BC Privacy Laws and Your Website: What You're Already Required to Do

"Privacy law" sounds like something that happens to banks and hospitals, not a plumber's website with a "Request a Quote" button. It isn't. If your site collects a name, an email, or a phone number from a visitor — and almost every small business site does — British Columbia's privacy law already applies to you. Here's what it actually says, in plain language, and what it means for the site you're running right now.

01 / The Law You Didn't Know Applied to You

The law in question is the Personal Information Protection Act, or PIPA — British Columbia's private-sector privacy law, in place since 2004 and enforced by the Office of the Information and Privacy Commissioner for BC (OIPC).¹ It covers corporations, sole proprietors, non-profits, trade unions — essentially any private organization operating in the province that collects, uses, or discloses personal information about people.²

There's no small-business carve-out. A one-person landscaping company with a contact form is an "organization" under this law in exactly the same way a mid-size accounting firm is. The obligations scale with what you're doing, not with your headcount.

02 / What Actually Counts as "Personal Information"

This is broader than most business owners assume. It's not just credit card numbers or medical records. Under PIPA, personal information is any data that can identify a specific individual³ — which, on a typical small business website, includes:

1. A name, email address, or phone number submitted through a contact or quote form
2. An email address collected for a newsletter sign-up
3. A name and message left through a review or testimonial form
4. In many interpretations, the IP addresses collected automatically by tools like Google Analytics or the Meta Pixel

If any of that sounds like a normal Tuesday for your website, that's the point — this law was never really about the exotic cases. It's about the contact form that's been sitting on your site since day one.

03 / What PIPA Actually Requires You to Do

Strip away the legal language and PIPA comes down to four practical obligations⁴:

1. Get consent. You need permission to collect someone's information — usually satisfied by them voluntarily filling out your form, provided it's reasonably clear what it's for.
2. Have a real reason. You can only use the information for the purpose you collected it for. A quote request form isn't a licence to add someone to a marketing list without telling them.
3. Keep it reasonably secure. You're expected to take reasonable steps to protect whatever you collect from unauthorized access — this is where things like using a reputable form handler and keeping software updated actually matter legally, not just technically.
4. Let people ask what you have. Individuals have the right to request access to, and correction of, the personal information you hold on them, and organizations generally have 30 days to respond.⁵

04 / Where This Shows Up on a Real Website

Translated into the actual pieces of a small business site, here's what PIPA touches:

1. Contact and quote forms — the most common point of collection, and the reason every Sharpline Digital build routes form submissions through a secure handler rather than an exposed mailto link.
2. Email newsletter sign-ups — these need to be clear about what someone's signing up for, not bundled silently into another action.
3. Analytics and advertising tools — Google Analytics, Meta Pixel, and AdSense all collect data about visitors in the background. This doesn't mean you can't use them, but it does mean your privacy policy needs to say you do.
4. Google Business Profile and review requests — if you're collecting names or emails to request reviews, the same consent principle applies.

05 / BC PIPA vs. the Federal Law (PIPEDA)

This is where it gets genuinely confusing, so here's the short version. British Columbia has its own privacy law because Ottawa allows provinces to opt out of the federal law — PIPEDA — if their own law is "substantially similar."⁶ BC PIPA qualifies, which means for business conducted entirely within BC, PIPA is the law that applies, not PIPEDA. The moment your business collects information from customers outside the province — a common reality for anyone selling online — the federal law comes back into play alongside it.

	BC PIPA	Federal PIPEDA
Applies to	Business conducted within BC	Interprovincial & cross-border activity
Enforced by	OIPC BC	Office of the Privacy Commissioner of Canada
Breach notification	Voluntary (for now)	Mandatory
Max organizational penalty	$100,0007	$100,000 per violation8

Worth noting on that breach notification row: the BC OIPC has publicly recommended that PIPA be amended to require mandatory breach notification, matching the federal rule and Alberta's provincial law.⁹ It hasn't happened yet as of this writing — but treating notification as voluntary indefinitely would be a bet against where this is clearly headed.

06 / What a Privacy Policy Actually Needs to Say

A privacy policy page isn't a box-ticking formality, and it isn't supposed to be a wall of boilerplate copied from a template site. To do its job under PIPA, it needs to plainly tell a visitor:

1. What personal information you collect (be specific — name, email, phone, whatever's actually true)
2. Why you're collecting it
3. Whether it's shared with anyone else (a form handler like Formspree counts, so does Google Analytics)
4. How someone can contact you to ask what you have on file or request a correction

That's genuinely it. It doesn't need to be ten pages of legal text — in fact, a privacy policy so dense that no one actually reads it arguably works against the spirit of the law, which is about giving people real, usable information.

07 / The Honest Bottom Line

Realistically, the OIPC isn't going to show up at a Fraser Valley small business unannounced. Enforcement almost always starts with a complaint — a customer who felt their information was mishandled, or noticed a business had no privacy policy at all despite collecting their email. But "unlikely to get caught" isn't the same as "not required," and a visible, honest privacy page does something a lot of small business owners undervalue: it signals to a customer that you actually thought about how you're handling their information, at a moment when a lot of businesses clearly haven't.

It's also one of the easiest boxes to actually check. Unlike site speed or SEO, this isn't an ongoing project — it's a page you write honestly once and revisit if what you collect changes. Every site Sharpline Digital builds ships with a real, specific privacy page as a default, not an afterthought bolted on when someone asks for one.

---