# Privacy Basics for Community Organizations in Canada

> Which privacy law applies to your community organization, the core ideas shared across all of them, and a few practical habits to protect participant trust.

Published: 2026-03-18  
Author: Andrey (OpenCommunity Team)

## Key takeaways

- Which privacy law applies depends on your province and whether your activity is commercial, so name your own situation rather than copying another region.
- Every Canadian privacy law shares the same core: collect only what you need, explain why, protect it, and keep it only as long as necessary.
- Limiting who can see each record is one of the simplest ways to protect participants.

## Why privacy is trust, not paperwork

Community organizations hold sensitive details: names, contact information, family relationships, and sometimes health, income, or immigration information. People share this because they trust your organization. Privacy law turns that trust into a set of expectations you can plan around.

You do not need to become a legal expert. You need to know which rules apply to you and build a few consistent habits. Deciding [what participant information to collect](https://opencommunity.ca/blog/what-participant-information-to-collect/index.md) is the first and most useful step.

## Which privacy law applies to you

Privacy for private-sector and nonprofit organizations in Canada is not governed by a single rule. Which law applies depends on where you operate and what you do.

- **PIPEDA**, the federal private-sector law, applies to organizations that handle personal information in the course of commercial activity, and to interprovincial or international data flows.
- Some provinces have their own private-sector laws. British Columbia and Alberta have Personal Information Protection Acts, and Quebec has its own law, often called Law 25, with distinct requirements.
- Many nonprofit activities are not commercial, which can affect whether PIPEDA applies, but provincial law, funder agreements, and good practice may still set expectations.

Because coverage varies, name your own situation plainly rather than assuming one province's rule is universal. The [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca) and your provincial regulator are the authoritative sources.

## The ideas shared across every law

Canadian privacy laws differ in detail but share a common spine. If you build habits around these ideas, you are usually working in the right direction wherever you operate.

- Collect only what you need, for a purpose you can name.
- Get meaningful consent, and explain why you are asking.
- Use and share information only for the purpose you collected it.
- Protect it with reasonable safeguards, including limiting who can see it.
- Let people see and correct their own information, and keep it only as long as you need it.

## Practical steps you can take now

1. Write a short, plain-language note explaining what you collect and why, and show it at sign-up.
2. Limit staff and volunteer access to the records they actually need.
3. Set a retention period so information does not pile up forever. See [how long to keep participant records](https://opencommunity.ca/blog/how-long-keep-participant-records/index.md).
4. Review the fields on your forms once a year and remove anything you never use.

> Note: This article is general information only and is not legal, financial, or professional advice. For questions about your organization's obligations, consult a qualified professional or the relevant government resource (for example, the CRA for registered charity matters, or your provincial or territorial registry for nonprofit governance).

## Questions and answers

### Does PIPEDA apply to nonprofits?

PIPEDA applies to organizations that handle personal information in the course of commercial activity. Many nonprofit activities are not commercial, which can place them outside PIPEDA, but provincial laws, funder rules, and good practice may still apply. Check your own circumstances.

### What is Quebec's Law 25?

Law 25 is Quebec's modernized private-sector privacy law. It introduces stronger requirements around consent, transparency, and accountability than some other regimes. Organizations operating in Quebec should review its specific obligations.

### Do we need a privacy policy?

A clear, plain-language explanation of what you collect and why is good practice everywhere and is expected under several laws. It does not need to be long. It needs to be honest and easy to find.

### Who should be able to see participant records?

That is your decision, and limiting access is a core privacy principle. Give staff and volunteers access to the records their role requires, rather than opening everything to everyone.

## More from OpenCommunity

- [All resources](https://opencommunity.ca/blog/index.md): Browse every published guide.
- [OpenCommunity features](https://opencommunity.ca/features/index.md): Explore the platform.