Canadian privacy principles require collecting only what is necessary for a stated purpose, identified at the time. Practically, fewer fields also convert better, which makes minimisation one of the rare places where compliance and conversion point the same way.

The principle in plain terms

Canadian private-sector privacy law is built on a set of principles, and three of them bear directly on forms.

Identify the purpose before or at the time you collect the information.

Limit collection to what is necessary for that purpose.

Limit retention, keeping information only as long as needed to fulfil the purpose.

Which law applies depends on your jurisdiction, since British Columbia, Alberta, and Quebec have their own private-sector statutes alongside the federal one, and the details differ. The underlying principles are broadly similar.

The test for each field

One question, asked field by field: what would you do differently if you did not have this.

If the answer is nothing, the field is collecting information for its own sake. That is the entire audit and it usually removes a third of a form.

Fields that survive it: what the person wants, how to reach them, and anything that genuinely changes the response, such as a postal code determining whether you serve them.

Fields that rarely survive: date of birth on a quote form, full address before you have agreed to attend, company name from a residential enquiry, and how they heard about you, which is useful to you and not necessary for them.

The two motives for over-collecting

Neither is unreasonable and both are worth naming.

It might be useful later. The most common. Collecting a full address at enquiry because you will need it if they proceed. The answer is to collect it when they proceed, which is a natural moment and a smaller ask.

The form template had the field. A plugin or a builder shipped with fields nobody chose, and nobody removed them.

The second is worth checking specifically. A surprising number of small business forms ask for things the owner has never noticed and could not explain.

Where over-collection actually costs you

Three ways, and the first is the one businesses feel.

Conversion. Every additional field loses some people, and fields that feel intrusive lose more than fields that feel routine. A date of birth on a quote form makes somebody wonder why.

Obligation. Anything you hold has to be protected, and would have to be disclosed if there were a breach. Data you did not collect cannot be exposed.

Trust. A form asking more than the situation warrants reads as either careless or commercially motivated, and both cost you the cautious enquirer.

Saying why

Where a field is genuinely needed and looks intrusive, a short explanation converts it.

Asking for a postal code so you can confirm you serve the area, or a phone number because quotes for this work need a conversation, turns an unexplained demand into a reasonable request.

That is also the purpose identification the principles ask for, so a sentence does two jobs at once.

Sensitive categories

Some information warrants a higher bar regardless of convenience.

Health information, financial details, government identifiers, and anything about children should be collected only where genuinely required for the service, and stored with more care than a general enquiry.

Government identification numbers in particular should not be collected by most small businesses at all, and certainly not through a website form. Where a business genuinely needs one, there is usually a specific legal basis and a specific moment, and neither is an enquiry form.

Retention

The part almost nobody addresses.

Enquiries that went nowhere, form submissions sitting in a plugin's database for years, and old spreadsheets of leads are all information you are holding without a purpose.

A simple policy is enough for most small businesses: how long enquiries are kept, how long customer records are kept, and when each is deleted. Then actually deleting them, which is the step that gets skipped.

Form plugins storing every submission indefinitely are a common source of accumulated data nobody knew existed, and worth checking.

Where the data actually sits

A practical question worth answering before a problem arises.

A form submission may exist in your email, in the site's database, in a plugin's storage, and with a third-party form service simultaneously. Deleting it from one place is not deleting it.

Knowing which of those apply to your site, and reducing it to as few as possible, is both good practice and what makes a deletion request answerable.

This is a general description rather than legal advice, requirements differ by jurisdiction, and the applicable privacy commissioner is the authority. The related question of what your terms should say is covered in terms and conditions for a small business site.

Frequently asked questions

What do the privacy principles require?

Identifying the purpose before or when you collect, limiting collection to what is necessary for it, and limiting retention to as long as the purpose requires.

How do I decide whether a field is needed?

Ask what you would do differently without it. If the answer is nothing, the field is collecting information for its own sake. That usually removes a third of a form.

Which fields rarely survive that test?

Date of birth on a quote form, full address before you have agreed to attend, company name on residential enquiries, and how they heard about you.

What does over-collecting cost?

Conversion, since every field loses some people and intrusive ones lose more; obligation, since anything held must be protected; and trust with cautious enquirers.

What about sensitive information?

Health, financial, government identifiers, and anything about children need a higher bar. Government identification numbers should generally never be collected through a website form.

What is usually forgotten?

Retention. Form plugins storing submissions indefinitely accumulate data nobody knew existed, and the same submission may sit in email, the database, and a third-party service at once.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Quote form asking for things you have never used?

We audit it field by field, which typically removes a third of them and improves the conversion rate at the same time.

Start a Conversation