Pipecue

Does PIPEDA apply to my plumbing business?

Almost certainly yes — though in three provinces it is a provincial law rather than the federal one. Either way, the obligations on a small shop are more modest than the acronym suggests.

PIPEDA is the federal Personal Information Protection and Electronic Documents Act. It applies to private-sector organisations that collect, use or disclose personal information in the course of a commercial activity. Booking a service call, quoting a job and invoicing for it are all commercial activity, and a customer's name, address, phone number and the description of what went wrong in their basement are all personal information.

There is no small-business exemption. A one-truck operation is covered on the same terms as a national chain. What differs is scale, not obligation: a shop holding four hundred customer records has less to do than one holding four hundred thousand, but the same rules describe what it must do.

Unless you are in Alberta, British Columbia or Quebec

Three provinces have their own private-sector privacy laws that the federal government has declared substantially similar to PIPEDA: Alberta, British Columbia and Quebec. An organisation operating within one of those provinces is generally exempt from PIPEDA for the personal information it handles inside that province, and follows the provincial statute instead.

In practice this matters less than it sounds for a plumbing company, because the underlying principles are close. Where it does matter is Quebec, whose Law 25 imposes materially stricter requirements than the rest of the country — mandatory privacy officers, privacy impact assessments, and specific consent rules. If you operate in Quebec, do not assume guidance written for PIPEDA transfers.

Work across a provincial border — quoting in one province, servicing in another — and information crossing that border falls under PIPEDA even if both provinces have their own law.

What it actually asks of you

The Act is built on ten fair information principles. Stripped of the legal phrasing, they ask a small business to be able to answer five questions honestly:

  • What do you collect, and why? You need a reason for each thing you ask for. Collecting a homeowner's date of birth to quote a water heater has no reason behind it.
  • Did they agree to it? Consent has to be meaningful — see do I need consent to store a customer's address.
  • How long do you keep it? Only as long as the purpose requires. There is no fixed number in the Act.
  • Is it safe? Safeguards proportionate to how sensitive the information is.
  • Can they see it? A customer can ask for their own information and you have thirty days to respond.

The part most shops get wrong

Not consent, and not security. It is retention — quote requests from four years ago sitting in an inbox nobody has emptied, for jobs that were never won. That is personal information held past the purpose it was collected for, and it is the single most common gap in a small trade business.

It is also the easiest to close, because the fix is a decision rather than a system: decide how long a lost quote is worth keeping, write the number down, and delete on that schedule.

This is a plain-language summary of published guidance, not legal advice. Every claim above is sourced below. For a decision that carries real consequence for your business, talk to a lawyer who practises privacy law in your province.

Sources

Checked against the Office of the Privacy Commissioner of Canada on .

Related