2025-2026 Survey of Canadian businesses on privacy-related issues

1. Customers’ personal information

This section presents findings on how Canadian businesses use, store, and handle the personal information they collect from customers.

Most Canadian businesses use customer information primarily to provide services

Most representatives of the businesses surveyed (86%) reported that their company uses customer information to provide service to customers. Results are virtually unchanged from 2023, but reflect a sustained increase since 2019 (63%), with levels rising to 84% in 2023 and holding steady at 86% this year.

About one-third of respondents (34%) said their company uses customer information to personalize services or products, up from 23% in 2023 and 22% in 2021, and slightly higher than in 2019 (30%). Smaller proportions reported using customer information for data analytics (18%) and to build customer profiles for marketing purposes (17%). Business use of customer profiles has been gradually increasing since 2019.

Very few (2%) business representatives said their company uses customer information to train an artificial intelligence (AI) system.

Regionally, companies in Quebec are more likely to use personal information collected about customers to provide them with services (92%, compared to 78% of companies in Atlantic Canada and 83% of those in Ontario). Higher rates are also observed among companies that collect information from minors (92%) and those that use AI in their business operations (93%).

Electronic and cloud storage are the primary methods used by businesses

Nearly two-thirds of business representatives (63%) said their company stores customer information on-site electronically, a slight decline from 2023 (68%), and consistent with 2021 levels (62%).

Half of surveyed businesses (50%) store customer information off-site with a third party, such as a cloud service, continuing a steady increase from 21% in 2019 to 27% in 2021 and 41% in 2023. In contrast, more than one-third (37%) store customer information on-site on paper, continuing a downward trend from 49% in 2019 to 41% in 2021 and 38% in 2023.

Very few business representatives (2%) said their company does not store personal information about customers.

Businesses in Quebec are more likely to store personal information off-site with a third-party (57%, compared to 39% of companies in Atlantic Canada and 44% in western Canada) or store it on-site electronically (69%, compared to 58% of companies in Ontario).

Differences are also observed by company size. Small businesses (1-19 employees) are more likely than medium (20-99 employees) and large (100+ employees) businesses to store personal information on-site in paper form (42%, compared to 31% and 32%, respectively). This is especially true among businesses with fewer than five employees, with 53% reporting on-site paper storage.

Very few companies send customer information outside Canada

Very few business representatives (3%) reported that their company sends customers’ personal information to companies outside Canada for processing, storage or other purposes. This is virtually unchanged from 2023.

Most companies^{Footnote 1} that send customers’ personal information outside Canada inform their customers that their personal information may be transferred outside Canada.

2. Use of AI in business operations

This section examines the use of AI by surveyed companies.

Growing use of AI among Canadian businesses

The proportion of business representatives reporting that their company uses AI for business operations increased from 6% in 2023 to 16% in 2025, though overall levels of use remain low.

Use of AI for business operations is higher in Ontario (17%) and western Canada (21%) than elsewhere in the country. Similarly, it is highest among businesses with 100+ employees (29%).

Research and document drafting is the most common use of AI among businesses

Among Canadian businesses that use AI in their operations (n=113), the most common application is research and document drafting, which was reported by close to half (45%) the survey respondents.

About one-quarter (24%) use AI for marketing, while smaller proportions use it for text or data analysis (18%) and customer service or chatbots (15%).

Fewer businesses reported using AI for other types of business operations. Seven percent use it for forecasting trends or customer behaviour, 5% for human resources-related applications, 4% for video or image analysis, 3% for employee recruitment or quality control, 2% for supply chain optimization, or 1% for fraud detection.

Eight percent reported other uses of AI, while 7% did not know how AI is used in their business operations.

Nearly half of businesses use AI to improve efficiency and to make decisions

Among Canadian businesses that use AI in their operations (n=113), nearly half (49%) reported using it primarily to improve efficiency, compared to 39% in 2023. This difference is not statistically significant and based on a small number of respondents (n=39).

In addition, approximately one-third of respondents (34%) said their company uses AI for both improving efficiency and supporting decision-making, while almost none of the businesses surveyed (1%) use AI exclusively for decision-making.

