Canadian privacy law is a patchwork. Federal law, provincial laws, sector-specific laws, all overlapping.
This is the version that matters if you build or run a website. We're a web agency, not a law firm, so this covers the implementation side. For advice on your specific obligations, talk to a privacy lawyer.
What is PIPEDA?
The Personal Information Protection and Electronic Documents Act. Canada's federal private-sector privacy law.
It applies to organizations collecting, using, or disclosing personal information in the course of commercial activity, across Canada, except where a province has legislation deemed substantially similar. Quebec, Alberta, and BC each have their own regimes for provincially regulated organizations.
PIPEDA rests on ten principles:
- Accountability
- Identifying purposes
- Consent
- Limiting collection
- Limiting use, disclosure, and retention
- Accuracy
- Safeguards
- Openness
- Individual access
- Challenging compliance
Every obligation traces back to one of these. If you're trying to work out whether something is allowed, start by asking which principle it touches.
What is Quebec's Law 25?
Quebec's modernized privacy law, originally Bill 64, phased in between 2022 and 2024. It's the strictest privacy regime in Canada.
It applies to any organization collecting personal information from people in Quebec. Not organizations based in Quebec. Organizations collecting from Quebec residents. If you have a contact form and Quebecers fill it in, you're in scope.
What it adds beyond PIPEDA:
- A designated privacy officer, named publicly
- Consent that's specific, informed, and separate for each purpose
- Mandatory breach reporting and a breach register
- Privacy impact assessments before new systems that handle personal information
- Data portability
- Confidentiality by default on any product or service with privacy settings
Penalties reach into the millions or a percentage of worldwide turnover, whichever is higher. Quebec meant it.
What's the difference between PHIPA and PIPEDA?
PHIPA is Ontario's Personal Health Information Protection Act. It covers personal health information held by health information custodians: hospitals, clinics, practitioners, labs.
The differences that matter:
- Scope. PIPEDA covers commercial activity broadly. PHIPA covers health information specifically.
- Who it binds. PIPEDA binds organizations. PHIPA binds custodians and their agents.
- Consent. PHIPA has the circle of care concept, allowing implied consent for sharing among providers treating the same patient. PIPEDA has nothing equivalent.
- Strictness. PHIPA is tighter on health data, because health data is more sensitive.
An Ontario clinic handling patient records is generally under PHIPA for that information, not PIPEDA. If the same clinic runs a gift shop, the gift shop is a different question.
What this means for your website
The law is abstract. The implementation isn't.
Forms. Every field you collect needs a purpose you can state. If you can't say why you need someone's phone number, don't ask for it. Limiting collection is a principle, not a suggestion.
Consent. Under Law 25, one checkbox covering everything doesn't work. Consent has to be specific and per-purpose. A newsletter signup and a data-sharing arrangement are two different consents.
Cookies and analytics. Analytics that identifies individuals is personal information. Pre-ticked consent boxes aren't consent. If your cookie banner sets tracking cookies before anyone clicks, that's a problem in Quebec.
Third-party embeds. Every embedded widget, chat tool, donation platform, and video player is potentially sending data somewhere. You're accountable for it even though you didn't write it.
Privacy policy. Openness is a principle. A policy nobody can find or read doesn't satisfy it. It also needs to be accurate, which means updating it when your stack changes.
Retention. Form submissions sitting in a CMS forever is a retention problem. Decide how long you keep things, and actually delete them.
The practical starting point
Inventory what you collect, where it goes, and why. Most organizations have never done this and are surprised by the answer. Old forms collecting fields nobody uses. Analytics nobody reviews. A chat widget somebody installed in 2019.
You can't comply with rules about data you don't know you have.
Pragmatica has been building websites for Canadian non-profits, charities, and associations since 2004. Get in touch if you want help with the implementation side.
