What does PIPEDA require of a small business?

PIPEDA is Canada’s federal private sector privacy law. Ontario has no general private sector privacy statute of its own, so for most Ontario businesses PIPEDA is the main privacy law for customer information. Health custodians follow PHIPA instead, and Quebec, British Columbia and Alberta have their own private sector laws.

Does PIPEDA apply to my business?

If you collect, use or disclose personal information in the course of commercial activity, yes, under section 4. There’s no minimum size or revenue. It generally doesn’t apply to employee information at Ontario businesses that aren’t federally regulated. See does PIPEDA apply to employee information.

What are the 10 principles?

PIPEDA’s requirements sit mainly in Schedule 1:

Principle	What it means for a startup
1. Accountability	Name someone responsible, and stay responsible for information you send to vendors. See privacy officer
2. Identifying purposes	Decide and document why you collect each type of information
3. Consent	Get meaningful consent; express consent for sensitive information
4. Limiting collection	Collect only what you need for those purposes
5. Limiting use, disclosure and retention	Use it only for those purposes, and delete it when you no longer need it
6. Accuracy	Keep it accurate enough for its purpose
7. Safeguards	Security suited to the sensitivity of the information
8. Openness	Make your practices readily available, usually in a privacy policy
9. Individual access	Give people their information on request. See access requests
10. Challenging compliance	Have a way to handle complaints

The Act also says, in section 5(3), that you may only collect, use or disclose personal information for purposes a reasonable person would consider appropriate in the circumstances, even with consent.

What does meaningful consent look like?

The Privacy Commissioner’s consent guidelines ask you to emphasize the key points (what, with whom, why and the risks), use layered and just-in-time notices, and give people real choices for non-essential uses. A long policy alone usually isn’t enough.

What happens after a breach?

You must report breaches that create a real risk of significant harm to the Privacy Commissioner, notify affected people, and keep a record of every breach. See when to report a privacy breach.

What are the penalties?

The Commissioner investigates complaints and publishes findings, and complainants can apply to the Federal Court. Knowingly failing to report breaches or keep breach records is an offence under section 28, with fines up to $100,000. Reputational and contractual consequences with business customers are often the larger cost. PIPEDA may be replaced: see Canada’s privacy law in 2026.

Where do most startups start?

1. Map what personal information you collect, where it goes, and which vendors receive it.
2. Name a privacy contact.
3. Publish a privacy policy that matches the map.
4. Put data processing agreements in place with key vendors.
5. Write a short breach response plan and a retention schedule.

We prepare privacy policies after reviewing your data practices under PIPEDA, at fixed fees on our fees page.

This guide is general information about Ontario and Canadian law, not legal advice for your situation. To check where you stand, book a free 15-minute consult.