and mobile apps add account data, payment details and servers often located outside Canada.

Lead generation is a quieter trigger. A newsletter signup collects email addresses, and if you plan to send promotions, the same form must capture CASL consent. Landlords who screen applicants online face the same duty, which is why a PIPEDA-compliant rental application form should always point to a published policy. Two edge cases deserve attention. Services likely to attract children under 13 need parental consent in the OPC's view, and the policy must say so. Non-profits are generally outside PIPEDA for their core activities, but section 2(1) expressly treats selling, bartering or leasing donor and membership lists as commercial activity, and in British Columbia the provincial statute covers non-profits regardless.

• The accountability and privacy officer clause names the individual responsible for compliance, with a title, mailing address and email address. Under Principle 4.1, accountability cannot be delegated away.
• The categories and purposes of collection separate information users provide (account details, orders, messages) from information collected automatically (IP addresses, cookies, device data). Each category is tied to a specific purpose, because Principle 4.2 requires purposes to be identified at or before collection.
• The consent and withdrawal clause distinguishes express consent for sensitive information or secondary uses from implied consent for expected uses. It explains how a user withdraws consent and what follows, as Principle 4.3.8 requires.
• The service providers and cross-border transfers clause identifies the third parties involved (hosting, payment, analytics, email delivery) and states when data is processed outside Canada. Your vendor contracts should mirror these commitments, and a service agreement with confidentiality and data handling terms is the usual vehicle.
• The retention and safeguards clause sets out how long each category is kept and the measures protecting it, in line with Principles 4.5 and 4.7.
• The access, correction and complaints clause explains how to submit a written request, the applicable response deadline, and the right to complain to the OPC or a provincial commissioner. Cookie controls and CASL unsubscribe rights sit in the same section.

Quebec has the most demanding regime in the country. The Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), as amended by Law 25, requires any business collecting personal information through technological means to publish a confidentiality policy on its website in clear and simple terms (section 8.2), along with its governance policy (section 3.2) and the title and contact information of the person in charge of the protection of personal information (section 3.1), a role held by the CEO by default. Functions that identify, locate or profile a user must stay inactive until the user turns them on (section 8.1), and products offered to the public must default to the highest confidentiality settings (section 9.1). A privacy impact assessment is required before communicating personal information outside Quebec (section 17), and the Charter of the French Language means the policy must be available in French.

Alberta regulates private organizations through the Personal Information Protection Act (SA 2003, c. P-6.5). Its distinctive feature is the disclosure of service providers outside Canada: policies must identify the countries involved and the purposes of the transfer, and individuals must be told how to obtain that information (sections 6 and 13.1). Breaches posing a real risk of significant harm must be reported to the Commissioner (section 34.1). Access requests get up to 45 days under section 28, longer than the federal deadline.

British Columbia's Personal Information Protection Act (SBC 2003, c. 63) applies to every private organization, including non-profits, clubs and charities that PIPEDA would not reach. Organizations must designate a person responsible for compliance (section 4) and explain collection purposes on or before collection (section 10). BC PIPA contains no general breach reporting duty equivalent to Alberta's.

Ontario has no general private-sector privacy statute, so PIPEDA applies directly to Ontario businesses, and health information custodians fall under the Personal Health Information Protection Act, 2004. Employers with 25 or more employees must also maintain a written electronic monitoring policy under Part XI.1 of the Employment Standards Act, 2000, which belongs alongside your employment agreement aligned with Ontario's ESA.

You start by describing what your site or app does. The questionnaire then asks which categories of personal information you collect, separating the data users type in from the data your tools capture automatically, because most owners underestimate the second list. From there, you indicate the provinces where you operate and where your customers live; selecting Quebec, Alberta or British Columbia adds the provincial disclosures described above. The next screens cover your service providers and where they host data, your retention periods, and whether you send marketing emails, which activates the CASL wording. You then enter the contact details of your privacy officer. Your website privacy policy is generated as an editable Word file and a PDF, ready to publish on a dedicated page linked from your footer and signup forms. Before publishing, compare every sentence against your real data flows. A policy promising you never share data while a pixel sends browsing activity to an ad network is a misrepresentation, and regulators read it that way.

The most frequent error is the copied policy: owners borrow a US or GDPR template, publish it unchanged, and end up describing rights Canadian law does not grant while omitting the ones it does, such as Alberta's foreign service provider disclosure. Vague purposes come next: phrases like "to improve our services" have been criticized by the OPC as too broad to support meaningful consent, and its Guidelines for obtaining meaningful consent ask organizations to highlight what matters most to users, including sharing with third parties. The third is the stale policy: a new analytics tool, payment processor or AI feature changes your data flows, yet the policy still describes the site at launch.

The remaining mistakes are operational. Many businesses list a privacy contact who left long ago, so access requests go unanswered and the statutory deadline runs out. Others assume the policy covers their email list, when CASL requires separate, documented consent; a privacy policy link never turns a purchased mailing list into consented contacts. Finally, under Principle 4.1.3 you remain accountable for information transferred to a processor, so any agency with access to customer records should sign a mutual non-disclosure agreement for Canadian businesses at a minimum, with data protection terms in the main contract.