What a Canada website privacy policy is for
Almost every Canadian business website collects personal information: names and emails from contact forms and orders, shipping addresses, account details, and device information through cookies and analytics. The Personal Information Protection and Electronic Documents Act (PIPEDA) requires businesses to be open about how they handle that information, name a person accountable for it, get meaningful consent, protect it, and let people see and correct it. A clear privacy policy is how a website meets the openness principle, and it is often the first thing the Privacy Commissioner, payment processors, ad platforms and app stores ask for.
This policy is written around PIPEDA's ten fair information principles in plain language. It names your privacy officer, sets out what you collect in a table, lists eight purposes, explains consent and withdrawal, covers essential, analytics and advertising cookies, states that you do not sell personal information and lists your service providers, discloses storage outside Canada, sets retention periods, describes safeguards and breach notification, explains access and correction with the 30-day response time, covers marketing emails under Canada's Anti-Spam Legislation, and tells people how to complain. An internal checklist helps you make sure your practices match the policy.
When to use it
Use it for a Canadian business website, online store, booking site or app that collects personal information from customers or visitors: retailers, service businesses, professionals, consultants, restaurants with online ordering, and subscription businesses. Publish it on its own page, link it from the footer and from any form that collects information.
If you operate in Alberta, British Columbia or Quebec, those provinces' private-sector privacy laws apply as well, and the policy notes the points to check; Quebec's Law 25 has specific extra requirements. Businesses handling sensitive health or financial information, or selling to children, should get privacy advice.
What's inside
The full list of sections and fields in this template, in the order they appear.
-
Accountability and scope
- Business
- Privacy officer contact
- What the policy covers
-
Collection, purposes and consent
- Types of information table
- Children
- Eight purposes
- New purposes
- Express and implied consent
- Withdrawal
-
Cookies and sharing
- Essential
- analytics and advertising cookies
- Controls
- No sale
- Service providers
- Affiliates
- Legal disclosures
- Business transfers
-
Storage, retention and safeguards
- Storage outside Canada
- Quebec note
- Retention periods
- Security measures
- Breach notification
-
Rights, marketing and contact
- Access
- correction and withdrawal
- 30-day response
- CASL marketing emails
- Complaints to the Privacy Commissioner
- Changes
-
Internal checklist
- Twelve compliance items including breach records and Law 25
Preview pages
-
Page 1 -
Page 2 -
Page 3
How to complete the policy
- Name your business and privacy officer. Give a title, mailing address and email for privacy questions.
- List what you collect. Complete the table with the real information you collect and how.
- Check the purposes. Remove any that do not apply and add any that do.
- Describe your cookies. Name the analytics and advertising tools you use, and how visitors can control them.
- List your service providers. Name the main platforms, processors and email tools you use.
- Disclose storage outside Canada. Say where your providers store data.
- Set retention periods. State how long you keep each kind of record.
- Set up access and breach processes. Make sure you can respond within 30 days and record breaches.
- Publish and review. Link the policy from your footer and forms, and review it yearly.
Example: a completed policy excerpt
A fictional Halifax online tea shop, Harbourleaf Tea Co., completes the policy:
Privacy officer: Owner and Privacy Officer, privacy@ address, Halifax mailing address. What we collect: name, email, shipping address and order history at checkout; card details collected by Shopify Payments; IP address and pages viewed through Shopify analytics and Google Analytics. Service providers: Shopify (e-commerce, stored in Canada and the United States), Canada Post (shipping), Klaviyo (email marketing, United States). Retention: order records for 6 years for tax purposes; marketing preferences until the customer unsubscribes.
The shop adds a cookie banner that lets visitors refuse advertising cookies, and a link to the policy in its checkout and newsletter sign-up form.
Canadian rules to know
These are the rules this policy is built around.
- PIPEDA, Schedule 1. Ten principles: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance.
- Openness (principle 4.8). Make available the accountable person's name or title and address, how to get access, the information held and its use, and what is shared with related organizations.
- Valid consent (section 6.1). Consent is valid only if people would understand the nature, purpose and consequences of what they agree to.
- Access (section 8). A response within 30 days, extendable by up to 30 days.
- Breaches (sections 10.1 and 10.3). Report and notify where there is a real risk of significant harm; keep a record of every breach.
- Canada's Anti-Spam Legislation. Consent, identification and an unsubscribe mechanism for commercial electronic messages.
- Provincial laws. Alberta PIPA, BC PIPA and Quebec's private sector act as amended by Law 25.
Mistakes in website privacy policies
The common problems are policies copied from another country that cite the wrong laws, no named privacy contact, a list of tools that does not match the website, saying data stays in Canada when providers store it elsewhere, no retention periods, no way to make an access request, marketing emails sent without consent records, and a policy that has not been updated since the website changed. Using the checklist and reviewing the policy yearly avoids each of them.
Frequently asked questions
Does a Canadian website need a privacy policy?
If your business collects personal information in the course of commercial activity, PIPEDA's openness principle requires you to make information about your privacy practices readily available, including who is accountable, how to get access, what you collect and how you use it. A website privacy policy is the usual way to do that.
What must a PIPEDA privacy policy include?
At least the name or title and address of the person accountable for privacy, how people can access their personal information, a description of the information you hold and a general account of its use, and what is shared with related organizations. Good practice adds cookies, service providers, storage outside Canada, retention, safeguards and complaints.
How long does a business have to respond to a privacy access request in Canada?
Under PIPEDA, no later than 30 days after receiving it, with a possible extension of up to 30 more days in limited cases, if you tell the person why. Access must be free or at minimal cost.
Do I have to report privacy breaches in Canada?
Yes, if a breach of security safeguards involving personal information creates a real risk of significant harm to someone. You must report it to the Privacy Commissioner of Canada as soon as feasible, notify the affected people, and keep a record of every breach, whether reported or not.
Does PIPEDA apply in Quebec, Alberta and British Columbia?
Those provinces have their own private-sector privacy laws that apply to organizations operating within them, and PIPEDA continues to apply to cross-border and interprovincial activity. Quebec's Law 25 adds requirements such as privacy impact assessments for transfers outside Quebec and stricter cookie consent.
