Know what your site collects and why
List analytics, advertising tags, chat tools, forms, embedded videos and other services that can collect information. For each, write down the purpose, the information involved, who can access it and what business decision it supports. Remove tools that have no clear owner or use.
Avoid collecting extra personal details just because a platform offers a field. Use the least information needed for the stated purpose and define how long records should be kept. Privacy obligations can depend on the organization, province, sector and information involved, so this checklist is not a substitute for legal advice.
Review vendors, access and retention
Read current vendor documentation and terms for data use, retention, deletion, account roles and any processing partners. Confirm where administrators can review settings and who can export records. A free analytics tool is not automatically appropriate for every business or data category.
Keep analytics ownership in a company-controlled account. Give staff and contractors only the access they need, and review it when roles change. Remove stale users and use multifactor authentication where available. Document who can respond to a privacy request or suspected exposure.
Make measurement transparent and useful
Write a privacy notice that accurately describes the tools and purposes currently in use. Do not copy a generic statement that promises practices the site does not follow. Make consent choices clear where required, and ensure that optional tags behave as the business’s policy says they will.
Choose measures that help improve the service: completed bookings, qualified enquiries or content discovery. Do not track sensitive details that are unnecessary to answer those questions. Test that analytics records a conversion once and does not accidentally include form contents, passwords or payment information.
Create a routine for changes and incidents
Review the tag list and vendor settings when the website, agency or analytics platform changes. Test in a staging environment when possible, and keep notes about the date, owner and purpose of each new integration. A script added for one campaign can remain on the site long after the campaign ends.
If information may have been exposed, follow the organization’s response process and consult qualified privacy professionals about next steps. The Office of the Privacy Commissioner of Canada provides business privacy resources; review official guidance that applies to your organization rather than assuming one rule covers every situation.
Practical checklist
- Inventory every tag, form, chat tool and data recipient.
- Document purpose, access, retention and accountable owner.
- Keep public privacy information aligned with actual practice.
- Seek qualified advice when legal duties or sensitive data are involved.
In short
Measure only what supports a real business purpose, protect access and verify that privacy statements match the tools actually running.
This article is general educational information, not legal, privacy, cybersecurity or financial advice. Confirm requirements for your situation with a qualified professional.