The personal information you process to invoice — customer names and addresses, emails, phone numbers, purchase history — is governed by Canadian privacy laws. Federally, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies to private-sector businesses in provinces without substantially similar legislation. In Quebec, the Act respecting the protection of personal information in the private sector, modernised by Law 25 (main obligations in force since September 2023), applies. Law 25 notably requires designating a person in charge of personal information protection and promptly reporting confidentiality incidents that present a risk of serious injury.
Consent and purpose of collection
PIPEDA requires valid consent for the collection, use and disclosure of personal information, tied to specific purposes. To invoice, you only need the information the invoice requires: name, address, billing email. If you want to use that data for other purposes (marketing, for example), obtain separate consent — 4invoices does not manage consents.
Right to access, correction and withdrawal
A customer can request a copy of the personal information you hold about them and require corrections. Law 25 notably adds a right to de-indexation and, since September 22, 2024, a right to data portability. Have a simple procedure to respond to these requests, bearing in mind your obligation to keep invoices for six years.
Confidentiality incidents
Law 25 requires promptly notifying the Commission d'accès à l'information (CAI) and affected individuals when an incident presents a risk of serious injury, and keeping an incident register. Unlike GDPR, it sets no 72-hour deadline, but you must act quickly. PIPEDA has a similar obligation towards the Office of the Privacy Commissioner.
Mapping the two laws — federal and Quebec
Federal PIPEDA applies to commercial activities in provinces without substantially similar legislation, and to inter-provincial and international exchanges. It rests on 10 fair information principles: accountability, identifying purposes, consent, limiting collection, limiting use, accuracy, safeguards, openness, individual access, and challenging compliance. The Office of the Privacy Commissioner of Canada investigates complaints.
Quebec has its own law — the Act respecting the protection of personal information in the private sector (1994), modernised by Law 25 with phased entry into force from 2022 to 2024. It notably adds: designating a person in charge of personal information protection (by default, the person with the highest authority), privacy impact assessments (PIA), data portability, and significant penalties — administrative monetary penalties up to $10M or 2% of worldwide turnover, and penal fines up to $25M or 4%.
For a Canadian SMB, the practical issue is complying with the law or laws that apply where it operates. A good practice is to apply the most demanding standard everywhere — often Quebec's — which simplifies internal procedures.
Frequently asked
My business is in Saskatchewan, I have no Quebec customers. Does Law 25 apply?
Generally, no: the Quebec act targets businesses carrying on an enterprise in Quebec. Without a link to Quebec, you're under PIPEDA. Many businesses still choose to apply the Quebec standard everywhere, for simplicity.
My data is hosted outside Canada. Problem?
PIPEDA and Law 25 don't prohibit hosting outside Canada, but require adequate protection. Law 25 additionally requires a privacy impact assessment before communicating personal information outside Quebec. Ask each provider where your data is hosted and govern the relationship by contract.
How long can I keep data of a customer who is no longer active?
General rule: as long as necessary for the stated purposes, no longer. For invoicing, the obligation to keep records for six years justifies keeping invoice-related data. Beyond that, destroy or anonymise information you no longer need.
Invoice while collecting only what you need
6 months free, no credit card. Invoices with only the necessary information, a tax rate per line, any currency and PDF delivery.