Fourteen percent of Canadian businesses that use AI do not use it for either operational efficiency or decision-making.

Near-unanimous human oversight of AI-driven decisions

Nearly all (97%) surveyed businesses that use AI for both efficiency and decision-making (n=42) reported that a human employee reviews AI-driven decisions before any action is taken by their company. The remainder (3%) did not know whether this human oversight occurs.

3. Canada’s privacy laws and compliance

This section presents findings on companies’ awareness of and compliance with their responsibilities under Canada’s privacy laws. Before answering these questions, respondents were provided with the following description of Canada’s privacy laws.

The federal government’s privacy law, the Personal Information Protection and Electronic Documents Act or PIPEDA, sets out rules that govern how businesses engaged in commercial activities should protect personal information. In Alberta, BC and Quebec, the private sector is governed by provincial laws, which are considered to be similar to the federal law.

Most businesses have a high level of awareness of their responsibilities under Canada’s privacy laws

Seven in 10 business representatives (72%) said their company is highly aware of its responsibilities under Canada’s privacy laws (scores of 6 or 7 on the 7-point scale), while 21% rated their company as moderately aware (scores of 3 to 5). Taken together, the vast majority (93%) of surveyed companies are at least moderately aware of their privacy-related responsibilities. Few (4%) rated their company’s awareness as low (scores of 1 or 2).

Self-reported awareness of responsibilities under Canada’s privacy laws is higher this year. Some or all of is increase may be attributable to the change in the target population this year rather than a true increase over time.

Awareness varies by company size and sector. It is higher among large companies (100+ employees) than among small companies (1-19 employees) (79% versus 67%), and it is higher among companies that are operating in the healthcare and social assistance sector (85%) compared to accommodation and food services (63%), other services (67%), and retail (70%).

9 in 10 businesses have taken steps to comply with Canada’s privacy laws

Nine in 10 Canadian businesses (91%) said their company has taken steps to ensure it complies with Canada’s privacy laws. Reported compliance has increased compared with recent waves (76% in 2023 and 74% in 2021) and remains well above the baseline of 66% reported in 2017. Some or all of the increase may reflect the change in the target population rather than reflecting a true change over time.

The likelihood of having taken steps to ensure compliance increases with company size and engagement with privacy practices. Large companies (94%) are more likely than small companies (88%) to report taking such steps. Higher rates are also observed among companies with a privacy policy (94%) and those that have used the OPC’s compliance information and tools (100%).

Vast majority of companies found it at least somewhat easy to ensure compliance

Among companies that have taken steps to comply with Canada’s privacy laws (n=714), 89% reported that doing so has been at least moderately easy. Over half (58%) said compliance has been very easy (scores of 1 and 2 on the 7-point scale), while 31% rated it as moderately easy (scores of 5 to 7). Just 5% of respondents said it was very difficult for their company to comply with Canada’s privacy laws.

The proportion of businesses that found it very easy to bring personal information handling practices into compliance with Canada’s privacy laws is stable at 58%, after having increased significantly between 2021 (35%) and 2023 (56%). Comparisons with previous years should take into account the change in the target population in 2025.

Fewer businesses in Quebec report that compliance with Canada’s privacy laws is very easy (43%).

Compliance costs with Canada’s privacy laws vary widely among businesses

Canadian businesses reported a range of costs associated with complying with Canada’s privacy laws over the past 12 months. The most commonly reported cost was under $1,000 (16%), followed by $1,000 to just under $5,000 (13%). In total, four in 10 businesses reported costs of under $5,000 (29%) or no costs at all (11%). At the same time, two in 10 businesses reported costs of $5,000 or more, including 8% reporting between $5,000 and just under $10,000 and 11% reporting $10,000 or more.

Notably, 9% of businesses indicated they had not taken steps to comply with Canada’s privacy laws, and nearly one-third (32%) were unable to estimate the financial cost of compliance.

Respondents were told to include all categories of costs, such as staff time and training, IT, and legal fees, in their estimate. Costs incurred ranged from under $1,000 to $200,000 or more in the last 12 months.

Small businesses (1-19 employees) are more likely than medium-sized and large businesses to report no costs (14% versus 9% and 6%, respectively) or costs of under $1,000 (19% versus 16% and 11%).

