Do I need consent to store a customer's address?
You need consent, and for ordinary service work you very likely already have it. The question worth asking is not whether consent exists but whether it was meaningful.
Consent is one of PIPEDA's ten principles, and it comes in two forms. Express consent is stated outright — a ticked box, a signature, a clear yes. Implied consent is inferred from the circumstances, and the regulator is explicit that it is appropriate only in strictly limited situations, judged on how sensitive the information is and what the individual would reasonably expect.
A homeowner who fills in your request form with their address and a description of a leaking water heater has plainly consented to you using that to quote the job. Nobody types their address into a plumber's quote form under the impression the plumber will not read it.
Where implied consent runs out
It covers the purpose the customer had in mind. It does not stretch to purposes they did not. Adding that homeowner to a monthly marketing newsletter is a different purpose from quoting their job, and it is not covered by the consent they gave when they asked for a quote.
The regulator's own framing is useful here: an organisation must give people a clear and easily accessible choice for any collection, use or disclosure that is not necessary to provide the product or service. Quoting the job is necessary. Marketing to them afterwards is not, so that one needs its own opt-in.
What makes consent meaningful
The test is whether it is reasonable to expect your customers understand what they agreed to — what is being collected, who it is shared with, why, and what the consequences are. For a plumbing company that usually means one plain sentence near the form, not a policy nobody opens.
If a customer would be surprised to learn you were doing it, the consent you have probably does not cover it.
They can take it back
An individual can withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice, and you have to tell them what withdrawing will mean. In practice: someone can ask to be taken off your list, and you have to do it — but withdrawing consent does not erase a record you are independently required to keep, such as an invoice retained for tax purposes.
What this looks like in a real shop
- One sentence on your quote form saying what you will use the details for, linking to your privacy policy.
- A separate, unticked box if you want to market to them later.
- A way to honour "stop contacting me" that does not depend on one person remembering.
- No collecting fields you have no use for. The cleanest way to reduce risk is to hold less.
This is a plain-language summary of published guidance, not legal advice. Every claim above is sourced below. For a decision that carries real consequence for your business, talk to a lawyer who practises privacy law in your province.
Sources
Checked against the Office of the Privacy Commissioner of Canada on .