Do I need a privacy policy in Canada?

Most founders ask this question after someone else has asked them for one: an app store, a payment processor, or a business customer’s security review. The legal answer usually arrives at the same place.

Is a privacy policy legally required in Canada?

In practice, yes, for any business that collects personal information from the public. PIPEDA, the federal private sector privacy law, applies to personal information an organization collects, uses or discloses in the course of commercial activities (s. 4). Its openness principle (Principle 4.8 of Schedule 1) says you must make specific information about your policies and practices readily available, in a form that is generally understandable. PIPEDA doesn’t use the words “privacy policy”, but a published policy is how almost every online business meets that duty.

Quebec is explicit. Section 8.2 of its private sector privacy act says anyone who collects personal information through technological means must publish a confidentiality policy on the enterprise’s website, in clear and simple language, and give notice of any change to it. See does Quebec’s Law 25 apply to my startup.

When do you need one?

If your business…	Do you need a privacy policy?
Has a website with a contact form or newsletter sign-up	Yes. Names and email addresses are personal information
Uses Google Analytics, a Meta pixel or similar tools	Yes. Tracking data tied to a device or person is often personal information. See cookie banners in Canada
Sells online or takes bookings	Yes
Has an app in the App Store or Google Play	Yes. Both stores require one, whatever the law says
Is a B2B SaaS product holding customers’ users’ data	Yes, plus a data processing agreement
Has users or customers in Quebec	Yes, and it must be published on your website
Is a static brochure site that collects nothing, with no analytics	Possibly not, but few sites stay that way

What counts as personal information?

PIPEDA defines personal information broadly as information about an identifiable individual (s. 2). Names, emails, phone numbers, payment and order details, IP addresses and device identifiers, location, photos and voice recordings, and anything a user types into your product can all qualify. Business contact information collected only to reach someone about their work is outside PIPEDA (s. 4.01), but most consumer and user data isn’t.

Is there a small business exemption?

No. PIPEDA has no minimum size, revenue or number of customers. The Privacy Commissioner notes that not-for-profits and charities generally aren’t covered unless they carry on commercial activities, but a startup selling a product is. Alberta, British Columbia and Quebec have their own private sector laws for activity inside those provinces, and PIPEDA still covers personal information that crosses provincial or national borders.

Who else will ask for one?

• Apple requires every app to link to its privacy policy in App Store Connect and inside the app, and says what the policy must explain (App Review Guidelines, 5.1.1(i)).
• Google Play requires a privacy policy link in Play Console and in the app, even for apps that don’t access personal or sensitive user data (User Data policy).
• Stripe lists a privacy policy in its website checklist for businesses taking payments, along with refund, cancellation and contact details.
• Business customers usually ask for your privacy policy and compare it with your answers in their security questionnaire.

What if I don’t have one?

Without a policy, it’s hard to show you meet PIPEDA’s openness principle, and in Quebec you would be missing a published policy the Act requires. The practical problems come sooner: an app rejected at review, a payment account held for missing policies, or an enterprise deal stalled in procurement. A policy that says the wrong thing creates its own risk. See privacy policy generators: what they miss.

What should it say?

It should describe what you actually collect, why, who receives it, where it’s stored, how long you keep it, and how people can reach you and access their information. We’ve set out the full list in what a Canadian privacy policy must include. The Privacy Commissioner’s tips for online privacy policies start with making the policy about your own business, and advise against templates and boilerplate.

What to do next

We prepare privacy policies after reviewing your data practices under PIPEDA, at fixed fees shown on our fees page. Most products also need terms of service. See what a privacy policy and terms of service cost and privacy policies for apps.

This guide is general information about Ontario and Canadian law, not legal advice for your situation. To check whether your business needs a privacy policy and what it should cover, book a free 15-minute consult.