Compliance: your website privacy obligations
The BrokerFold Team — Product + Engineering
Last reviewed
On this page
The moment your website has a contact form, you are collecting personal information in the course of commercial activity, and Canadian privacy law attaches duties to that — with a policy or without one. PIPEDA sets the federal baseline, BC, Alberta, and Quebec run their own private-sector laws, and Quebec’s Law 25 currently sets the strictest bar. The reference treatment is realtor website privacy policy; this lesson is the operator’s pass: know what you collect, say it truthfully, and behave accordingly.
Step 1: inventory before anything else
Walk your own site and list every point where information about a person enters: lead and valuation forms, tour requests, newsletter signups, visitor accounts with saved searches and favourites, VOW registrations, analytics, any pixel an ad campaign added. A realtor site collects more than most agents think, and the inventory is the foundation — a policy written before the inventory is fiction with headings.
Step 2: make the policy match the machine
The legal core of every Canadian regime rhymes: collect with consent, state your purposes, use data only for them, safeguard it, and answer for it when asked. Your policy is where you commit to the specifics. Our platform generates the privacy page for every tenant site, describing the collection the platform actually performs — including the VOW account disclosures a gated site owes its registered visitors. Your job is the delta: confirm the identity details are right, and if you have added third-party tools of your own, reflect them. A policy that describes practices you do not follow is a public promise being broken in writing.
Step 3: honour purpose limits in your marketing
Privacy law and anti-spam law meet at your database: information collected for a showing request is not thereby licensed for a lifetime of newsletters. Consent basis and purpose ride together — which is exactly the bookkeeping the CASL lesson builds. When a new use genuinely serves the person, ask; when it merely serves you, do not repurpose quietly.
Step 4: prepare for the two requests that will come
Sooner or later someone asks what you hold about them, and someone asks you to delete it. Neither should be an emergency. Access: know where contact records, form history, and account data live so you can produce them. Deletion: stop marketing uses immediately, remove what nothing obliges you to keep, and name the obligations behind what stays — board audit records, for instance, are covered in record keeping that saves you. Written scoping beats improvised promises in both directions.
Step 5: contain your own sprawl
The riskiest personal data an agent holds is usually the copy nobody remembers: exported CSVs in a downloads folder, lead lists emailed to a personal address, an old phone with the full client book. Keep client data in the systems built to hold it, delete casual exports after use, and lock the devices. Most small-operator breaches are lost sprawl, not hacked servers.
What done looks like
You can name every collection point on your site from memory. The published policy describes reality, including your additions. An access or deletion request has a calm, scripted path. And no personal data lives anywhere you could not find it on request.
The mistake that costs the most
Treating the privacy policy as a legal page nobody reads. One complaint, one nosy competitor, or one deletion request is all it takes for the gap between your policy and your practice to become the story — and a broken written promise reads far worse than a missing page. Write the truth, then keep it true.
Frequently asked questions
My platform generated a privacy policy for my site — am I done?
You are most of the way. The generated policy describes what the platform actually does, which beats any template — but it speaks for your practice too, so read it once: confirm your brokerage details are current and that anything you bolted on, like an ad pixel or a third-party chat widget, is reflected.
Someone asked me to delete their information — do I have to?
Individuals can withdraw consent and ask for their information; some records you must keep anyway for legal and regulatory reasons, like transaction files and VOW access logs. The right response is honest scoping — stop the marketing uses immediately, delete what nothing requires you to hold, and explain what is retained and under which obligation.
Does Quebec's Law 25 matter if I am in Ontario?
It applies to Quebec residents' information, so an Ontario agent marketing into Quebec can be reached by it. Its bar is the highest of the Canadian regimes, which is why treating it as the default standard is the low-effort safe posture.
Keep reading
- Compliance: CASL for your database Audit an existing real estate database against Canada's anti-spam law: sort by consent basis, fix your message template, and renew before clocks expire.
- Compliance: record keeping that saves you The six files that end compliance disputes before they start: consents, licences, substantiation, acceptance logs — and which ones write themselves.
- Realtor website privacy policy Yes, you need one: PIPEDA covers lead forms and visitor tracking, Quebec adds Law 25, and VOW sites carry extra disclosure duties. What the policy must say.
- PIPEDA for real estate brokerages What privacy law requires of a brokerage: meaningful consent, safeguards, breach response, and how VOW registrant data must be handled.