Personal Data Notice Template for Canada

A Personal Data Notice is a fundamental privacy compliance document that Canadian organizations must provide to individuals when collecting their personal information. Under federal and provincial privacy laws, this notice serves as your primary tool for meeting transparency obligations and building trust with customers, employees, and other stakeholders whose data you handle.

When do you need this document?

You need a Personal Data Notice whenever your organization collects personal information as part of commercial activities. This includes when you gather customer information through websites, mobile apps, or in-person transactions, collect employee data during hiring and employment processes, obtain client information for professional services, or use third-party service providers who handle personal data on your behalf. The notice is also required when you update your data handling practices, expand into new provinces with different privacy requirements, or implement new technologies that affect how you process personal information. Organizations operating in multiple provinces must ensure their notice addresses varying provincial requirements, particularly in Quebec and British Columbia which have distinct privacy legislation.

Key legal considerations

Your Personal Data Notice must clearly identify the types of personal information you collect, the specific purposes for collection and use, and the legal basis for processing under applicable privacy laws. The document should outline your consent mechanisms, explaining when and how you obtain consent from individuals, and describe circumstances where consent may not be required. You must include information about data retention periods, security measures to protect personal information, and procedures for individuals to access, correct, or request deletion of their data. The notice should also detail any disclosure of personal information to third parties, including service providers, and explain individuals' rights to withdraw consent and file complaints with privacy commissioners.

Legal requirements in Canada

Under PIPEDA, your notice must demonstrate compliance with ten fair information principles, including accountability, identifying purposes, consent, limiting collection, limiting use and disclosure, accuracy, safeguards, openness, individual access, and challenging compliance. Provincial laws add specific requirements: Quebec's private sector protection act requires explicit consent for sensitive information and mandates breach notification procedures, while British Columbia's PIPA includes specific provisions for employee personal information and requires organizations to designate a contact person for privacy inquiries. The notice must be prominently displayed, easily accessible through your website or physical locations, and written in language that individuals can reasonably understand. Organizations must also ensure the notice is available in both official languages when conducting business in federal jurisdiction, and some provinces require additional language considerations for their diverse populations.