Does PIPEDA Apply to Your Ontario Business? A Plain-Language Test

If your Ontario business collects any personal information from customers, clients, or website visitors — names, emails, payment details, browsing behaviour — there's a good chance a federal privacy law already applies to you, whether you've thought about it or not. Does PIPEDA apply to your specific business? For most Ontario businesses engaged in ordinary commercial activity, the answer is yes.

This article walks through the basic test in plain language, so you can figure out where your business actually stands.

The Basic Test: Personal Information + Commercial Activity

The Personal Information Protection and Electronic Documents Act (PIPEDA) is a federal statute that governs how private-sector organizations collect, use, and disclose personal information in the course of commercial activity. Two elements generally need to be present:

1. Personal information — information about an identifiable individual, such as names, contact details, or purchase history.
2. Commercial activity — any transaction, act, or conduct of a commercial character, which covers the vast majority of ordinary business dealings.

If your business fits both, PIPEDA is very likely already part of your legal obligations, even if you've never formally addressed it. It doesn't matter whether your business is a corporation, a partnership, or a sole proprietorship — the legal form you operate under doesn't change whether PIPEDA applies to how you handle personal information.

Why Ontario Businesses Specifically Are Caught

Some provinces — Quebec, British Columbia, and Alberta, for example — have their own private-sector privacy statutes that apply instead of PIPEDA for activity within that province. Ontario has no general private-sector privacy statute of its own. As a result, PIPEDA is the law that applies to most Ontario businesses' handling of customer and client personal information — there isn't a separate "Ontario privacy law" layered on top for ordinary commercial activity.

Common Situations Where PIPEDA Clearly Applies

• Running an online store or booking system that collects customer names, addresses, and payment information.
• Maintaining an email list or newsletter with subscriber contact details.
• Using website analytics or marketing tools that track visitor behaviour.
• Storing client files, intake forms, or customer records that contain personal details.
• Sharing customer information with a third-party service provider, such as a payment processor, shipping company, or CRM platform.

Situations That Are Often Misunderstood

• "We're too small to matter." PIPEDA does not generally carve out an exemption for small businesses based on size — the trigger is the nature of the activity (commercial) and the type of information (personal), not the size of the organization.
• "We don't sell anything, so it doesn't apply." Commercial activity is broader than sales — it can include activities like maintaining a client list for a service business, or running a loyalty or referral program.
• Employee information is treated somewhat differently. A narrower rule governs employee personal information, and it generally applies mainly to federally regulated employers, such as banks or telecommunications companies. Most Ontario businesses' customer-facing data collection is what triggers PIPEDA, not their internal HR files.

What PIPEDA Requires Once It Applies

Once PIPEDA applies to your business, the core expectations generally include:

• Obtaining meaningful consent before collecting, using, or disclosing personal information for a given purpose.
• Being able to explain, in plain terms, what personal information you collect and why.
• Limiting collection, use, and disclosure to what's reasonably needed for the identified purpose.
• Keeping personal information reasonably secure and not holding onto it longer than necessary.

These aren't one-time boxes to check. As your business adds new tools, vendors, or ways of collecting information, the same questions apply again: what are you collecting now, why, and have your customers meaningfully agreed to it.

Frequently asked questions