Ontario Privacy Law for Apps and Websites: PIPEDA, PHIPA and Employee Monitoring

This guide is general information for planning software projects, current as of October 2026. It is not legal advice; confirm your obligations with a privacy lawyer.

Short answer: Ontario has no general private-sector privacy law of its own, so businesses in Ontario follow the federal PIPEDA for customer and other commercial personal information. If you handle personal health information as a health information custodian, or on behalf of one, Ontario's PHIPA applies. Employers with 25 or more workers in Ontario must also have a written electronic monitoring policy under the Employment Standards Act.

PIPEDA: the main law for Ontario businesses

PIPEDA is built on ten fair information principles, including accountability, identifying purposes, consent, limiting collection, safeguards, openness and individual access. For an app or website, that translates into:

• A clear privacy policy that explains what you collect, why, and who you share it with.
• Meaningful consent, with separate choices for optional uses such as marketing or analytics.
• Collecting only what the feature needs, and deleting data you no longer need.
• Security safeguards proportionate to the sensitivity of the data.
• A way for people to access and correct their information.

Breach reporting under PIPEDA

If a breach of security safeguards creates a real risk of significant harm, you must report it to the Office of the Privacy Commissioner of Canada and notify the affected individuals as soon as feasible. You must also keep a record of every breach, even minor ones, for 24 months. Build logging and alerting that let you investigate quickly, and a simple internal process for deciding whether the threshold is met.

PHIPA for health apps

If you're building for clinics, hospitals, pharmacies or other health information custodians, Ontario's Personal Health Information Protection Act sets stricter rules for collecting, using and disclosing personal health information, including for the technology providers that work for them. Health projects need access logging, strict role-based access and careful vendor agreements from day one.

Employee data and electronic monitoring

PIPEDA generally doesn't cover employee information at provincially regulated Ontario employers. But under the Employment Standards Act, employers with 25 or more employees on January 1 must have a written policy explaining whether, how and why they monitor employees electronically. If your software tracks location, devices or activity, such as field-service or productivity tools, make the data it collects easy to describe in that policy.

What to build into an Ontario app

• Consent screens and settings that separate required from optional uses.
• Role-based access, audit logs and encryption for sensitive data.
• Data retention rules and deletion that actually run.
• Breach logging and alerting tied to a response plan.
• CASL for emails and texts. Canada's anti-spam law applies everywhere in Canada: commercial emails and text messages need consent, identification of the sender and a working unsubscribe. Build these into sign-up flows and notification settings.

Serving customers in Québec too? Read our Law 25 checklist, and see privacy law by province for the full picture.

What about federal privacy reform?

In June 2026 the federal government introduced Bill C-36, which would replace PIPEDA's private-sector rules with a new Protecting Privacy and Consumer Data Act, with a new regulator and stronger enforcement. As of October 2026 it has only passed first reading, and earlier attempts (Bill C-11 and Bill C-27) died before becoming law. PIPEDA still applies until a new law is in force. Building to good privacy practice now, such as clear consent, minimal data and documented safeguards, keeps you ready either way.

Algoseed Labs in Ontario

We work with Ontario businesses from our Montréal office, on the same Eastern Time hours. For merchants in Simcoe County, we built a hyper-local marketplace with postal-code-based delivery routing (read the case study), and we've written about mobile app development in Toronto. See how we work across Canada or tell us about your project.

Frequently asked questions

Does Ontario have its own privacy law for businesses?

Not a general one. Ontario businesses follow the federal PIPEDA for commercial personal information. Ontario's PHIPA applies to personal health information held by health information custodians and those acting for them.

Do Ontario businesses have to report privacy breaches?

Yes, under PIPEDA. If a breach creates a real risk of significant harm, you must report it to the Privacy Commissioner of Canada and notify affected individuals, and you must keep a record of every breach for 24 months.

Do Ontario employers need an electronic monitoring policy?

Yes, if they had 25 or more employees on January 1. The Employment Standards Act requires a written policy describing whether, how and for what purposes employees are monitored electronically.