How to Use This Checklist

Work through each section and check whether your website currently meets the requirement. Items marked PIPEDA are relevant to most Canadian private-sector organizations. Items marked Law 25 are specifically required for organizations serving Quebec residents. Items marked PIPA apply to BC organizations.

1. Data Collection

  • Identify what you collect — You know exactly what personal information your website collects (names, emails, IP addresses, etc.) PIPEDA
  • Data minimization — You only collect information you actually need for a specific, identified purpose PIPEDA
  • Purpose identification — The purpose for collecting each type of information is identified before or at the time of collection PIPEDA
  • Third-party data flows — You know which third-party services receive visitor data (analytics, advertising, chat, fonts, etc.)
  • Retention limits — Personal information is not kept longer than necessary for its purpose PIPEDA

2. Cookies and Tracking

  • Cookie audit — You know which cookies your website sets and why
  • Analytics cookies — If using Google Analytics or similar, consent is obtained before setting cookies Law 25
  • Advertising pixels — If using Meta Pixel, Google Ads, or similar, consent is obtained before loading Law 25
  • Consent mechanism — If cookies require consent, the consent mechanism is genuine (not dark patterns) Law 25
  • Reject option — Users can reject non-essential cookies as easily as they can accept them
  • No tracking without consent — No tracking scripts load before consent is given

3. Contact Forms and Data Submission

  • Form disclosure — Contact forms explain what happens to submitted information PIPEDA
  • Privacy policy link — Forms link to your privacy policy
  • Secure transmission — Forms are submitted over HTTPS (SSL/TLS)
  • Form data storage — You know where form submissions are stored and for how long
  • Email marketing consent — If collecting emails for marketing, explicit consent is obtained separately from contact form submission CASL
  • CASL compliance — Commercial electronic messages comply with Canada's Anti-Spam Legislation CASL

4. Privacy Policy

  • Privacy policy exists — Your website has a privacy policy PIPEDA
  • Plain language — The privacy policy is written in plain language, not just legal boilerplate
  • Accessible location — The privacy policy is linked from the footer of every page
  • What you collect — The policy clearly states what personal information is collected
  • Why you collect it — The policy explains the purpose for each type of information collected
  • Third parties — The policy discloses which third-party services receive visitor data
  • Individual rights — The policy explains how individuals can access, correct, or request deletion of their information PIPEDA
  • Contact information — The policy includes contact information for privacy inquiries PIPEDA

5. Data Residency and Security

  • Hosting location — You know where your website is hosted and what jurisdiction applies
  • HTTPS — Your entire website is served over HTTPS with a valid SSL certificate
  • Form data security — Contact form submissions are transmitted and stored securely
  • Breach response plan — You have a plan for responding to a data breach, including notification obligations PIPEDA
  • Canadian data residency — If required, personal data is stored in Canada (healthcare, legal, government, financial services)

6. Quebec-Specific Requirements (Law 25)

  • Privacy officer — A privacy officer is designated and their contact information is published Law 25
  • Privacy policy in French — Privacy policy is available in French for Quebec visitors Law 25
  • Cookie consent — Genuine cookie consent is obtained before setting non-essential cookies Law 25
  • Right to erasure — Process exists for individuals to request deletion of their personal information Law 25
  • Breach notification — Process exists to notify the Commission d'acc—s — l'information within 72 hours of a breach Law 25
Important: This checklist provides general guidance only. For specific legal advice about your organization's privacy obligations, consult a Canadian lawyer familiar with privacy law. Privacy requirements vary by organization type, province, and sector.

How We Build Privacy-First Websites

At MyWaypoint Digital, privacy is a design principle, not a compliance exercise. Our default approach:

No cookies by default
No third-party analytics
No advertising trackers
No social media pixels
HTTPS on all pages
Secure form handling
Plain-language privacy policy
Canadian hosting options
Transparent data practices

Our own website is the proof: no cookies, no tracking, no analytics. We build client websites the same way. See our Trust Centre for our full privacy commitment.