Does PIPEDA apply to a small Ontario business, or only to large companies?

PIPEDA applies to small Ontario businesses too — there's no size, revenue, or employee-count exemption that carves smaller operations out of the federal Personal Information Protection and Electronic Documents Act. What triggers PIPEDA isn't how big a business is; it's whether the business collects, uses, or discloses personal information about identifiable individuals in the course of commercial activity, which describes the overwhelming majority of Ontario businesses that deal with customers at all, from a single-location retailer to a home-based online shop.

This surprises some small business owners who assume privacy legislation is really aimed at large corporations with big customer databases. In reality, a small business collecting customer names, emails, or payment information for ordinary sales, bookings, or service delivery is engaged in exactly the kind of commercial activity PIPEDA is meant to cover, and the same basic obligations around meaningful consent and being transparent about data practices apply regardless of the business's size.

Because Ontario has no separate provincial private-sector privacy law that might otherwise apply differently to smaller businesses, PIPEDA is simply the relevant federal framework here across the board. Don't assume your business is too small for it to matter.