4. Awareness and use of the OPC’s resources

This section presents findings on companies’ awareness and use of the OPC’s information and tools designed to help companies comply with their privacy obligations.

Half of businesses report awareness of the OPC’s privacy compliance resources

Awareness of the OPC’s resources has increased in recent years. In 2025, half of business representatives (51%) reported being aware that the OPC has information and tools available to companies to help them comply with their privacy obligations.

This represents an increase compared with 2023 (41%) and 2021 (33%), with awareness at its highest since tracking began. This increase may reflect, in part or in whole, the change in the target population rather than a true increase in awareness of OPC resources over time.

Awareness of the OPC’s tools and information is higher among large (100+ employees) and medium-sized (20-99 employees) businesses (57% and 56%, respectively) than among small businesses (1-19 employees) (45%). As well, companies that have taken steps to comply with Canada’s privacy laws (54%) and those with a privacy policy (55%) are also more likely to be aware of the OPC’s resources.

4 in 10 businesses aware of the OPC’s resources report using them

Use of the OPC’s information and tools has increased over time among businesses that are aware of them (n=396). In 2025, four in 10 businesses (40%, up from 26% in 2023) reported having used OPC resources. The increase may reflect, in part or in whole, the change in the target population rather than a true increase in the use of OPC resources over time.

Canadian businesses most often identify practical compliance tools as the most helpful resources

Respondents were presented pairs of potential resources and asked to select which would be most helpful. Results reflect the proportion of times each item was selected when presented. Each respondent was presented two pairs of potential resources.

Companies most often chose practical compliance tools. Step-by-step compliance guides (65%), online training modules for staff (64%), and templates (63%) were most frequently identified as helpful, selected nearly two-thirds of the times they were presented to respondents.

Many also selected sector-specific checklists (58%) and access to advice (57%), while nearly half chose webinars or virtual workshops (49%), cybersecurity best-practice guidance (48%), and case summaries or real-world examples (47%). Self-assessment tools (42%), breach reporting guidance (34%), and guidance on AI and emerging technologies (25%) were selected less frequently than the other tools.

5. Company privacy practices

This section presents findings on the procedures and policies companies have in place to protect personal information collected from their customers.

Majority of businesses have designated a privacy officer

Seven in 10 Canadian businesses (72%, up from 56% in 2023) reported having designated someone in their company to be responsible for privacy issues and the personal information the company holds. This increase may reflect, in part or in whole, the change in the target population rather than a true increase in the designation of privacy officers over time.

The likelihood of designating a privacy officer was higher among companies that have used the OPC’s tools and information (88% compared to 74% of companies that have not used these resources).

Most Canadian businesses have documented privacy policies

Nearly three-quarters (74%, up from 50% in 2023) of business representatives reported that their company has developed and documented internal policies for staff that address their privacy obligations under the law. Comparisons over time should take into account the change to the target population in 2025, which may influence observed differences from previous years.

The likelihood of developing and documenting internal policies for staff that address privacy obligations increases with business size, from 64% of small businesses (1-19 employees) to 87% of large businesses (100+ employees).

Regionally, companies in Quebec (66%) are less likely than those in Ontario and western Canada (both 77%) to have such policies in place. Adoption is also higher among companies that have used the OPC’s privacy tools (93%).

Six in 10 Canadian businesses provide regular staff privacy training and education

Six in 10 business representatives (62%) reported that their company regularly provides staff with privacy training and education. In previous survey waves, the proportion was considerably lower and relatively stable. Some or all of the increase may be attributable to the change in the target population, rather than a true shift over time.

The likelihood of providing regular privacy training and education for staff increases with business size, from 55% of small businesses to 76% of large businesses. Regionally, companies in Quebec (48%) are less likely than those in Ontario (70%) and western Canada (62%) to provide such training and education. Implementation is also higher among companies that have used the OPC’s privacy tools (84%).

Most businesses have procedures for personal information access requests

Three-quarters (75%, compared to 50% in 2023) of business representatives reported that their company has procedures in place to respond to customer requests for access to their personal information. Differences over time may reflect the change in the target population this year rather than true shifts over time.

