Does PIPEDA Apply to Your Small Business Website?

Short answer: if your website collects any personal information in the course of doing business — and a contact form counts — PIPEDA almost certainly applies to you. There's no small-business exemption. There never was.

This is the opposite of the AODA situation, so if you read our AODA post and exhaled, don't get too comfortable. AODA's website rule lets most small businesses off the hook. PIPEDA doesn't. It's the compliance plot twist nobody warns you about.

The good news: complying is mostly common sense and a decent privacy policy, not a five-figure legal project. Let me walk through it in plain English.

What PIPEDA actually is

PIPEDA — the Personal Information Protection and Electronic Documents Act — is Canada's federal privacy law for the private sector. It governs how businesses collect, use and disclose personal information in the course of commercial activity.

"Personal information" is broader than people think. A name and email on a quote form is personal information. So is a phone number, an IP address in your analytics, or a photo. If it can be tied to a person, it counts.

Does it apply if I only have a contact form?

Yes. This is the part that catches people.

You don't need an online store, a login system, or a database of thousands of customers. A single contact form that collects a name and an email, so you can quote a job, is you collecting personal information in the course of commercial activity. That's the trigger. Full stop.

There's a narrow carve-out for business contact information used purely to reach someone in their professional role. But a homeowner filling out "get a quote" on your site isn't that. They're a customer, and their details are covered.

But I'm in Ontario / I'm tiny / I'm just one person

None of those get you out of it.

• Size doesn't matter. PIPEDA has no headcount or revenue threshold. One employee or a hundred, same rules.
• Ontario is squarely covered. Some provinces — BC, Alberta, Quebec — have their own private-sector privacy laws that stand in for PIPEDA within the province. Ontario doesn't. So Ontario businesses fall under PIPEDA directly.
• "I'm just a solo trade" isn't a loophole. If you're doing commercial activity, you're in.

The uncomfortable summary: most Canadian small-business websites are technically subject to PIPEDA, and most of their owners have no idea.

Do I need a privacy policy if I use Google Analytics?

Realistically, yes — and it's the most-skipped part.

Google Analytics, Meta Pixel, Mailchimp, Stripe, Calendly: every one of these collects personal information, and most of them process it on servers outside Canada (usually the US). PIPEDA doesn't ban that. But it does expect you to be transparent about it and to stay accountable for the data you hand off.

Translation: your privacy policy should tell people, in readable language, what you collect, why, who you share it with, and that some of it may be processed outside Canada. Not a wall of legalese — a page a normal human can actually follow.

What a PIPEDA-friendly privacy policy covers

You don't need a lawyer's 12-page epic. A solid small-business privacy policy hits these:

• What you collect — form fields, analytics, cookies, whatever applies.
• Why you collect it — to reply to enquiries, send a quote, run the site.
• Who you share it with — the tools above, named plainly.
• Where it goes — including "may be processed outside Canada."
• How people reach you — a real contact for privacy questions or to access their data.
• How you protect it — the basic safeguards you have in place.

One honest caveat, because I'd rather you trust this page than fear it: this is a plain-English overview, not legal advice, and edge cases exist. If you handle genuinely sensitive data — health, financial, kids' — talk to a privacy lawyer. For a typical trades or services site with a contact form, a clear policy and sensible habits get you most of the way there.

What happens if I don't comply?

Less than the scare-marketing implies — today. But that's changing.

Right now PIPEDA is enforced by the Office of the Privacy Commissioner, which investigates complaints and can publish its findings and make recommendations. It can't, on its own, hand you a giant fine. Binding orders or damages go through the Federal Court. So the near-term risk is mostly a complaint, an investigation, and the reputational joy of being publicly named for mishandling customer data.

Here's the "but." A replacement law with real teeth — fines reportedly up to the greater of $25 million or 5% of global revenue — has been circling Parliament and is widely expected to land. An earlier version, Bill C-27, died in early 2025, but the direction of travel is clear: Canada is moving toward GDPR-style penalties. Building this in now, while it's cheap and nobody's chasing you, beats scrambling later when they are.

The one-minute version

If your site has a contact form, PIPEDA applies. Size and Ontario don't save you. You need a readable privacy policy that says what you collect, why, who you share it with, and that some data leaves Canada. It's a small task done up front and an annoying one done in a panic.

If your current site doesn't have a privacy policy — or has a copy-pasted one that mentions a company that isn't yours — we'll build you a free demo homepage with the basics done right from the start. You see it before you pay a cent.

For the other half of the Canadian small-business compliance picture, see our plain-English AODA guide, and if you're still sorting the fundamentals, the small-business website checklist is a good next stop.

Frequently asked questions

Does PIPEDA apply if I only have a contact form?

Yes. A contact form that collects a name, email or phone number is you collecting personal information in the course of commercial activity, which is exactly what PIPEDA governs. You don't need an online store or user accounts — a single quote form is enough to bring you under the law.

Do I need a privacy policy if I use Google Analytics?

In practice, yes. Google Analytics collects personal information such as IP addresses and usually processes it outside Canada. PIPEDA expects you to be transparent about what you collect and where it goes, so a readable privacy policy that names your tools and notes that data may be processed abroad is the right move.

What happens if my small business doesn't comply with PIPEDA?

Currently the Office of the Privacy Commissioner investigates complaints and can publish findings and recommendations, but it can't levy large fines directly — damages go through the Federal Court, and the bigger risk today is reputational. However, replacement legislation with GDPR-style fines (reportedly up to $25 million or 5% of global revenue) is expected, so the penalty landscape is set to get much stricter.

Is PIPEDA the same as GDPR?

No. PIPEDA is Canada's federal privacy law; GDPR is the European Union's, and it's stricter with far larger fines already in force. They share principles like consent and transparency, but they're separate laws. If you have customers or visitors in the EU, GDPR may apply to you on top of PIPEDA.

What must a PIPEDA-compliant privacy policy include?

At minimum: what personal information you collect, why you collect it, who you share it with, whether it may be processed outside Canada, how people can access or correct their information, and a real contact for privacy questions. Plain language beats legalese — the goal is that a normal customer can actually understand it.