How to write a privacy policy that meets Canadian law
A privacy policy is the public statement of how your business collects, uses, shares and protects personal information. In Canada it is also how you meet the openness duty in PIPEDA and the publication rules in Quebec Law 25. This guide explains what the law expects, what a compliant policy contains, and how the free Valdra generator builds one from your answers.
Does a Canadian business need a privacy policy?
PIPEDA applies to private sector organizations that collect, use or disclose personal information in the course of commercial activity. Its openness principle requires you to make specific information about your personal information policies and practices readily available. For a business with a website, a published privacy policy is the practical way to do that.
Quebec is explicit. Under the Act respecting the protection of personal information in the private sector, as amended by Law 25, a business that collects personal information through technological means must publish a confidentiality policy on its website, drafted in clear and simple terms, and give notice of any change to it. It must also publish its governance rules and the title and contact information of the person in charge of the protection of personal information.
Alberta and British Columbia have their own private sector laws (PIPA), which also expect you to explain your practices on request. If you operate there, use the generated policy as your base and have it checked against your provincial law.
What a compliant Canadian privacy policy contains
Valdra builds every policy around the same sections, so nothing a regulator looks for is left out:
- Introduction: who you are and what the policy covers.
- Information collected: the categories of personal information, including cookies, and any automated decisions when you use them.
- Use: the purposes for each kind of information, stated before or at the time of collection.
- Legal basis: consent and the other grounds you rely on.
- Sharing: the service providers that process data for you, and sub processors when you list them.
- International transfers: whether information is stored or processed outside Canada or Quebec.
- Retention: how long you keep information and how you dispose of it.
- Your rights: access, correction and withdrawal of consent with a 30 day response, plus portability and de-indexation for Quebec.
- Security: the safeguards that protect the information.
- Cookies: what you use and why.
- Children: your minimum age, when you set one.
- Changes: how you tell people when the policy changes.
- Contact: how to reach your privacy officer and how to complain.
What you enter in the form
The generator asks for your business name, website, a short description, province, industry and effective date. Then it asks about your practices: the types of data you collect, cookies, automated decisions, minimum age, marketing email and the platform you send it with, processors and sub processors, international transfers, your business model and payment processor, user content, your privacy officer, a privacy contact email and how disputes are resolved.
If you send marketing email, the policy adds CASL wording on how you obtain consent and how people unsubscribe. The rights section points to your own privacy request page, so people know where to send an access request.
Generator, template or lawyer?
Each option has a place. This is how they compare for a small or mid sized Canadian business.
| Valdra generator | Generic online template | Lawyer drafted | |
|---|---|---|---|
| Cost | Free with a Valdra Free account | Often free | Professional fees |
| Written from your practices | Yes, from your form answers | Mostly fill in the blanks | Yes |
| PIPEDA and Law 25 items | Built in | Often written for US or EU law | Yes |
| Canadian French | Yes, per document | Rarely | On request |
| Versions and comparison | Yes | No | Manual |
| Best for | Getting compliant now | A placeholder | Complex or regulated businesses |
Keeping your policy current
A privacy policy is only accurate while it matches what you do. When you add a new tool, start sending marketing email, or move data outside Canada, regenerate the policy and publish the new version. Valdra keeps every earlier version and lets you compare them, which is useful evidence of what you told the public and when. The policy does not change itself when the law changes, so review it whenever Canadian privacy rules move.
Quebec penalties make this worth doing. Under Law 25 the Commission d'accès à l'information can impose administrative monetary penalties of up to $10 million or 2% of worldwide turnover, whichever is greater, and penal fines imposed by a court reach $25 million or 4%, whichever is greater.
Beyond the privacy policy
The privacy policy is the one document on the Free plan, which also includes one PIPEDA assessment, one assessment of your home law if you are a Quebec business (Law 25), an Alberta or BC business (PIPA) or a Nova Scotia public body (FOIPOP), in app alerts and e-signature requests. Starter adds Terms of Service, a data processing agreement, an acceptable use policy and a cookie policy filled from your Valdra cookie scan. Professional adds retention, information security, incident response, cross border disclosure and AI policies.
Valdra has a free plan with no time limit. Starter is $249 CAD a month and Professional is $599 CAD a month, with two months free on annual billing. Enterprise pricing is custom. Your records are stored in Canada and the product works in English and French.