Businesses in Quebec (63%) are less likely than businesses in Ontario and western Canada (79% each) to have procedures for responding to customer requests for personal information. When it comes to business size, these procedures are more common among large businesses (100+ employees) than among small businesses (1-19 employees) (81% versus 72%).

Nearly 8 in 10 businesses report procedures for handling privacy complaints

Just under eight in 10 businesses (77%) have procedures in place to handle complaints from customers who believe their personal information has been handled improperly. In earlier survey waves, roughly half of the business representatives surveyed reported that their company had such procedures. Differences over time may reflect the change in the target population this year rather than true shifts over time.

Businesses in Quebec (67%) are less likely than those in Ontario and western Canada (both 80%) to have procedures for privacy complaints. In addition, these procedures are more common among larger businesses (83% of companies with 20-99 employees and 85% of companies with 100+ employees) than among small businesses with 1-19 employees (68%). Implementation of such procedures is also higher among companies that have used the OPC’s privacy tools (96%).

Use of basic security measures is widespread, but adoption of more advanced protections varies

Business representatives reported that their company takes a range of actions to safeguard customers’ personal information. The most common measures include using end-point protection tools (90%), requiring passwords to access accounts (87%), and controlling employee access to electronic files (86%).

Many businesses also reportedly use multi-factor authentication (65%), while just over half use encryption (55%) and intrusion detection systems (52%). A very small proportion use voice print authentication (5%).

The use of several measures has increased since 2023. More companies require passwords to access accounts (87%, compared to 83% in 2023), control employee access to electronic files (86% versus 79%), and use multi-factor authentication (65% versus 53%). Comparisons to 2023 should take into account the change to the target population in 2025.

Regionally, companies in Ontario and western Canada are more likely to use encryption (64% and 63%, respectively) and multi-factor authentication (76% and 72%, respectively) to safeguard the personal information of customers.

6. Collection of personal information from minors

This section presents findings on the procedures and policies companies have in place to protect the personal information collected from customers under the age of 18.

3 in 10 businesses collect personal information from minors

Three in 10 business representatives (29%) reported that their company collects personal information from customers who are minors (under the age of 18). In 2023, fewer companies (12%) were reportedly collecting personal information from customers under the age of 18. This difference may reflect the change in the target population this year rather than a true shift over time.

Companies in Quebec (35%) and Ontario (30%) are more likely to collect information from minors compared to companies operating in western Canada (22%).

Most companies verify age and obtain parental consent, but fewer implement stronger protections for young people

Among companies that collect personal information from young people (n=214), most verify age (85%) and obtain parental consent if the young person is under 13 (84%). In addition, approximately two-thirds (68%) explain their privacy policies and practices in simple, age-appropriate language. Fewer companies use strong privacy settings by default, such as automatically turning off location tracking (36%) or make it easy for young people to delete their account or information they have posted (34%).

Compared to 2023, considerably more companies are obtaining parental consent when collecting information from young people (84% in 2025 versus 69% in 2023). This may be attributable, at least in part, to the change in the target population this year. Other differences are not statistically significant due to the small sample sizes.

Companies in Quebec (94%) are more likely to verify age compared to companies operating in Ontario (82%) and western Canada (79%).

7. Privacy policies

This section presents findings on privacy policies and how companies communicate their privacy practices.

A strong majority of Canadian businesses have a privacy policy

Eight in 10 (84%) business representatives said their company has a privacy policy. This represents an increase compared with previous waves of the survey. Differences over time may reflect the change in the target population this year rather than true shifts over time.

Companies in Quebec (88%) and Ontario (86%) are more likely to have a privacy policy compared to those in western Canada (78%). Use of a privacy policy also increases with business size, from 78% of small businesses (1-19 employees) to 92% of large businesses (100+ employees). Privacy policies are also more common among companies that have used the OPC’s privacy tools (97%).

Most privacy policies explain key information-handling practices in plain language

Most business representatives whose company has a privacy policy (n=665) reported that it explains in plain language key elements of their information-handling practices. Nearly nine in 10 (87%) said their policy outlines the purposes for which personal information is collected, used or disclosed. Similarly, large majorities indicated that their policy explains how personal information is collected, used or disclosed (85%), as well as what personal information is collected (84%).

