Plain English. No legalese. For solo service business operators.
Not legal advice. Last updated: June 3, 2026
If you are a solo or small service business operator using Draftrow, you need to:
That is it. Privacy compliance for a small service business is not as complex as compliance for a hospital or a bank.
If you are in Canada:
PIPEDA (Personal Information Protection and Electronic Documents Act) is the federal law. Plus any provincial law if your province has one (Quebec, BC, Alberta have provincial privacy laws).
If you serve customers in the United States:
State-specific laws may apply (CCPA in California, others in various states). HIPAA only applies if you are processing health information for healthcare providers.
If you serve customers in the EU or UK:
GDPR applies (more complex, may require additional steps). Consider consulting a privacy lawyer if EU customers are a meaningful part of your business.
For most Draftrow operators (Canadian solo service businesses serving Canadian customers), PIPEDA is the main framework.
PIPEDA has ten fair information principles. The ones that matter most for a solo operator:
Identifying purposes: Tell customers why you collect their information (use our privacy notice template)
Consent: Customers must consent to your collection (their voluntary inquiry is implied consent for reasonable business use)
Limiting collection: Only collect what you need for the service
Limiting use: Use information only for the original purpose
Accuracy: Keep information accurate (let customers correct it)
Safeguards: Protect information appropriately (Draftrow encrypts at rest)
Openness: Be transparent about practices (have a privacy notice)
Individual access: Let customers see their information on request
Challenging compliance: Let customers complain if needed
Of these, the practical actions for you are: have a privacy notice, use information only for the original purpose, respond to access/deletion requests within 30 days.
You do not need a per-customer consent form.
Implied consent from their voluntary business inquiry is sufficient for standard business processing.
You do not need to register with a privacy regulator.
PIPEDA does not require registration.
You do not need a Data Protection Officer.
This is a GDPR requirement that only applies to large organizations or specific types of data.
You do not need expensive privacy certifications.
SOC 2, ISO 27001, etc., are for enterprise vendors, not solo operators.
You do not need lawyers reviewing every customer interaction.
Standard practices and templates cover the common cases.
Consult a privacy lawyer ($300-500 for a one-hour consultation) if:
For routine operations, our templates and Draftrow's built-in features should cover the standard cases.
Draftrow handles (technical side):
You handle (customer-facing side):
Together, this is solid PIPEDA compliance for a solo operator.
Email security@draftrow.com if:
We respond within 24 hours during business days.
Related resources