What rights does a customer have to access the personal information my Ontario business holds about them?

Under PIPEDA, an individual generally has the right to ask your business what personal information you hold about them, how it's being used, and who it has been disclosed to, and your business generally has to respond within a reasonable time and provide access to that information, subject to some limited exceptions, such as information that would reveal another person's personal information or that's protected by legal privilege. Customers also have the right to challenge the accuracy of information you hold and have it corrected if it's genuinely wrong or incomplete.

This isn't the same as customers being able to demand you delete everything you have about them on request; PIPEDA's access rights are primarily about transparency and correction, and separate practices about how long information should be retained and when it should be disposed of apply on their own terms, tied to the purpose it was collected for.

Businesses should have a straightforward internal process for handling access requests, since PIPEDA expects a genuine, timely response rather than a business simply ignoring or deflecting the request. If you're not sure how you'd respond to a customer's access request today, that's worth fixing before one actually arrives.