Approximately three-quarters of business representatives reported their company’s privacy policy explains with whom information may be shared (76%), how long personal information is retained (75%), and how it is disposed of (73%). Seven in 10 (70%) said their policy also describes the risk of harm in the event of a breach.

Compared with earlier waves, results point to modest gains across several measures. The share explaining data retention periods increased from 67% in 2023 to 75% in 2025, while explanations of data disposal practices increased from 62% to 73%. Disclosure of the risk of harm in the event of a breach also improved, increasing from 55% in 2023 to 70% in 2025. Differences over time may reflect the change in the target population this year rather than true shifts over time.

Customer-facing privacy communication is fairly widespread, though some practices are less common

Among companies that have a privacy policy (n=665), many communicate key privacy practices to customers. Three-quarters (75%) of business representatives said their company explains how customers can raise a privacy concern or ask a privacy-related question. In addition, seven in 10 make clear when the collection, use or disclosure of personal information is a condition of service (71%), make privacy information easily accessible to customers (71%), and explain how customers can request access to their personal information (69%). Two-thirds (65%) of companies explain how customers can file a formal privacy complaint.

About half of companies report additional communication practices, including obtaining consent from customers when making changes to privacy practices (56%), actively promoting their company’s privacy practices (55%), and notifying customers when changes are made to the privacy policy (53%).

The proportion of companies that communicate elements of their privacy practices has increased since 2023. Comparisons over time should take into account the change to the target population this year, as differences may reflect this change, at least in part, rather than true shifts over time.

Companies in Quebec (56%) are less likely than those operating in Ontario (78%) and western Canada (73%) to make clear whether the collection, use, or disclosure of personal information is a condition of service.

8. Data breaches

This section presents findings on Canadian business’ preparedness for data breaches and experience with them.

Nearly two-thirds of businesses are highly prepared to respond to a data breach

Nearly two-thirds of business representatives (64%) said their company is highly prepared to respond to a data breach involving personal information (scores of 6 or 7 on the 7-point scale), including 46% who consider their company extremely prepared. One-quarter (26%) rated their company as moderately prepared (scores of 3 to 5). Overall, the vast majority (90%) of surveyed companies are at least moderately prepared to respond to a data breach, while few (5%) indicated low preparedness (scores of 1 or 2).

Compared with 2023, perceptions of preparedness have improved, with the proportion rating their company as highly prepared (scores of 6 or 7) increasing from 46% to 64% in 2025. Comparisons over time should take into account the change to the target population this year, as differences may reflect this change, at least in part, rather than true shifts over time.

Perceptions of being highly prepared increase with business size, from 57% among small businesses (1-19 employees) to 77% among large businesses (100+ employees). It is also higher among business that have used the OPC’s tools (78%).

Reported data breaches among businesses have increased

One in 10 business representatives (10%) reported that their company has experienced a breach where the personal information of customers was compromised, up from 6% in 2023. Differences over time may reflect the change in the target population this year rather than true shifts over time.

8 in 10 businesses report keeping records of data breaches

A large majority of business representatives reported that their company keeps records of data breaches involving customers’ personal information. This year, 81% said their company keeps records of such breaches, down from 94% in 2023. The decrease may reflect, in part or in whole, the change in the target population this year rather than a true decline in record keeping.

Corporate profile of responding companies

The following tables present the characteristics of Canadian businesses included in the survey sample (using weighted data), as well as business representatives.

Survey questionnaire

Introduction

1st POINT OF CONTACT/GATEKEEPER:

Hello/bonjour, my name is [Interviewer’s name]. Would you prefer to continue in English or French? / Préférez-vous continuer en anglais ou en français? The Office of the Privacy Commissioner of Canada is conducting a survey. May I speak to the person in your company who is the most familiar with the types of personal information collected about your customers, and how this information is stored and used. This may be your company’s Privacy Officer if you have one.

