Provincial Privacy Legislation requires all businesses to have a written privacy policy. What should a business person put into their policy?

The policy must account for all the activities of the business that relate to personal information. It must state what is being collect; how it is being collected; why it is being collected; how it will be used and by whom; how it will be secured; and how long it will be kept. Additionally, it must have business contact information to allow a person to obtain copies of the personal information.