If your business wants to collect, use, or disclose meaningful personal information:

  • You need consent (some limited exceptions apply)
  • You should only collect the personal information you need
  • You can only use or disclose personal information for the purpose for which consent was given
  • Even with consent, you still have to limit the collection, use, or disclosure to that which would be considered appropriate
  • The more sensitive the personal information, the greater the safeguards required such as Healthcare records
  • Individuals have a right to see the personal information your business holds on them

Oversight is through the Office of the Privacy Commissioner of Canada (OPC)