A PIPEDA privacy policy is the document that tells people what you do with their personal information, in language they can follow. The Act does not hand you a template, so the content comes from Schedule 1 and from the guidance of the Office of the Privacy Commissioner of Canada (OPC).

This guide turns the ten principles into a list of what the policy has to say, and flags what to add if you also serve Quebec. For the legal frame behind it, see our guide to PIPEDA and cookies.

Principle 4.8 (openness) says an organization must make specific information about its policies and practices readily available, in a form that is generally understandable. Principle 4.1.4 requires policies and practices that give effect to the principles, including procedures to receive complaints and train staff.

Nothing in the Act fixes the format. The policy can be one page or many, as long as the required information is easy to find and written for the reader, not for a lawyer. If you are unsure what such a document is for, our explainer on what a privacy policy is covers the basics.

Section 5(3) says an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances. Write each purpose in the policy as if you had to defend it to that reasonable person.

The ten principles give you the outline. Not every principle produces a paragraph, but most do.

Name the person accountable for compliance, or the title, and give a way to reach them. Our guide to the responsibilities of a data protection officer helps define the role. Principle 4.1.2 says the identity of that person must be made known on request. Putting it in the policy answers the request in advance.

State that you remain responsible for information transferred to a third party for processing, and that you use contracts to secure a comparable level of protection (4.1.3). This applies to your analytics, hosting and advertising vendors.

For each category of information, say what you collect, why, and on what consent basis. Separate what is needed to deliver the service from what is optional, such as marketing. Say how people can withdraw consent (4.3.8) and what happens if they do.

Explain how long you keep information and what you do when it is no longer needed. Principle 4.5.3 says it should be destroyed, erased or made anonymous.

Describe, in general terms, the safeguards that protect the data, such as access controls and encryption. You do not need to publish a security manual, but a vague "we take security seriously" is not enough.

Tell people how to ask for their information, who handles it, and how to complain. Our guide to the PIPEDA DSAR privacy portal explains the request workflow behind that section.

A privacy policy that skips tracking is incomplete. Summarize which technologies you use and why, and link to a dedicated PIPEDA cookies policy for the detail.

The OPC expects the four key elements to be easy to find: what is collected, which parties it is shared with, for what purposes, and the risk of harm. The privacy policy should point to where each of those lives. The OPC's guidelines for obtaining meaningful consent describe all four.

Not sure your policy matches what your site really collects? Talk to our team.

PIPEDA does not use the words controller and processor, but the logic is similar. The organization that collects the data stays accountable even when a vendor handles it. Map who does what before you write the section, using our guide to the difference between data controller and data processor.

Say that information may be processed outside Canada when that is the case, and that it may then be subject to the laws of that country. The OPC has long said that people should be told about this when it applies.

Sections 10.1 to 10.3 require reporting a breach of security safeguards to the OPC, and notifying affected people, when there is a real risk of significant harm, "as soon as feasible". You must also keep a record of every breach for 24 months under SOR/2018-64.

The policy does not need the procedure, but it should say that you have one and who people can contact if they think their data was exposed.

Quebec's private-sector Act, as amended by Law 25, goes further. Section 8.2 requires a privacy policy that is written in clear and simple language and published on your website. Section 8.1 requires informing people when a technology can identify, locate or profile them.

Alberta's PIPA (S.A. 2003, c. P-6.5) has mandatory breach notification in section 34.1. British Columbia's PIPA (S.B.C. 2003, c. 63) had no mandatory private-sector breach notification at our last check. If you operate in these provinces, check the local text before you rely on this guide.

1. Start from a data inventory. You cannot describe what you do with data you have not mapped. See our guide to data mapping and data inventory.
2. Write each section from the principle, not from a template.
3. Link it from the footer, the banner and every form that collects data.
4. Review it when you add a tag, change a vendor or launch a new feature.
5. Keep dated versions, and record which version each person saw when they consented.

AdOpt records the policy and terms version shown with each consent in its Consent Log, which helps you show what a person agreed to and when.

1. Accountable person named, with contact details.
2. Each category of information, with purpose and consent basis.
3. Third parties and vendors, and how you protect transferred data.
4. Retention period, and what happens at the end.
5. How to withdraw consent, access data, correct it and complain.
6. Summary of tracking technologies, linked to the cookie policy.
7. Breach contact, and cross-border processing if it applies.
8. Quebec section, in French, if you serve Quebec.
9. Last-updated date.

The Act does not use the term, but principle 4.8 requires you to make specific information about your policies and practices readily available, and principle 4.2 requires purposes to be identified. A published privacy policy is the standard way to do both, and the OPC expects it when you collect personal information online.

Principle 4.1 requires designating an individual accountable for compliance, though other people can take on day-to-day work. Publish the title or name and a contact address. Principle 4.1.2 says the identity must be made known on request, so listing it in the policy saves a step.

It should say who receives personal information, at least by category, such as analytics, advertising and hosting providers. Principle 4.1.3 makes you responsible for data you hand to a third party for processing, and the OPC lists the parties involved among the four key elements of meaningful consent.

PIPEDA sets no schedule. In practice, update it whenever a purpose, vendor or retention period changes, and also review it on a fixed cycle, for example every quarter. An outdated policy undermines consent, because people agreed to what the policy said at the time, so keep dated versions.

Not necessarily separate, but it must meet Quebec's rules. Section 8.2 of the private-sector Act requires a privacy policy in clear and simple language published on your website, and section 8.1 requires notice about identification, location and profiling technologies. Many organizations add a Quebec section and a French version.

• Canada PIPEDA and cookies: all you need to know, the full guide to the law
• PIPEDA cookies policy, for the tracking section of your documents