A published privacy policy can look reassuring. It can also leave an owner with a false sense that the work is finished. I would ask a more practical question: can the people running the business explain how its promises are carried out?
A statement about protecting customer information needs an operating process behind it. Someone has to decide what is collected, who can access it, which suppliers receive it and when it should be deleted. Those decisions continue after the policy goes online.
Start with how information actually moves
I would begin with a simple information map. Follow one enquiry, purchase or customer account from collection through the systems and people that handle it. Include shared inboxes, spreadsheets, service providers and copies downloaded by staff.
Then compare that map with the public policy. Does the business collect more information than the policy suggests? Has a new tool introduced another recipient? Can an employee explain what happens when someone asks to access or correct their information?
Where the federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies, its accountability principle calls for responsibility, policies and practices that give effect to the privacy principles. The Office of the Privacy Commissioner of Canada (OPC) also describes safeguards appropriate to the sensitivity of the information. The applicable law needs to be identified; a healthcare business, for example, may face a different statutory framework.
Give decisions an owner
A policy that belongs to everyone can become a policy that nobody maintains. I would want a named person to coordinate privacy questions, with enough support to get answers from the people responsible for operations, contracts and technology.
Consider a hypothetical online retailer adding a customer-support platform. The useful review goes beyond adding the platform’s name to a policy. What information will staff send to it? What does the contract permit? Who controls access? What happens when the subscription ends?
Those questions can lead to different workstreams. A legal review can examine the agreement and information-handling obligations. A qualified technical professional can assess relevant systems and controls. A reviewed contract does not establish that the technical configuration is secure.
Make change and escalation routine
New software, departing staff and new marketing activities can change the information map. I would build a short review into those ordinary decisions, rather than rely on an annual policy update to discover what has already changed.
Staff also need a clear route for raising a concern. Who should they contact about a misdirected email, an unexpected vendor request or a missing device? Who decides whether legal and technical assistance is needed? A written escalation route helps people act consistently; it does not replace situation-specific advice.
A practical review for the owner
For an initial review, I would put five questions on the agenda:
- What personal information do we hold, and why?
- Who is responsible for each important handling decision?
- Do our contracts and public statements reflect our actual practices?
- Can staff follow the access, retention and escalation procedures?
- What needs legal review, and what needs a technical assessment?
The aim is a manageable process that the business can explain and maintain. A privacy policy is an important part of that process. Its value depends on the decisions, responsibilities and safeguards supporting it.
Read more about my approach to privacy, AI and digital-risk legal questions.
Further reading: OPC guidance on accountability and safeguards.