PIPEDA and the enquiries your business stores

CASL governs what you may send. PIPEDA governs what you may hold, and the two get discussed together because a single enquiry form triggers both at once. Not legal advice; the Office of the Privacy Commissioner publishes the authoritative version and it is short enough to read.

An enquiry is personal information

A name, an email address, a phone number, a description of a job at a home address — that is personal information about an identifiable individual, held by a business in the course of commercial activity. Nothing about the modest scale of a trades business takes it outside the frame.

What follows from that is proportionate rather than dramatic. Collect what you need for the purpose, be able to say what the purpose is, protect it, and do not keep it forever because deleting things is effort.

The questions worth being able to answer

• What do you collect, and is each field actually used for something? A form asking for a date of birth to quote a bathroom is collecting beyond its purpose
• Where does it live, and who can reach it? An inbox on a shared laptop is an answer, and often not a good one
• How long do you keep it? Indefinitely is a decision, even when it is made by not deciding
• What happens if somebody asks what you hold about them, or asks you to delete it?

The part software makes worse, and the part it makes better

Worse: every tool you connect is another copy of the same enquiries, in another company's systems, under another retention policy. Routing leads to a spreadsheet, a CRM and a chat app means four copies of the same personal information and four answers to "how long do you keep it".

Better: software can hold a boundary consistently in a way a busy person cannot. A system that never asks for a field it does not need, and that deletes on a schedule rather than when somebody remembers, is doing something a human with a full diary will not reliably do.

“The safest data is the data you never collected. Every field on a form is a small permanent obligation, and a field is far easier to add than to remove.”

A reasonable starting point

Look at your enquiry form and remove any field you cannot name a use for. Write down, for yourself, where enquiries end up and how long each copy lives. Then read the Privacy Commissioner's own summary — it is written for businesses rather than lawyers, and it will take less time than the average argument about whether any of this applies to you.