Key obligations
Every Canadian business should:
- Designate a privacy officer (the person accountable for compliance).
- Publish a clear privacy policy describing what you collect, why, with whom you share it.
- Obtain meaningful consent, especially for sensitive or unexpected uses.
- Limit collection to what is necessary for stated purposes.
- Implement reasonable security safeguards, including encryption at rest and in transit.
- Have a breach response plan with 24/7 contacts and templates.
Province-specific extras
If you operate in:
- BC: BC PIPA applies. Follow OIPC BC guidance on employee information.
- Alberta: Alberta PIPA applies. Breach notification is mandatory and Alberta was the first province to require it.
- Quebec: Law 25 applies. Conduct a PIA for every new system. Register biometric systems with the CAI.
CASL basics
If you send commercial electronic messages, you must:
- Obtain express or implied consent.
- Include sender identification and contact information.
- Provide a working unsubscribe mechanism for 60 days.
- Process unsubscribe requests within 10 business days.
Resources
The OPC publishes a free Privacy Toolkit for Business. Provincial commissioners publish industry-specific guidance.