What must a privacy policy include in Canada?

No single Canadian statute lists every section a privacy policy must have. The list comes from PIPEDA’s principles, Quebec’s private sector act, and the app stores, and a good policy covers all three at once.

The checklist

Section	What to say	Where the requirement comes from
Who you are and who to contact	Your legal name, and the name or title and address of the person accountable for privacy, to whom complaints and questions go	PIPEDA clause 4.8.2(a) and Principle 4.1; Quebec s. 3.1 (title and contact details of the person in charge, on your website)
What you collect	Each type of personal information, including what users give you, what’s collected automatically and what you get from third parties	PIPEDA clauses 4.8.2(c) and 4.4.1; Quebec s. 8; Apple 5.1.1(i); Google Play
How you collect it	Forms, cookies, SDKs, pixels, integrations	Quebec s. 8 (the means of collection); Apple 5.1.1(i)
Why	Each purpose, specific enough to understand	PIPEDA Principle 4.2 (purposes identified at or before collection); Quebec ss. 4 and 8
Who you share it with	Categories of recipients: hosting, analytics, payments, AI model providers, advertising partners, related companies	PIPEDA clause 4.8.2(e); Quebec s. 8 (third persons or categories of third persons); Google Play
Where it goes	That information may be stored or processed outside Canada, or outside Quebec, and may be accessible to authorities there	OPC cross-border guidelines; Quebec s. 8
How long you keep it	Retention periods or the criteria for them, and how you delete or anonymize	PIPEDA Principle 4.5; Apple 5.1.1(i)
How you protect it	The kinds of safeguards you use, in general terms	PIPEDA Principle 4.7
Choices and consent	How to opt out of marketing or tracking, and how to withdraw consent	PIPEDA Principle 4.3; Quebec s. 8 (right to withdraw consent); Apple 5.1.1(i)
Access and correction	How to ask for a copy of their information or correct it, and how long you have to respond	PIPEDA Principle 4.9 and s. 8; Quebec ss. 8 and 27
Complaints	How to complain to you, and that they can also complain to the Privacy Commissioner of Canada	PIPEDA clauses 4.10.2 and 4.10.3; PIPEDA s. 11
Tracking and profiling	What identifies, locates or profiles people, and how to turn those functions on	Quebec s. 8.1
Automated decisions	That a decision is made exclusively by automated processing, if one is	Quebec s. 12.1
Children	Whether the product is meant for children, and how you get a parent’s consent	OPC consent guidelines; Quebec s. 4.1 (under 14)
Changes	How you’ll tell people about changes	Quebec s. 8.2 (notice of amendments)
Date	When the policy was last updated	OPC tips

What does PIPEDA itself require?

Clause 4.8.2 of Schedule 1 lists what the information you make available must include: the name or title and address of the person accountable for your practices and to whom complaints or inquiries go, how to get access to personal information, a description of the types of personal information you hold and a general account of their use, any brochures or other materials explaining your policies, and what personal information is made available to related organizations such as subsidiaries. The rest of the checklist comes from the other principles, which say what you must do; the policy is where you tell people you do it.

What does Quebec add?

Quebec’s private sector act requires the policy to be published on your website in clear and simple language (s. 8.2), and requires you to tell people at collection the purposes, the means of collection, their rights of access and correction, their right to withdraw consent, the third parties or categories of third parties who will receive the information, and the possibility that it could be communicated outside Quebec (s. 8). Separately, s. 3.2 requires detailed information about your internal governance policies, including retention and destruction, roles and complaint handling, to be published on your website. Many businesses cover that in the same privacy page. See does Quebec’s Law 25 apply to my startup.

Is publishing the policy enough for consent?

No. The Privacy Commissioner’s consent guidelines say you must make privacy information available in complete form while emphasizing four key elements: what personal information is collected, with which parties it’s shared, for what purposes, and the risks of harm. Those points belong in short notices at sign-up and when you ask for a sensitive permission, not only in the policy. Quebec also requires consent to be requested separately for each purpose, in clear and simple language.

What do the app stores add?

Apple’s guideline 5.1.1(i) requires the policy to identify what data the app collects, how, and all uses of it, to confirm that third parties receiving user data will protect it to the same standard, and to explain retention and deletion and how users can revoke consent or request deletion. Google Play’s User Data policy requires the policy to disclose the types of personal and sensitive data the app accesses, collects, uses and shares, and the parties it’s shared with. Keep the store’s privacy labels and data safety answers consistent with the policy.

What should a privacy policy not say?

• That you “never share” data, if you use any outside vendor.
• That you comply with laws you haven’t looked at.
• Purposes so broad they mean anything, such as “to improve our business”. PIPEDA s. 5(3) limits you to purposes a reasonable person would consider appropriate, and the Commissioner’s tips ask for specific, meaningful information.
• Anything about a product feature you’ve removed or haven’t built.

What to do next

We prepare privacy policies that work through each of these points against your real data flows, at fixed fees on our fees page. See also do I need a privacy policy, privacy officers and privacy access requests.

This guide is general information about Ontario and Canadian law, not legal advice for your situation. To check your current policy against this list, book a free 15-minute consult.