✅ De-facto mandatory under the federal Personal Information Protection and Electronic Documents Act (PIPEDA) Openness/Accountability principles — the policy must be publicly available. ⚠️ Quebec: directly mandatory under Law 25, with a much stricter regime — publication in plain language plus published privacy-officer contact details; penalties can reach $25 million or 4% of worldwide turnover.
⚠️ This is a blank template, not legal advice: check the wording with a lawyer and adapt it to your jurisdiction and your case.
This template has no optional clauses: the text is the same for everyone. Field placeholders are shown as labels — on the site the template is read-only, values are entered inside the system.
PRIVACY POLICY
Business name Effective date: Effective date
This policy explains how Business name collects, uses, discloses, and protects personal information, in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA). ⚠️ In Quebec, this policy is written to also satisfy Quebec's Law 25 (An Act to modernize legislative provisions as regards the protection of personal information), which imposes stricter requirements than PIPEDA. ⚠️ British Columbia and Alberta each have their own Personal Information Protection Act (PIPA), which — unlike PIPEDA — also covers employee personal information.
1. WHAT WE COLLECT 1.1. What personal data we collect
2. WHY WE COLLECT IT 2.1. Purposes of collection and use
3. CONSENT 3.1. Consent and how to withdraw it
4. DISCLOSURE TO THIRD PARTIES 4.1. Disclosure to third parties
5. TRANSFER OUTSIDE QUEBEC / ACROSS BORDERS 5.1. Cross-border / outside-Quebec transfer assessment
6. COOKIES AND TRACKING 6.1. Cookies and tracking technologies
7. RETENTION 7.1. Data retention period
8. CONTACT / PRIVACY OFFICER 8.1. Requests, questions, and complaints about this policy may be sent to: Privacy officer / contact for requests.
⚠️ Quebec businesses: this document exists in an English form for reference only — the primary, legally-operative version for Quebec customers must be published in French, "in simple and clear terms," per Law 25.
— — — ⚠️ This is a boilerplate template, not legal advice. Employment, consumer-protection, privacy, and food-safety law in Canada is largely PROVINCIAL — this template uses Ontario (Employment Standards Act, 2000 / Occupational Health and Safety Act) as its default reference jurisdiction and flags with ⚠️ the specific British Columbia, Alberta, and Quebec divergences named in the underlying research, but it does not resolve every provincial variation for you. Quebec employers additionally have French-language obligations under the Charte de la langue française (Bill 96) that are handled as a separate French-language document, not by this English template. Have this document reviewed and adapted by a lawyer licensed in the relevant province before use, and confirm the current minimums/thresholds in force on the date of use — termination-clause case law in particular (Waksdale, Dufault, Chan and successors) changes year to year.
Fields that belong to a switched-off clause are dimmed — they are not asked for.
e.g. orders, reservations, loyalty program, camera/video footage
e.g. payment processors, delivery platforms
⚠️ Quebec Law 25: a privacy impact assessment is required before transferring personal information outside Quebec
⚠️ Quebec Law 25: tracking technologies must be OFF by default, with explicit opt-in
⚠️ Quebec Law 25: by default the person in charge of protecting personal information is the head of the business — this person's title and contact details must be published
1 of 10 fields are taken from the company, employee or counterparty record, the questionnaire can be dictated to the AI, and the finished document comes with a number, a PDF and an acknowledgement record.