What CASL asks you to keep, and for how long

Compliance conversations tend to be about permission. The harder half is proof, and it is the half that tends to be discovered during an enquiry rather than before one. Not legal advice — if a regulator has already contacted you, that is a call to a lawyer, not a call to read an article.

The asymmetry nobody plans for

Consent that happened but was never recorded and consent that never happened look identical from the outside. If somebody asks how a particular address came to be on your list, the useful answer is not "they signed up" — it is where, when, and what they were shown at the time.

The CRTC's FAQ addresses both halves of this directly: how to demonstrate that consent was obtained, and how long a business should retain records to show compliance. Those are two separate questions and both have answers worth reading at the source rather than second-hand.

What a usable record looks like

• Where the address came from — a form on your site, a conversation, an existing customer relationship
• When, precisely enough to place it against anything else that happened
• What the person was shown or agreed to at that moment, not a description written afterwards
• Whether they have since withdrawn, and when — withdrawal is a right that operates at any time

“A spreadsheet somebody maintains by hand is a record right up until the week nobody maintains it. The records that survive are the ones written automatically, as a side effect of the thing actually happening.”

Where small businesses actually lose this

Rarely through bad intent. Usually through moving tools. A list is exported from one system and imported into another, and the provenance — where each address came from and what they agreed to — does not survive the CSV. What arrives on the other side is a column of addresses with no history attached.

The practical defence is unglamorous: capture the record at the moment of capture, keep it attached to the address rather than in a separate document, and check that it survives whenever you change systems. That last one is the step that gets skipped, and it is the step that matters.