Privacy law for restaurant guest data in Canada: PIPEDA, provincial acts and breach rules

A guest list is an asset, and it is also a responsibility. The moment you keep an email address, a phone number, a birthday or a dietary note, privacy law applies to how you collect it, use it and protect it. Know the federal law and where the provincial ones apply.

Which privacy law applies to a restaurant?

The federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies to private-sector organizations that collect, use or disclose personal information in the course of commercial activity, including small businesses. Some provinces have their own private-sector acts that apply instead of PIPEDA for activity inside the province. British Columbia and Alberta each have one, and Quebec has its own law. Check with the provincial privacy commissioner for yours. In Ontario, PIPEDA is the main law for most businesses.

What counts as personal information?

Anything that identifies a person or can be linked to one: a name, a phone number, an email, a booking record with a name, a loyalty card number, a photograph, a payment record, an allergy or a dietary requirement shared at booking. A guest's allergy is sensitive information, and you should treat it with care.

What does PIPEDA expect from you?

The Act is built on ten fair information principles. In plain terms:

1. Know who is responsible. Name a person in your business who looks after privacy.
2. Say why you collect it. Tell guests the reason when you ask.
3. Get consent. Ask clearly, and let guests say no to anything that is not needed for the booking.
4. Collect only what you need. A table booking needs a name and a way to reach the guest. It does not need a date of birth.
5. Use it only for the reason you gave. A booking number is not a marketing list.
6. Keep it only as long as you need it. Delete old records.
7. Protect it. Lock the booking book, use strong passwords and limit who can see records.
8. Be open. Let guests ask what you hold.
9. Give access. Respond to requests to see or correct their data.
10. Have a way to complain. Give a contact for questions.

What is a breach and what must you do?

A breach of security safeguards is a loss of, or unauthorized access to, personal information. The Office of the Privacy Commissioner of Canada says that organizations must report to the Commissioner, and notify affected individuals, when a breach creates a real risk of significant harm. You must also keep a record of every breach, whether or not you report it. The Commissioner has noted that small and medium-sized businesses appear to under-report.

A lost phone with the booking app, a spreadsheet emailed to the wrong person, a stolen laptop or a hacked email account can all be breaches. If a supplier holds your guest data and it is breached, you remain responsible for reporting.

How do email and text marketing fit in?

Privacy law and anti-spam law are different. Canada's anti-spam law, CASL, requires consent before you send commercial messages. Privacy law governs what you do with the list. Keep proof of consent, make unsubscribing easy and honour requests promptly.

What are the simplest habits to adopt this month?

• Keep guest data in one system with access limited to people who need it.
• Remove ex-employees from every account on the day they leave.
• Turn on two-step sign-in for email and booking tools.
• Write a one-page breach plan: who to call, what to record, who to tell.
• Delete bookings and notes you no longer need.

What should a guest data policy say?

Write a short policy that fits on one page. List what you collect, why you collect it, who can see it, how long you keep it and how a guest can ask to see or delete it. Share it with staff, and put a short version on your booking page and your website. Keep it honest: if you do not use guest emails for marketing, say so. If you do, say how a guest can stop. A clear policy is a sign of a well-run business, and it helps staff answer questions with confidence when a guest asks.

Would a simpler way to keep regulars close help you?

Collecting a guest's details only makes sense if you use them well and protect them. Mosey is a food discovery app where diners rate the dishes they ate and choose which businesses they follow, which means the guests who hear from you are the ones who asked to. Nobody can pay to outrank you there, because Mosey Gold is earned from ratings alone.

More guides for your business:

• Why are restaurant costs still rising in Canada, and what is already set for 2027?
• How to get more customers for a Halifax restaurant, in and out of cruise season
• How to get more customers for a restaurant in Hamilton, Ontario

More in the Canadian guides for food businesses.