Privacy for Ontario Small Businesses: The PIPEDA Basics

Ontario doesn't have its own general privacy law for private businesses, so most businesses in Ontario follow the federal Personal Information Protection and Electronic Documents Act (PIPEDA). Health information has its own Ontario law.

The basics

1. Accountability: name someone responsible for privacy.
2. Purpose: explain why you are collecting personal information.
3. Consent: get meaningful consent.
4. Limit collection: collect only what you need.
5. Limit use and retention: use it only for the stated purpose, and delete it when no longer needed.
6. Accuracy: keep it accurate.
7. Safeguards: protect it with security suited to its sensitivity.
8. Openness: make your privacy practices available.
9. Access: let people see and correct their information.
10. Challenging compliance: have a way to handle privacy complaints.

Privacy breaches

If a breach creates a real risk of significant harm, you must report it to the Privacy Commissioner of Canada and notify the affected people. Keep a record of every breach for at least 24 months.

Practical steps

• Use strong passwords and two-factor authentication.
• Limit who can see customer data.
• Post a clear privacy policy on your website.

Sources

• Personal Information Protection and Electronic Documents Act
• Office of the Privacy Commissioner of Canada: businesses

Read next: E-Signatures in Ontario: What You Can Sign Online

General Ontario legal information, not legal advice for your matter, and reading it does not create a retainer. Sources checked 15 October 2026: check the current law, forms and dates before you act.

Photos from Pexels: A screen showing digital security · A laptop showing a cybersecurity message.

This article is general information for people in Ontario, not legal advice. Rules, forms and deadlines change, and every situation is different. Check the current rule or speak to a licensed legal professional before you act.