Privacy Policy Requirements in Canada: What Yours Must Say (2026)
What every Canadian privacy policy must cover
Who you are and your privacy contact; what personal information you collect; why you collect it; how you use and share it; how long you keep it; how you protect it; cookies and analytics; and how people can access, correct or delete their data.
Law 25 extras
Quebec adds requirements: name the person responsible for privacy, disclose if data leaves Quebec/Canada, explain automated decision-making if you use it, and describe how you obtain consent. Plain language is required — no dense legalese.
Copy-ready outline
Use these headings: 1) Who we are 2) What we collect 3) Why 4) How we use it 5) Sharing 6) Cookies & analytics 7) Retention 8) Security 9) Your rights & how to exercise them 10) Contact. Fill each honestly — do not claim controls you do not have.
Action checklist
- ✅ Name your business and privacy contact
- ✅ List data types collected and the purpose for each
- ✅ Explain sharing and any cross-border transfer
- ✅ Describe cookies and analytics
- ✅ State retention periods
- ✅ Explain access/correction/deletion rights and how to use them
FAQ
Is a privacy policy legally required in Canada?
In practice yes — Law 25 and PIPEDA require transparency about how you handle personal information, and a published privacy policy is the standard way to meet that. It must be clear and accurate.
Can I copy another company's privacy policy?
No. A policy must reflect what your business actually collects and does. Copying one risks describing controls you do not have, which is itself a compliance problem.
Get a free assessment
Tell us where you are — we send back a clear, no-pressure plan. Leads only, no payment.