One Contact Form Means Privacy Law Applies

Here's something most new Canadian businesses don't realize: the moment your website collects a name and email, privacy law applies to you.

One contact form is enough. In Canada, that's PIPEDA. The launch-day minimums are genuinely minimal:

• A privacy policy that truthfully says what you collect, why, and who you share it with. A template that doesn't match reality is worse than none at all.
• Cookie consent, if you're running analytics or ad pixels.
• Knowing where form submissions actually go — into a system you control, or a random inbox forever?
• A way to delete someone's data if they ask, because they're allowed to.

None of this requires a lawyer on retainer at launch. It requires doing the basics deliberately, instead of copy-pasting a policy from a U.S. template that cites laws that don't apply here.