Does my Ontario business need a privacy policy if it collects customer information?

Practically, yes, even though the federal Personal Information Protection and Electronic Documents Act, which governs most Ontario businesses' handling of customer information, doesn't literally require a document titled "privacy policy." What it does require is openness: businesses collecting, using, or disclosing personal information in the course of commercial activity have to make information about their privacy practices readily available in a form customers can understand, including what's collected, why, and who it might be shared with.

In practice, a clear, accessible privacy policy is the standard, expected way businesses satisfy that openness obligation, which is why almost every legitimate Ontario business, regardless of size, ends up with one. Skipping it doesn't just create a compliance gap on paper; it also removes the easiest way to show customers, and the federal privacy regulator if a complaint is ever made, that your practices are transparent and consent-based.

Ontario has no separate provincial private-sector privacy law of its own, so PIPEDA is the operative framework here regardless of how small or local your business is. If you collect any customer information, even just names and emails for a mailing list, a clear, accurate privacy policy tailored to what you actually do is a sensible and genuinely low-cost step.