PIPEDA for Restaurants: Privacy Compliance for Canadian Food Service

Restaurants and food service businesses collect more personal information than most owners realise. Online orders, reservation systems, loyalty programmes, and delivery apps all generate personal data — and PIPEDA applies to all of it. Here's what Canadian food service operators need to know.

Last updated: April 2026

Does PIPEDA Apply to Restaurants?

Yes — any Canadian restaurant engaged in commercial activities that collects, uses, or discloses personal information is subject to PIPEDA. This applies to:

• Independent restaurants and cafes
• Franchise locations (both franchisor and franchisee obligations exist)
• Food trucks
• Catering companies
• Meal kit services
• Ghost kitchens and delivery-only operations

Exception: If your province has substantially similar private-sector privacy legislation (Alberta's PIPA, BC's PIPA), those laws govern for provincial activities. Quebec restaurants face Law 25 in addition to PIPEDA for cross-provincial activities.

What Personal Information Do Restaurants Collect?

You may be collecting more than you think:

Data Source	Personal Information Collected
Online ordering platform	Name, email, phone, delivery address, payment details, order history
Reservation system	Name, phone, email, dietary restrictions, special occasions, notes
Loyalty programme	Name, email, purchase history, preferences, birthday
Delivery apps (Uber Eats, DoorDash, Skip)	Varies by platform — customer data is held by the platform
Email marketing list	Name, email, preferences
Gift cards (registered)	Name, email, balance
Wi-Fi sign-in	Email, device identifier
Security cameras (CCTV)	Video images of identifiable individuals

Key PIPEDA Obligations for Restaurants

1. Privacy Policy

Your restaurant needs a privacy policy. If you take online orders or have a loyalty programme, publish it on your website. It should explain:

• What information you collect and why
• How reservations and loyalty data are used
• Who you share data with (delivery platforms, payment processors, email marketing tools)
• How customers can access or correct their information

A simple, plain-language one-page policy is sufficient for most restaurants.

2. Consent for Marketing

If you want to send customers marketing emails (promotions, seasonal menus, event invitations), you need consent under CASL (Canada's anti-spam legislation) in addition to PIPEDA's consent requirements.

The right way to collect marketing consent:

• At point of online order: "Would you like to receive promotional emails from [Restaurant Name]?" with an unchecked checkbox
• At loyalty programme signup: Explicit consent checkbox for marketing communications
• Paper sign-up sheet: Written consent for marketing emails

Not acceptable:

• Pre-ticked boxes for marketing consent
• Including marketing consent as a condition of using the loyalty programme
• Sending promotional emails to everyone who ever made a reservation

3. Loyalty Programme Privacy

Loyalty programmes are data-intensive. Your programme collects purchase history over time — building detailed profiles of customer behaviour. For PIPEDA compliance:

• Explain clearly in your programme terms what data is collected and how it's used
• Get explicit consent if you use purchase data for targeted advertising or share it with third parties
• Allow members to view and delete their loyalty profile data on request
• Set a retention limit — don't keep inactive loyalty accounts indefinitely

4. Delivery Platform Relationships

If you use third-party delivery platforms (Uber Eats, DoorDash, SkipTheDishes, Ritual), understand the data sharing relationship:

• The platform collects customer data and shares order information with you to fulfil the order
• You receive customer names, delivery addresses, and order details through the platform
• The platform's privacy policy governs data on their side; you're responsible for any data you store on yours
• Don't add customers from delivery orders to your own marketing list without their separate consent

5. Security Cameras (CCTV)

CCTV in your restaurant captures personal information. PIPEDA requirements:

• Notify — post visible signs indicating that CCTV is in operation
• Purpose — use footage only for the stated purpose (security, loss prevention)
• Retention — overwrite footage after a reasonable period (30-90 days is typical) unless retained for a specific incident
• Access — footage is personal information that individuals can request access to (within reason)

Note: In Alberta and BC, PIPA imposes explicit requirements for workplace video surveillance. Inform employees if your kitchen is being monitored.

6. Reservation System Data

Reservation data (especially dietary restrictions, allergies, and occasion notes) can include sensitive personal information:

• Dietary restrictions may reveal religious beliefs or medical conditions
• Use this information only for the reservation and service purposes
• Don't retain detailed guest notes longer than necessary
• If using a third-party reservation system (OpenTable, Resy, Yelp Reservations), review their privacy practices and ensure they protect your customers' data

7. Free Wi-Fi

If you offer customer Wi-Fi requiring email sign-up:

• Collect only what's necessary (an email is likely sufficient)
• Explain what the email will be used for at the time of collection
• If you plan to send marketing emails, obtain CASL-compliant consent at sign-up

Practical Compliance Checklist for Restaurants

• Publish a simple privacy policy on your website
• Update your online ordering flow to collect marketing consent properly
• Review your loyalty programme terms and consent language
• Post CCTV notification signs
• Review your delivery platform data relationships
• Train front-of-house and management staff on basic privacy practices
• Set a retention policy for reservation and loyalty data
• Designate someone (owner or manager) as responsible for privacy

Staff Training Basics

Privacy training for restaurant staff doesn't need to be complicated:

• Don't share customer reservation notes or contact information with other customers
• Customer payment information (card numbers) must never be written down or retained
• Don't take photos of customers without consent
• If a customer asks about their personal information, direct them to the manager or owner
• Report any suspected data breach (stolen device with customer data, system hack) to the manager immediately

Breach Response for Restaurants

If your POS system is hacked, a device containing customer data is stolen, or your loyalty app is breached:

1. Contain the breach immediately (isolate affected systems)
2. Assess what data was affected and how many customers
3. Report to the OPC if there is real risk of significant harm
4. Notify affected customers promptly
5. Notify your payment processor and cyber insurer if applicable
6. Document everything

Frequently Asked Questions

Q: Do we need a privacy policy if we only take cash and have no online presence? A: If you collect no identifiable personal information, PIPEDA essentially doesn't apply. But most modern restaurants collect at least email addresses or take card payments — those activities trigger PIPEDA obligations.

Q: A customer wants to see their loyalty programme data. What do we do? A: Verify their identity and provide a summary of the information you hold — points balance, purchase history, contact information. You have 30 days to respond.

Q: Can we sell our customer email list if we sell the restaurant? A: Customer email lists collected under consent for your restaurant's marketing are personal information. Selling them to a third party (including a new owner) requires either new consent from customers or a disclosure to the OPC. Many restaurant asset sales include customer data — ensure the purchase agreement addresses this properly.

Q: We use a cloud-based POS system. Are we responsible for the data it holds? A: You are accountable for the personal information held by your vendors. Review your POS provider's privacy practices and data security certifications.

---

Simple Compliance for Busy Operators

Canada Compliance AI helps Canadian SMEs work through CASL, PIPEDA and Quebec Law 25: a free two-minute compliance check, readiness scores, a prioritized task plan, a 24-month breach register and an exportable audit log. See what's live and what's planned.

Start your free trial today — compliance that doesn't slow down your kitchen.

Related reading: PIPEDA Compliance Guide | CASL Email Compliance | What is Personal Information Under PIPEDA