PIPEDA and PHIPA: which one applies to you.
If you are an Ontario business handling customer information in the course of commercial activity, PIPEDA applies to you — there is no size exemption, and Ontario has no provincial private-sector privacy law that replaces it. If you hold personal health information as a custodian, PHIPA applies instead, and it covers a solo practice on the same terms as a hospital. Most Ontario businesses are under PIPEDA and do not realise it.
Why Ontario businesses fall under a federal law.
Some provinces have their own private-sector privacy legislation that the federal government has declared substantially similar, which displaces PIPEDA for activity inside that province. Ontario does not have one. Ontario's privacy statutes cover the public sector and health information; ordinary commercial activity is left to the federal law.
The practical consequence is that a florist in Alliston taking customer names, addresses and payment details is subject to PIPEDA in the same way a national retailer is. There is no employee count below which it stops applying. What changes with size is how much process is reasonable, not whether the obligations exist.
The two laws, side by side.
PIPEDA — commercial activity
Federal, enforced by the Office of the Privacy Commissioner of Canada. Applies to personal information collected, used or disclosed in the course of commercial activity. Covers consent, limiting collection to what you actually need, safeguarding it, and giving people access to what you hold about them.
PHIPA — personal health information
Ontario, enforced by the Information and Privacy Commissioner of Ontario. Applies to health information custodians — physicians, dentists, pharmacies, clinics, long-term care and others — regardless of size. A one-physician family practice carries the same core obligations as a hospital.
Where they meet
A health-sector custodian answers to PHIPA first for health information. A vendor serving that custodian may still be under PIPEDA for its own commercial activity. If you build software or provide IT services to a clinic, you are likely dealing with both at once, in different directions.
The breach obligation people miss.
PIPEDA's mandatory breach reporting has two parts, and the second one catches almost everyone.
First: a breach of security safeguards that creates a real risk of significant harm must be reported to the Privacy Commissioner and the affected individuals must be notified. That much is widely known.
Second, and less widely known: you must keep a record of every breach of security safeguards for 24 months — including the ones you assessed and decided did not meet the reporting threshold. The record has to contain enough detail for the Commissioner to check that your assessment was sound, and where you decided not to report, it should say why.
In other words, deciding a breach was minor is a decision you are expected to have documented. An organization with no breach log is not demonstrating that nothing happened; it is demonstrating that nothing was recorded. Knowingly contravening the reporting, notification or record-keeping requirements is an offence under the Act.
PHIPA works differently. Custodians report to the Information and Privacy Commissioner of Ontario at the first reasonable opportunity rather than against a fixed clock, and they submit annual statistics on all privacy breaches — not only the ones that triggered individual notification.
What this looks like for a small business.
Know what you hold, and why
Most over-collection is accidental. A contact form asking for a date of birth nobody uses is personal information you now have to protect for no benefit. The cheapest privacy improvement available is usually deleting a field.
A written policy people can actually read
PIPEDA expects you to be open about your practices. A privacy policy that nobody in the business has read is a liability rather than a defence — it describes commitments you are not keeping.
A breach log, started before you need it
Twenty-four months of records is only onerous if you begin after the first incident. A simple log with date, what happened, what information was involved, the harm assessment and the decision satisfies the requirement and takes minutes per entry.
Know where the data physically is
Personal information in a third-party system is still your responsibility. Which suppliers hold customer data, in which country, under what terms, is a question you should be able to answer without opening a contract.
Common questions.
Is my business too small for PIPEDA to apply?
No. PIPEDA has no small-business exemption. It applies to personal information handled in the course of commercial activity, whatever the size of the organization. What scales with size is the amount of process that is reasonable, not whether the law applies.
Does Ontario have its own privacy law instead?
Not for ordinary commercial activity. Ontario has statutes covering the public sector and personal health information, but no private-sector law declared substantially similar to PIPEDA, so PIPEDA is the operative framework for most Ontario businesses.
Do I have to report every breach?
No — you report breaches that create a real risk of significant harm. But you must keep a record of every breach for 24 months regardless, including those you decided not to report, along with the reasoning. The recording obligation is universal even though the reporting obligation is not.
We use a cloud provider. Are they responsible for compliance?
Not in your place. Using a third party to process personal information does not transfer your accountability for it. Your provider's certifications help you meet your obligations; they do not replace them.
We serve a medical clinic. Which law applies to us?
Probably both, in different directions. The clinic is a health information custodian under PHIPA. Your own commercial activity is under PIPEDA. If you handle health information on the clinic's behalf, your obligations flow from your agreement with them as well as from the legislation.
Sources.
This page states the law as we understand it and is not legal advice. For anything consequential, confirm against the primary sources or take advice:
Not sure what you are holding?
We will map what personal information your systems actually collect, where it lives, and what your obligations are — in one call.