A privacy-policy link is not the same as a privacy practice
Open with a realistic hypothetical: a local contractor has added a quote form, optional project-photo upload, email sign-up and analytics over several years. The privacy-policy link remains in the footer, but the owner cannot confidently explain what information reaches which providers or who answers a customer’s privacy question.
Explain the core distinction. A privacy policy should describe actual practices in understandable language; it cannot replace knowing what the business collects, why it needs it, how it protects it or who handles it. Avoid implying that every Canadian business is governed by identical privacy rules.
Businesses and your personal information - Office of the Privacy Commissioner of Canada
Provincial laws that may apply instead of PIPEDA - Office of the Privacy Commissioner of Canada
Start with a five-part inventory of what your website does
Ask readers to list every collection point: contact and quote forms, appointment requests, newsletter sign-ups, file or photo uploads, chat, payment steps, analytics and advertising tags. The aim is to understand the existing site, not to add more tracking or collect more information.
For each collection point, record the information requested, the specific business purpose, the people or providers receiving it, and who can access it internally. Encourage owners to remove fields that do not support a real next step. A request for a service area may help assess a quote request; a sensitive detail with no clear purpose may not.
Include a retention and responsibility check: decide who answers a privacy question, where enquiries land, whether access is limited to people who need it, and what internal process applies when information is no longer needed. Complex answers should be documented and reviewed with qualified advice rather than guessed.
Forms Tutorial | Web Accessibility Initiative (WAI) | W3C
Identify the providers that handle website information
Explain that information may move beyond the business inbox. Depending on the site, it may be processed by a form provider, email platform, booking service, customer relationship management system, analytics provider or advertising provider. The article should not assume that all providers or arrangements create the same legal issue.
Make the practical point: a business should be able to identify these providers before writing or revising public wording. The Office of the Privacy Commissioner of Canada states that an organization remains accountable for personal information processed by a third party on its behalf, so adding a provider is a reason to review both the website and the internal process.
Guidance on assessing third-party service providers - Office of the Privacy Commissioner of Canada
Run a plain-language policy match test
Set out a concise checklist. Does the policy accurately name the types of information collected? Does it explain why the business collects it in language a customer can understand? Does it describe meaningful third-party processing or sharing? Does it say how someone can ask a privacy question or seek access to their information? Does it identify a responsible person or role?
Stress that clarity matters at the moment a customer decides whether to submit information. A generic statement such as “we respect your privacy” gives less useful information than a factual explanation of how an enquiry is handled. The goal is not longer legalistic wording; it is an accurate account of the business’s practices.
Warn against copying wording from an unrelated business. Boilerplate may refer to collection methods, providers, jurisdictions or practices the business does not use, and can create a misleading public explanation.
Know when website copy is not enough
Explain that a straightforward local service enquiry form may be easier to map than a business collecting health information, financial information, identification documents or extensive project files. Complexity can also increase where information is used for behavioural advertising, shared across jurisdictions, handled by several providers or collected from customers in more than one province.
Recommend qualified privacy or legal advice before the business relies on generic wording in those situations. Make clear that a web designer or developer can help identify and implement website-side changes, but cannot certify legal compliance or replace legal advice.
Businesses and your personal information - Office of the Privacy Commissioner of Canada
Provincial laws that may apply instead of PIPEDA - Office of the Privacy Commissioner of Canada
A practical next step: map first, then update the site, process and policy together
Close with a useful action list: inventory every collection point, identify information and purpose, list providers and recipients, assign responsibility, compare the map against the published policy, and seek qualified advice where needed. The policy should follow the real practice, not lead it.
For businesses changing their forms, customer journey or integrations after appropriate privacy guidance, a custom website review can help make the website-side experience clear and consistent. Keep this as an optional, non-promotional closing.