Why privacy is trust, not paperwork
Community organizations hold sensitive details: names, contact information, family relationships, and sometimes health, income, or immigration information. People share this because they trust your organization. Privacy law turns that trust into a set of expectations you can plan around.
You do not need to become a legal expert. You need to know which rules apply to you and build a few consistent habits. Deciding what participant information to collect is the first and most useful step.
Which privacy law applies to you
Privacy for private-sector and nonprofit organizations in Canada is not governed by a single rule. Which law applies depends on where you operate and what you do.
PIPEDA, the federal private-sector law, applies to organizations that handle personal information in the course of commercial activity, and to interprovincial or international data flows.
Some provinces have their own private-sector laws. British Columbia and Alberta have Personal Information Protection Acts, and Quebec has its own law, often called Law 25, with distinct requirements.
Many nonprofit activities are not commercial, which can affect whether PIPEDA applies, but provincial law, funder agreements, and good practice may still set expectations.
Because coverage varies, name your own situation plainly rather than assuming one province's rule is universal. The Office of the Privacy Commissioner of Canada and your provincial regulator are the authoritative sources.
The ideas shared across every law
Canadian privacy laws differ in detail but share a common spine. If you build habits around these ideas, you are usually working in the right direction wherever you operate.
Collect only what you need, for a purpose you can name.
Get meaningful consent, and explain why you are asking.
Use and share information only for the purpose you collected it.
Protect it with reasonable safeguards, including limiting who can see it.
Let people see and correct their own information, and keep it only as long as you need it.
Practical steps you can take now
1
Write a short, plain-language note explaining what you collect and why, and show it at sign-up.
2
Limit staff and volunteer access to the records they actually need.
3
Set a retention period so information does not pile up forever. See how long to keep participant records.
4
Review the fields on your forms once a year and remove anything you never use.
Note: This article is general information only and is not legal, financial, or professional advice. For questions about your organization's obligations, consult a qualified professional or the relevant government resource (for example, the CRA for registered charity matters, or your provincial or territorial registry for nonprofit governance).
Frequently asked questions
Trying to make your centre run more smoothly?
OpenCommunity helps neighbourhood houses and family centres manage sign-in, programs, and attendance in one place.
Note: This article is general information only, not legal or professional advice.