Do I Need a Privacy Policy on My Business Website?
If your website collects any personal information, such as names and emails from a contact form, booking details, or a newsletter sign-up, then yes, you should have a privacy policy. In Canada, private-sector privacy laws expect businesses to be open about how they handle personal information, and a policy page on your site is the easiest way to do that. I'm a web designer, not a lawyer, so treat this as a plain-language orientation and check the official sources below for your situation.
Which law applies to my business?
Canada's federal law is PIPEDA. The Office of the Privacy Commissioner says it covers organizations that collect, use or disclose personal information in the course of commercial activity, and it is built on 10 fair information principles, including accountability, consent, openness, limiting collection, safeguards and individual access.
Alberta, British Columbia and Quebec have their own private-sector laws that are considered substantially similar to PIPEDA, and organizations covered by those laws are generally exempt from PIPEDA for activity within that province. In BC, that law is the Personal Information Protection Act (PIPA). Which one applies to you can depend on where you operate and where your customers are, so if you sell across provincial lines it's worth reading the official guidance or asking a professional.
What does BC's regulator say about policies?
BC's Office of the Information and Privacy Commissioner says PIPA requires organizations to develop and follow policies and practices to meet their obligations, and to make those documents available on request. It also notes PIPA applies to businesses, charities, associations and non-profits in BC, and that the level of detail in your policy can depend on your size, how much personal information you handle and what you do with it. A one-person trades business doesn't need a 20-page document.
What counts as personal information?
The BC guidance describes it as information reasonably capable of identifying a particular individual. Examples it lists include name, address, financial information, date of birth, photographs of an individual and product preferences. On a typical small business site, that usually means:
- Names, emails and phone numbers from contact or quote forms.
- Appointment details from online booking.
- Customer details collected for orders or deliveries.
- Email addresses collected for a newsletter. (Sending marketing emails has its own rules; see my CASL post.)
What to put in a small business privacy policy
The BC guidance organizes a policy under headings based on common privacy principles. Translated into plain language for a small site, cover these:
- Who is responsible. Name a person (often you) and give a contact email or phone number.
- What you collect and why. Be specific: "your name and email so we can reply to your quote request."
- Consent. How people agree to you using their information, and how they can say no or withdraw.
- Who you share it with. For example your booking tool, payment processor or email service.
- How long you keep it. Only as long as you need it.
- How you protect it. Passwords, access limits, reputable tools.
- How people can see or correct their information, and how to make a complaint.
Where to put it
Link your privacy policy in your website footer so it's reachable from every page, and link it right next to any form that collects information ("By submitting, you agree to our privacy policy"). Keep the wording human. A policy nobody can understand doesn't help your customers or you.
Practical habits that matter more than the page
- Collect less. If you don't need a customer's birthday or home address, don't ask.
- Know where the data lives. Contact form emails, booking tools, spreadsheets, a CRM. If someone asks what you hold on them, you should be able to find it.
- Use tools you trust and check where they store data and what they do with it.
- Have a plan for a mistake. BC's regulator publishes a privacy breach quick reference guide for small and medium-sized businesses, which is a good thing to read before you need it.
Can I just copy another business's policy?
I wouldn't. Their business collects different information with different tools, and copying can leave you promising things you don't do. Use the regulator's guidance as your checklist, write it for your own business, and update it when you add something new such as booking, a store or a CRM. For anything complicated, such as health information, children's data or customers outside Canada, get proper advice.
How I can help
When I build a site for a Canadian small business, I can help you think through where a privacy page belongs and when a new feature like online booking means it needs an update. You can see how the free website works, and it's month-to-month, cancel any time. If you'd rather write the policy yourself, the sources below are the best place to start.
Sources
- Office of the Privacy Commissioner of Canada: PIPEDA in brief
- BC OIPC: Developing a privacy policy under PIPA (March 2019)
- BC OIPC: Privacy breach quick reference guide for small and medium-sized businesses
Want a custom website without the up-front cost? I'll build it free. You only pay $9/month* if you keep it.