Website Privacy for BC Businesses: PIPA, PIPEDA and CASL
What British Columbia businesses should know about website privacy: PIPA, PIPEDA, CASL, contact forms, cookies, analytics and writing a clear privacy policy.
Almost every business website collects personal information — through contact forms, newsletter sign-ups, online bookings or analytics. In British Columbia, that comes with legal responsibilities.
This guide explains the basics in plain language. It’s general information, not legal advice; for your specific situation, speak with a lawyer or check the official guidance from the privacy commissioners.
Which privacy laws apply?
| Law | Generally applies to |
|---|---|
| BC PIPA (Personal Information Protection Act) | Private-sector organisations collecting, using and disclosing personal information within British Columbia |
| PIPEDA (federal) | Personal information handled in commercial activities across provincial or national borders, and federally regulated businesses |
| CASL (Canada’s Anti-Spam Legislation) | Commercial electronic messages such as marketing emails and texts |
Many BC businesses deal with more than one: PIPA for local customer data, PIPEDA when data crosses borders (for example, cloud tools hosted elsewhere), and CASL for email marketing. If you have customers in Europe, the GDPR may apply too.
The core principles
Although the laws differ in detail, they share common principles:
- Consent: collect personal information with the person’s knowledge and consent, which can be implied in some situations and must be explicit in others.
- Purpose: explain why you collect information and use it only for that purpose.
- Limit collection: collect only what you need.
- Security: protect the information with reasonable safeguards.
- Access: people can ask to see and correct their information.
- Retention: don’t keep information longer than needed.
- Accountability: someone in the organisation is responsible for privacy.
What this means for your website
Contact and booking forms
- Ask only for the information you need.
- Explain how you’ll use it, with a link to your privacy policy near the form.
- Send form data securely (HTTPS) and limit who can access it.
Analytics and cookies
Tools like Google Analytics collect information about visitors’ devices and behaviour. Explain this in your privacy policy, configure tools to collect only what you need, and give visitors a way to opt out. Turn off advertising features and data sharing you don’t use.
Email marketing (CASL)
Get consent before sending marketing emails, identify your business, include contact information and offer a working unsubscribe link. Keep records of how and when people subscribed.
Third-party tools
Chat widgets, booking systems, embedded maps and CRMs may store data outside Canada. Know where your tools store data and mention this in your privacy policy.
Security basics
HTTPS everywhere, updated software, strong passwords with multi-factor authentication, and reliable backups. My WordPress security guide covers the essentials.
What to include in a privacy policy
- Who you are and how to contact your privacy contact.
- What personal information you collect — forms, emails, analytics, cookies.
- Why you collect it and how you use it.
- Who you share it with, including service providers and where data may be stored.
- How long you keep it.
- How you protect it.
- How people can access, correct or delete their information, or withdraw consent.
- When the policy was last updated.
Write it in plain language, link to it from your footer and forms, and update it whenever you add new tools.
Common mistakes
- Copying a privacy policy from another website that doesn’t match your tools.
- Adding analytics or marketing pixels without updating the policy.
- Collecting more form fields than you need.
- Emailing contacts who never agreed to marketing messages.
- Storing form submissions forever in an unprotected inbox or database.
Frequently asked questions
Does a small business website need a privacy policy?
If you collect any personal information — even a name and email through a contact form — having a clear privacy policy is strongly recommended and expected by privacy law principles.
Do I need a cookie banner in Canada?
Canadian law focuses on meaningful consent and transparency rather than a specific banner format. Requirements depend on what you collect and how; if you serve European visitors, GDPR rules on consent may apply.
Who enforces these laws?
In BC, the Office of the Information and Privacy Commissioner for British Columbia oversees PIPA; the Office of the Privacy Commissioner of Canada oversees PIPEDA; and the CRTC is the main regulator for CASL, alongside the Competition Bureau and the federal Privacy Commissioner.
Want a website that respects privacy and performs well?
I build fast, secure websites with privacy-friendly analytics and clear policies. Learn more about my web development services, or get in touch.
