Your privacy policy is often the first place regulators, partners and privacy-conscious customers look. In Canada, PIPEDA’s openness principle requires you to make information about your privacy practices readily available, and Quebec’s Law 25 adds specific publication requirements. A good policy is accurate, specific and readable.
Before you write: map your data
A privacy policy can only be accurate if you know what you actually do. Before drafting, list:
- Every point where you collect personal information (website forms, checkout, cookies and pixels, phone calls, in-person, job applications).
- Where the information is stored and which vendors process it.
- Why you use it and how long you keep it.
Copying another company’s policy is the most common mistake we see — it creates promises you do not keep and leaves out things you do.
The checklist
Who you are
- Your legal business name and contact details.
- The name or title and contact information of the person responsible for privacy (required in Quebec to be published on your website).
What you collect
- Categories of personal information (contact details, account data, payment information, technical data such as IP address and device identifiers, communications).
- Information collected automatically through cookies, analytics and advertising technologies.
- Information received from third parties, such as partners or public sources.
Why you collect it
- Specific purposes linked to each category — “to process orders”, “to send newsletters you subscribed to”, “to improve our website” — rather than “for business purposes”.
Who you share it with
- Categories of service providers (hosting, payment processing, email delivery, analytics) and any other recipients.
- Whether information may be stored or processed outside Canada (or outside Quebec), and that it may then be accessible to authorities in those jurisdictions.
- Whether you sell or rent personal information — ideally a clear “we don’t”.
How long you keep it and how you protect it
- Retention periods or the criteria used to set them.
- A general description of safeguards (access controls, encryption, staff training) without revealing details that would help attackers.
People’s rights and choices
- How to request access to or correction of personal information (see our access request guide).
- How to withdraw consent and unsubscribe from marketing (see our CASL guide).
- How to manage cookies and tracking preferences.
- For Quebec: portability rights and information about automated decisions, if you make any.
Complaints and updates
- How to make a complaint to you, and the right to complain to the Office of the Privacy Commissioner of Canada or the relevant provincial commissioner.
- The date the policy was last updated and how you will announce material changes.
Make it readable
The OPC’s guidance on meaningful consent stresses that people should be able to quickly understand the key elements: what information is collected, with whom it is shared, for what purposes, and any meaningful risk of harm. Practical tips:
- Use a short summary at the top, with details below.
- Use headings that match the questions people ask: “What we collect”, “Who we share it with”, “Your choices”.
- Write in plain language — and offer French where your audience requires it.
- Link to the policy at every point of collection, not only in the footer.
Keep it current
Review your policy whenever you add a new tool, vendor or data use — and at least once a year. A policy that is accurate today can become misleading the day someone installs a new marketing pixel.
Your privacy policy is one piece of a wider programme. Our PIPEDA compliance checklist and Quebec Law 25 guide cover the rest.
Frequently asked questions
Can I use a privacy policy generator?
Templates are a useful starting point, but only if you edit them to match your real data practices. The policy must describe what you do.
Do I need a separate cookie policy?
Not necessarily. Many businesses include a cookie section in the privacy policy. What matters is that people are informed and, where required (for example under Quebec’s privacy-by-default rule), can choose before tracking begins.
Get a second pair of eyes
Secure Pathways helps small and mid-sized businesses turn privacy requirements into a clear, manageable routine — from privacy audits and policy templates to consent management and breach readiness. If you are not sure where you stand on your privacy policy, get in touch for a complimentary consultation.
This article is general information, not legal advice. Privacy rules change and depend on your industry and province — confirm your obligations with a qualified professional.
