Privacy basics for website forms in Canada

Every contact form, quote request and booking widget on your website collects personal information. In Canada, privacy law sets expectations for how you handle it. The good news is that most of what the law asks for is also just good practice.

This article covers the basics for private-sector businesses. It is general information, not legal advice. Check the guidance from the Office of the Privacy Commissioner of Canada at priv.gc.ca, and talk to a lawyer about your specific situation.

Which privacy law applies to you

The federal law is the Personal Information Protection and Electronic Documents Act, known as PIPEDA. It covers private-sector organizations that collect, use or disclose personal information in the course of commercial activity.

Some provinces have privacy laws the federal government accepts as equivalent. Alberta’s is the Personal Information Protection Act, or PIPA, and British Columbia and Quebec have their own. The Privacy Commissioner of Canada explains that a business covered by one of these laws usually follows it, rather than PIPEDA, for information it handles inside that province. PIPEDA still applies when personal information crosses provincial or national borders in the course of commercial activity.

For a Calgary business, that can mean both laws are relevant. Alberta's PIPA has also been through a legislative review with recommended changes, so check the current version. The principles below are a sensible baseline either way.

The principles behind PIPEDA

PIPEDA is built on ten fair information principles. For website forms, these come up most often:

• Accountability: someone in your organization is responsible for privacy compliance.
• Identifying purposes: tell people why you are collecting their information at or before the time you collect it.
• Consent: get meaningful consent for how you collect, use and share it.
• Limiting collection: collect only what you need for the purpose you stated.
• Limiting use, disclosure and retention: use it only for that purpose, and keep it only as long as needed.
• Safeguards: protect it with security that matches its sensitivity.
• Openness: make your privacy practices easy to find and understand.

The remaining principles cover accuracy, people's right to access their own information, and their ability to challenge how you comply.

Designing forms that respect privacy

Good privacy starts with the form itself. Ask a simple question: what is the minimum we need to respond to this person?

• Drop fields you do not use. If you never phone people back, you may not need a phone number. If you do not need a birthdate, do not ask for one.
• Explain the purpose beside the form in one plain sentence, such as: We use these details to reply to your request and will not add you to our mailing list without your permission.
• Keep marketing consent separate. A quote request is not permission to send newsletters. Use a separate, unchecked box if you want marketing consent, which also helps with anti-spam rules.
• Be careful with sensitive information. Health, financial or identity details need stronger protection and clearer consent. Ask whether a website form is the right channel at all.

Retention and safeguards

Form submissions tend to pile up in inboxes, CRMs and spreadsheets for years. Under PIPEDA, personal information should be kept only as long as it is needed for the purpose it was collected for. Set a retention period, for example deleting inquiries that never became customers after a set time, and then actually follow it.

For safeguards, think about the whole path the data takes:

• The site uses HTTPS, so form data is encrypted on its way to you
• Submissions go to a secure system, not a shared inbox everyone can open
• Accounts that can see submissions use strong passwords and two-factor authentication
• Only staff who need the data can access it
• Old exports and spreadsheets get deleted, not left in downloads folders

If something does go wrong, PIPEDA requires organizations to report breaches that create a real risk of significant harm to the Privacy Commissioner, notify the affected people, and keep records of all breaches of security safeguards. Alberta's PIPA has its own breach notification requirements, so know which rules apply to you before you need them.

Writing a privacy policy people can read

Your privacy policy is how you meet the openness principle. It should be easy to find, usually linked in your footer and near your forms, and written in plain language. Cover:

• What information you collect and how, including forms, cookies and analytics
• Why you collect it and how you use it
• Who you share it with, including service providers, and whether data is stored outside Canada
• How long you keep it
• How people can access or correct their information
• Who to contact with privacy questions

Avoid copying another business's policy word for word. A long policy describing practices you do not follow is worse than a short one that is accurate.

Our recommendation

Walk through every form on your website and ask three questions: do we need each field, do we say why we are asking, and where does the data end up? Trim what you can, add a plain purpose statement, and update your privacy policy to match what really happens. If you collect sensitive information or operate across provinces, have a lawyer review your approach.

Written by Vishal Singh

Founder of Byte Harbor and a senior frontend and web platform engineer. He builds websites, custom software and AI automation for businesses across Canada and the US.

About Byte Harbor