Ontario: federal law, and a single provincial law that reaches clinics
There is no Ontario privacy statute for businesses. Federal law applies — except to health information custodians, and even there, only for what happens inside Ontario.
Which Ontario privacy law applies to my business?
None, unless you are a health information custodian. Ontario has no general private-sector privacy statute. Federal law — the Personal Information Protection and Electronic Documents Act — governs commercial activity by an Ontario business, in full, with no exemption order.
Ontario’s access to information statutes reach public bodies: ministries, municipalities, police services, school boards. They do not bind a plumber, a salon or a garage. Searching for “the Ontario privacy law for business” turns up nothing, because it does not exist.
One Ontario statute does reach a private business: the Personal Health Information Protection Act, which covers health information custodians. It follows the same border rule as everywhere in the country: provincial law governs what happens inside the province, federal law governs information transferred outside the province or outside the country.
This is not legal advice. It is a summary of what we read, written for a business owner, carrying its reading date below.
You are looking for the Ontario law, and cannot find it
That is where most readers of this page start. Ontario is the largest economy in the country, and many owners assume a provincial privacy statute for business exists, as one does in Quebec. They land on the access to information statutes, notice those speak of ministries and municipalities, and conclude they searched badly.
They searched fine. The statute does not exist. What this page does is tell you which law takes its place, what it asks of a business whose calls are answered and recorded by software, and the one case where an Ontario statute reaches you anyway.
Why there is no Ontario statute to find
Three provinces enacted a general private-sector statute judged substantially similar to the federal one: Quebec, Alberta and British Columbia. For organisations in those three, a federal order sets aside Part 1 of the federal statute — but only for what happens inside the province.
Ontario is not among them. Its access to information statutes frame public bodies, and do so well, yet they say nothing about what a shop does with customer information. That gap is not really a gap: federal law applies to every organisation collecting, using or disclosing personal information in the course of commercial activities, and an Ontario small business is exactly that.
The practical effect is one authority to know for ordinary commercial activity, and one statute to read. Simpler than Quebec, and worth saying plainly rather than padding a page around it.
What federal law asks of your business
Information is collected for a stated purpose, announced to a person, with consent, and used for that purpose. A call recording and its transcript are a collection: they fall under this rule like everything else. Retention is limited to what a purpose requires, and a person holds a right of access to what you keep about them.
Since 1 November 2018, an organisation subject to federal law must report to the federal commissioner and notify affected individuals of any breach of security safeguards presenting a real risk of significant harm. It must also keep a record of every breach for 24 months following the day it concludes one occurred — including breaches it judged to carry no real risk.
That record-keeping duty often surprises people. It calls for no complicated tool: it calls for a dated trace of what happened, what you concluded, and what you did afterwards.
The one Ontario statute that reaches you, and on what condition
The Personal Health Information Protection Act governs health information custodians — medical and dental offices, pharmacies, laboratories. Federal order SOR/2005-399 excludes those custodians from Part 1 of the federal statute for personal health information collected, used and disclosed in Ontario.
The border rule holds here as elsewhere: federal law keeps applying to interprovincial and international exchanges, and to anything that is not a custodian. An Ontario clinic whose processing partly leaves the province therefore has two laws above it, rather than one.
We do not say here which activities count as custodians beyond those the statute names: that is a question for an adviser reading your situation.
Recording a call: two regimes, not one
The Criminal Code does not forbid a business party to a call from recording it: consent from one of the people in the conversation is enough to take it out of the offence.
Privacy law, for its part, requires a caller to be told at the start of a call about the recording and its purpose, requires that purpose to be the only one used, requires an alternative route for a person who declines, lets that person request access to their recording, and limits retention. A recording being no offence says nothing about whether keeping it is lawful under privacy law.
Here, the disclosure is spoken before the microphone opens. You can hear it by calling your own receptionist.
Where a complaint goes, and what the product lets you show
For ordinary commercial activity, a customer complaint about use of their information goes to the Office of the Privacy Commissioner of Canada. For a health information custodian, it goes to the Information and Privacy Commissioner of Ontario.
What the product hands you for answering a request: an access log, exporting a record, deleting a record, and a role per teammate that limits what each one sees. Verifiable mechanisms rather than a label.
What it will not do for you: write your policy, set your retention period, keep your breach record, or decide whether your activity is that of a custodian. Federal law in force stays the same as elsewhere in the country; Bill C-36, tabled on 15 June 2026, sat at second reading on 23 October 2026 without royal assent, so none of its content is in force.
Related product pages
Pages describing measures taken, processing locations and known limits.