Short answer: if your Ontario business website collects personal information, you should have a privacy policy. And there is no small business exemption under Canada’s federal private-sector privacy law.
If you are wondering whether you need a privacy policy for a small business in Ontario, the answer is usually yes if your website collects personal information. That can include information submitted through a contact form, newsletter signup, online booking tool, e-commerce checkout, or certain analytics and tracking tools.
Under Canadian privacy law, businesses are expected to be transparent about what personal information they collect, why they collect it, how they use it, and who they share it with.
Most local businesses are not doing a very good job of that. We know because we checked.
When we audited 100 Kitchener-Waterloo small business websites, only 36% had a privacy policy linked from the homepage. Of the businesses running a contact form, 64% had no privacy policy linked from the homepage at all.
What law are we talking about?
For most private-sector businesses in Ontario, the main federal privacy law is PIPEDA, the Personal Information Protection and Electronic Documents Act. PIPEDA applies to organizations that collect, use, or disclose personal information in the course of commercial activities.
Importantly for small businesses, there is no general exemption based on company size. A sole proprietor running a one-page website can still have privacy obligations under PIPEDA, just as a much larger company does.
A few provinces, including Alberta, British Columbia, and Quebec, have their own private-sector privacy laws that have been recognized as substantially similar to PIPEDA. Ontario does not have an equivalent general private-sector privacy law, which means most ordinary businesses in Kitchener, Waterloo, Cambridge, and elsewhere in Ontario are governed by PIPEDA when they collect personal information in the course of commercial activity.
There are exceptions in specific sectors. For example, Ontario’s Personal Health Information Protection Act (PHIPA) applies to certain organizations handling personal health information.
You can read more directly from the Office of the Privacy Commissioner of Canada.
Does PIPEDA actually require a privacy policy?
PIPEDA does not simply say that every business must create a web page titled “Privacy Policy.” What it does require is transparency.
Organizations are expected to make information about their privacy practices readily available, including what personal information they collect, how it is used, and who is responsible for privacy matters within the organization. For a business with a public website, publishing a privacy policy online is one of the simplest and clearest ways to do that.
So while the legal requirement is broader than simply saying you must have a privacy policy page, the practical answer for most small business websites is the same: if your website collects personal information, you should have a clear privacy policy that visitors can easily find.
Does my website actually collect personal information?
Many business websites do. Here are some of the most common examples:
- A contact form. Names, email addresses, phone numbers, and information entered into the message field can all be personal information.
- A newsletter signup. Email addresses can be personal information.
- Online booking or quote requests. These often collect names, contact details, appointment information, addresses, or other details.
- E-commerce. Online stores commonly collect names, shipping and billing addresses, email addresses, and transaction information.
- Analytics and advertising tools. Tools such as Google Analytics, advertising pixels, and other tracking technologies may collect identifiers or information that can qualify as personal information depending on how they are configured and used.
If your website collects personal information in one or more of these ways, you should be thinking about your privacy obligations.
The detail almost everyone misses: data outside Canada
One of the most commonly overlooked issues is third-party software. Most business websites rely on outside services for things like analytics, email marketing, payment processing, website hosting, CRM software, online booking, form processing, and advertising.
Depending on the service and how your account is configured, personal information may be processed or stored outside Canada. That is not automatically prohibited. Canadian businesses are allowed to use service providers in other countries.
However, you remain responsible for the personal information under your control, and visitors should be given appropriate information about how their data is handled. If personal information may be processed outside Canada, your privacy policy should generally disclose that and explain that the information may be subject to the laws of the jurisdiction where it is processed.
This is one of those small details that can easily be missed in a generic privacy policy.
What actually goes in a privacy policy?
For a typical small business website, a useful privacy policy should explain:
- What you collect. For example, names, email addresses, phone numbers, form submissions, transaction information, or analytics data.
- How you collect it. Through forms, online bookings, purchases, cookies, analytics tools, or other technologies.
- Why you collect it. To respond to inquiries, provide services, fulfill orders, send newsletters, improve your website, or measure marketing performance.
- Who you share it with. For example, website hosts, email platforms, payment processors, booking systems, analytics providers, and other service providers.
- Where information may be processed. Including whether third-party providers may process or store data outside Canada.
- How long you keep it. Personal information should generally not be retained longer than necessary for the purposes for which it was collected.
- How people can contact you. Provide a contact point for privacy questions, complaints, and requests to access or correct personal information.
- How you protect it. Explain in plain language that reasonable administrative, technical, and physical safeguards are used.
You do not need several pages of legal language. The important thing is that the policy accurately reflects what your business actually does. Clarity beats legalese.
Can I just use a free privacy policy generator?
For a simple website, a privacy policy generator can be a reasonable starting point, but it should be treated as a template rather than a finished product.
There are two common problems. First, many privacy-policy generators are written primarily for US or European privacy laws and may not properly reflect Canadian requirements. Second, the policy has to match your actual website.
If a template says you do not use analytics, but Google Analytics is installed, the policy is inaccurate. If it says information stays in Canada, but one of your service providers processes data elsewhere, the policy may also be inaccurate.
So use a generator if it helps you build the skeleton. Then review it against the tools your website actually uses.
What about cookies and cookie banners?
Cookies are another area where advice online can become overly simplistic. There is no universal rule saying that every Ontario business website using cookies must display the same kind of GDPR-style cookie banner.
The important issue is whether personal information is being collected, used, or disclosed, and whether the business has obtained appropriate consent. If your website uses analytics, advertising pixels, behavioural advertising, or other tracking technologies, you should determine what level of notice and consent is appropriate for those tools.
For some websites, that may mean using a cookie consent banner or consent-management platform. For simpler websites using more limited technology, the requirements may be different. At minimum, visitors should be given clear information about non-obvious tracking practices and how their information is being used.
In our local website study, only 12% of the sites we reviewed displayed a cookie consent notice.
Make the policy easy to find
Once you have a privacy policy, do not bury it. Put a link in your website footer.
The footer is where visitors expect to find things like privacy policies, terms, accessibility information, and contact details. A footer link also makes the policy available throughout your site rather than only on the homepage.
One thing to watch in 2026
As of September 2026, PIPEDA remains Canada’s federal private-sector privacy law. The federal government has introduced legislation that would modernize Canada’s private-sector privacy framework, but those proposed changes have not yet replaced PIPEDA.
For small businesses, the practical advice today is simple: follow the law that is currently in force and revisit your privacy practices when the legislation changes.
The bottom line
If your Ontario business website collects personal information, you should have a clear and accessible privacy policy. There is no general small business exemption under PIPEDA.
Your policy should accurately explain what information you collect, why you collect it, what service providers you use, whether information may be processed outside Canada, how it is protected, and how someone can contact you about their information.
It does not need to be complicated. For many small businesses, this is an afternoon project: review the tools your website uses, create an accurate privacy policy, and add a link to it in your footer.
Based on what we found in our Kitchener-Waterloo website study, doing even that puts you ahead of a large percentage of local businesses.
If you would rather not sort through it yourself, this is the kind of detail we look at when building a website properly. Take a look at our website design work, or get in touch and we will point you in the right direction, no pitch.
This article provides general information about privacy practices for small business websites in Ontario. It is not legal advice. Privacy obligations can vary depending on your business, the information you collect, and the services you use. For advice about your specific obligations, speak with a qualified legal or privacy professional.
