A privacy policy should describe what you actually collect, why, who else sees it, and how someone can access or correct it. The mistake most Canadian small businesses make is copying an American template, which describes the wrong law entirely. In British Columbia, private sector businesses are generally governed by BC PIPA rather than the federal statute.

Not legal advice. This is a plain explanation of what these documents are for and what they generally need to cover. Privacy law is jurisdictional and fact-specific, and if you handle sensitive information or operate across borders, take proper advice.

Which law applies to you

This is where most templates go wrong, and it is worth getting straight.

PIPEDA is the federal private sector privacy statute and remains in force. Proposed replacement legislation has been before Parliament in recent years without being enacted, so PIPEDA continues to govern.

Three provinces have their own private sector laws recognised as substantially similar, and in those provinces the provincial statute generally applies to intra-provincial commercial activity instead: British Columbia and Alberta each have a Personal Information Protection Act, and Quebec has its own regime, which is considerably stricter than the others.

So a BC business serving BC customers is generally looking at BC PIPA. PIPEDA still applies to federally regulated industries and to personal information crossing provincial or national borders in the course of commercial activity, which for many businesses means both are relevant in different respects.

The practical consequence: an American template referencing US statutes describes obligations that do not apply to you while omitting the ones that do.

What the policy should actually contain

What you collect

Specifically. Names, phone numbers, email addresses, service addresses, and anything gathered automatically such as analytics data. Vague statements about collecting "certain information" are not useful to anyone.

Why you collect it

The purpose, stated at or before collection. Quoting work, scheduling, invoicing, and following up are legitimate and easy to state.

Who else receives it

The part most policies omit and most businesses have not thought through. Your analytics provider, email platform, booking tool, payment processor, and hosting provider all handle information on your behalf, and some of them are outside Canada.

Where it is held

Canadian law does not generally prohibit holding personal information outside the country, but it does expect transparency about it and accountability for it. If your email platform stores data in the United States, say so.

How long you keep it

Retention should be tied to purpose rather than indefinite. Many small businesses keep everything forever by default, which is worth addressing before writing about it.

How to access, correct, or complain

Individuals generally have a right to access what you hold about them and request corrections. Give a named contact and a real method of reaching them.

Two obligations frequently missed

Someone should be accountable. These regimes expect a designated person responsible for compliance. For a small business that is usually the owner, and naming them is the point.

Safeguards should be appropriate to the sensitivity of what you hold, and you should have thought about the providers handling data on your behalf rather than assuming they are fine. In practice, accountability and safeguards are the two areas most commonly found lacking in small organisations.

There are also breach reporting obligations where a breach creates a real risk of significant harm, which is worth knowing exists before you need it.

What not to do

The proportionate view

A local trades business collecting names, addresses, and phone numbers to quote and complete work is not in a demanding position. The obligations are real and modest, and a short honest policy describing actual practice satisfies them far better than a lengthy generic one describing somebody else's.

Write down what you genuinely do, publish it, and update it when the practice changes. That is most of what is being asked.

Frequently asked questions

Which privacy law applies to a BC business?

For private sector commercial activity within British Columbia, generally BC's Personal Information Protection Act rather than the federal statute. PIPEDA continues to apply to federally regulated industries and to personal information crossing provincial or national borders.

Is PIPEDA still Canada's privacy law?

Yes. PIPEDA remains the federal private sector privacy statute. Proposed replacement legislation has been before Parliament in recent years without being enacted, so PIPEDA continues to govern federally regulated activity and inter-provincial commercial activity.

What should a small business privacy policy include?

What personal information you collect, why you collect it, who else receives it including service providers, where it is held, how long you keep it, and how someone can access or correct it along with a named contact and a way to complain.

Can I use an American privacy policy template?

Not usefully. American templates reference statutes that do not apply to Canadian businesses while omitting the obligations that do, which produces a document describing somebody else's legal position rather than yours.

Do I need to say where customer data is stored?

Canadian law does not generally prohibit holding personal information outside the country, but it expects transparency about it and accountability for it. If your email platform or analytics provider stores data abroad, the policy should say so.

What obligations do small businesses most often miss?

Accountability, meaning a designated person responsible for privacy compliance, and safeguards, meaning appropriate protection and some consideration of the providers handling data on your behalf. Breach reporting obligations also exist where a breach creates a real risk of significant harm.

West Coast Media Solutions Inc. builds and hosts websites for businesses across Canada and operates a premium domain marketplace, both relevant interests to declare. Nothing here is legal advice; where obligations are described, confirm current requirements against the regulator or your own counsel.

Want a second opinion?

We build and host websites for businesses across Canada, and we will show you what your current arrangement is costing you.

Start a Conversation