PIPEDA and your website: privacy basics for a Canadian small business

01Does PIPEDA apply to your website?

If your website has a contact form, a booking tool, a newsletter signup, analytics or a chat widget, it collects personal information: names, email addresses, phone numbers, IP addresses and behaviour. If you are a business, that collection is in the course of commercial activity. The Office of the Privacy Commissioner of Canada (OPC) oversees PIPEDA, and its guidance for businesses is the authoritative starting point.

Where a province has substantially similar legislation, the provincial law applies to organizations within that province instead: Quebec (including Law 25), British Columbia and Alberta each have their own private-sector privacy law. Federally regulated businesses and cross-border data flows can still bring PIPEDA into play. If you are unsure which applies, the OPC's site explains the split.

02What your website collects without you noticing

Most owners think of the contact form and stop there. The list is longer.

• Form submissions, including anything typed into a free-text box.
• Booking details and appointment history.
• Analytics: pages viewed, device, approximate location, and identifiers set by the analytics tool.
• Chat transcripts, including AI website chat.
• Call recordings and transcripts from an AI receptionist.
• Email addresses on a newsletter list, and the open and click data the email platform records.
• Server logs with IP addresses.
• Data sent to third parties by embedded maps, videos, fonts and advertising tags.

03The privacy policy: what to include

Write it yourself first in plain English, then have it reviewed if you collect anything sensitive, such as health information. A policy copied from another site describes their practices, not yours.

• What you collect, in plain words, and through which parts of the site.
• Why you collect each item and what you do with it.
• Who you share it with: hosting, analytics, email, CRM, booking, payment and AI providers, by category or by name.
• Where it is stored, including outside Canada.
• How long you keep it.
• How someone can see, correct or delete their information, and whom to contact.
• How you protect it, in general terms.
• The date it was last updated.

04Consent, forms and analytics

Consent has to be meaningful: the person should understand what they are agreeing to. The table turns that principle into settings on a website.

05Provincial variations

Quebec's Law 25 adds obligations such as a designated privacy officer and a published privacy policy, phased in between September 2022 and September 2024; the Commission d'accès à l'information du Québec publishes the details. British Columbia and Alberta each have a private-sector privacy law considered substantially similar to PIPEDA, administered by their own commissioners. A business serving customers in several provinces should build to the strictest rule that applies to it rather than maintain several versions of its practices.

06Safeguards and retention

Safeguards are the practical side: HTTPS everywhere, forms that send to a monitored inbox rather than a shared spreadsheet, CRM access limited to staff who need it, two-factor authentication on the accounts that hold customer data, and providers chosen for their security practices. Retention is the forgotten side: decide how long you keep enquiries, transcripts and lists, and delete on schedule.

Redenn's builds default to privacy-conscious analytics, spam-protected forms that email you, and integrations only where a real process needs them. The privacy policy and the retention decisions are yours, and Redenn will point you to the questions you need to answer.

07Not legal advice

This guide summarizes publicly available guidance from the OPC and the CAI as of 2026-09-24 and is general information, not legal advice. Which law applies, what consent is required and how long you may keep data depend on your business and your customers; confirm with the regulator's guidance or a lawyer.