Privacy kit

How it works

1. 1 Tick what you collect about customers, name the apps that hold it and where they keep it, and say who answers privacy questions. Your trade fills in a sensible start.
2. 2 Watch the ring fill as you cover Canada's ten fair information principles, and fix what “Before it goes up” flags. Every piece of the kit is worded from your answers.
3. 3 Copy the policy to your website, print the Privacy Facts label, the camera sign and the Wi-Fi card, and keep the data map. When a customer asks, or something goes wrong, the letters, the deadlines and the breach record are ready.

Free, with no account. Everything happens on this page and is never sent to us. A customer's name in a request letter, or anything typed about a breach, is never saved at all: close the page and it's gone. Remember keeps only the setup, on this device.

Good to know

Does a small business really need a privacy policy?

If you collect customers' personal information in the course of business, Canada's federal privacy law, PIPEDA, generally applies, whatever your size. One of its principles is openness: people should be able to find out, in plain words, what you collect, why, and who to ask. A booking app, an email list or a card machine is enough to count.

What's the Privacy Facts label for?

Most people won't read a full policy at the counter. The Privacy Commissioner encourages putting the key points up front and the details a layer below, so the label shows what you collect, how long you keep it, what you never do, and who to ask, with a QR code to the full policy.

My apps keep data in the US. Is that allowed?

Generally, yes. Using a service outside Canada is allowed, but you stay responsible for the information, and you should tell people it may be processed in another country, where courts and authorities there may be able to reach it. The data map and the policy say this for every app you mark outside Canada or not sure.

A customer asked to see what we have on them. How long do I have?

Thirty days. You can take up to 30 more if gathering it would seriously disrupt the business, you need to consult someone, or you're converting the format, but you have to tell them in writing within the first 30 days. Not answering in time counts as a refusal. It should cost them nothing, or very little.

What counts as a breach I have to report?

A lost device, a hacked account, misdirected email or snooping can all be breaches. If one creates a real risk of significant harm, report it to the Privacy Commissioner and tell the people affected as soon as you can. Either way, keep a record of every breach for 24 months. The risk grid helps you think it through; the decision is yours.

Do I need a sign for security cameras?

The Privacy Commissioner's guidance for businesses says to tell people about cameras before they're recorded, usually with a sign at the entrance, keep recordings only as long as you need them, and let only a few people watch. Point cameras away from places people expect privacy, like washrooms and change rooms.

What about Quebec, British Columbia and Alberta?

They have their own private-sector privacy laws, which apply to most information collected inside the province (verify). Quebec's rules are the strictest, with extra duties like naming the person in charge of privacy and publishing information in French. If you're there, have the policy checked against your province's law.

Is anything sent or stored?

No. The policy, the label and the letters are written in this tab, and printing goes straight from your browser to your printer. Customer names and breach notes stay in memory only. Remember keeps just the setup in this browser, and you can untick it to forget.

Is this legal advice?

No. Guidance, not legal advice. It's plain wording for common situations, with checks for common gaps. If you hold sensitive information, like health details, or you've had a serious breach, talk to a lawyer or contact the Privacy Commissioner's office.

From the Privacy Commissioner of Canada: the ten principles, meaningful consent, data across borders, access requests, breaches and video cameras. And the law itself, PIPEDA, with its breach regulations. Guidance, not legal advice.