Does PIPEDA apply to an Ontario business that only operates within the province?

Yes. PIPEDA is a federal law, but it applies to the handling of personal information by most Ontario businesses in the course of commercial activity regardless of whether that business ever crosses a provincial or international border. The trigger is commercial activity involving personal information, not whether the business ships products interprovincially, deals with out-of-province customers, or operates online versus from a single physical location.

Some provinces, including Quebec, British Columbia, and Alberta, have their own private-sector privacy legislation that applies instead of PIPEDA to activity within that province, but Ontario has no equivalent general private-sector privacy statute of its own. That means an Ontario business operating entirely within the province doesn't get to rely on some separate, lighter provincial regime — PIPEDA is simply the law that governs its handling of customer and other personal information, full stop.

Business owners sometimes assume "local" or "provincial" operations put them outside the reach of a "federal" law, but that reasoning doesn't hold here. If your business collects any personal information as part of ordinary commercial activity anywhere in Ontario, assume PIPEDA applies and build your practices around it.