IF ASKED BY GATEKEEPER:

I’m calling on behalf of Phoenix SPI, a public opinion research company. We’re conducting a survey for the Office of the Privacy Commissioner of Canada to better understand the needs and practices of companies across the country in relation to Canada’s privacy laws.

RESPONDENT:

Hello/Bonjour, my name is [Interviewer’s name]. I’m calling on behalf of Phoenix SPI, a public opinion research company. We’re conducting a survey for the Office of the Privacy Commissioner of Canada to better understand the needs and practices of companies across the country in relation to Canada’s privacy laws.

The survey takes about 15 minutes and is voluntary. Your responses will be kept confidential and anonymous, and the information you provide will be administered according to the requirements of the Privacy Act, the Access to Information Act, and any other pertinent legislation. The survey is registered with the Canadian Research Insights Council’s survey validation system.

May I continue?

Screening and background information

1. Does your company sell or offer services or products directly to individual consumers?

2. Does your company collect personal information about customers?

3. Approximately how many employees work for your company in Canada? Please include part-time employees as full-time equivalents. [DO NOT READ LIST]

Section 1. Customers’ Personal Information

To start, I’d like to ask about the personal information your company collects about customers.

4. What does your company do with the personal information that it collects about customers? Is it used ...? [READ LIST. ROTATE ITEMS. ACCEPT ALL THAT APPLY]

5. How does your company store the personal information of customers? Is the information…? [READ LIST. ROTATE ITEMS. ACCEPT ALL THAT APPLY]

6. Does your company send customers’ personal information to companies outside Canada for processing, storage or other purposes? [READ LIST]

7. [IF Q6=01] Do you inform customers that their personal information may leave Canada? [READ LIST]

Section 2: Technology

8. Does your company use AI for business operations? [READ LIST]

9. [IF Q8=01] How is your company using AI in its business operations? [DO NOT READ LIST; ACCEPT MULTIPLE RESPONSES]

10. [IF Q8=01] Is AI being used by your company to improve efficiency, for decision-making, or for both?

11. [IF Q10=02,03] When your company uses AI for decision-making, does a human employee review the decision before any action is taken by your company? [READ LIST]

Section 3: Canada’s Privacy Laws and Compliance

The federal government’s privacy law, the Personal Information and Protection and Electronic Documents Act or PIPEDA (PRONOUNCED PIP-EE-DAH) sets out rules that govern how companies should protect personal information. In Alberta, British Columbia and Quebec, the private sector is governed by provincial laws, which are similar to the federal law.

12. How would you rate your company’s awareness of its responsibilities under Canada’s privacy laws? Please use a scale from 1 to 7, where 1 is not at all aware, and 7 is extremely aware.

13. Has your company taken steps to ensure that it complies with Canada’s privacy laws? [READ LIST]

14. [IF Q13=01] How difficult has it been for your company to bring your personal information handling practices into compliance with Canada’s privacy laws? Please use a scale from 1 to 7, where 1 is extremely easy, and 7 is extremely difficult.

15. In the past 12 months, which of the following best describes your company’s approximate financial cost of complying with Canada’s privacy laws. Please include all categories of costs, such as staff time and training, IT, and legal fees. Is it…? [READ LIST; STOP WHEN THE RESPONDENT SELECTS AN ITEM] [NEW]

16. Are you aware that the Office of the Privacy Commissioner of Canada, or the OPC, has information and tools available to companies to help them comply with their privacy obligations? [READ LIST]

17. [IF Q16=01] Has your company ever used any of these resources? [READ LIST]

18. [IF Q16=02, 03 or 99, ADD: The OPC produces resources for companies to help them comply with their privacy obligations.] As the person at your company most familiar with the handling of customers’ personal information, which of the following information and tools would you find most helpful? The first one is [ITEM 1] OR [ITEM 2]. REPEAT. [RANDOMIZED PAIRED COMBINATIONS ENSURING EACH ITEM APPEARS EQUALLY; TWO PER RESPONDENT; DO NOT REPEAT QUESTION UNLESS NEEDED.] [NEW]

Section 4: Company Privacy Practices

Now I’d like to ask you about your company’s privacy practices.

19. Have you designated someone in your company to be responsible for privacy issues and personal information that your company holds?

20. Has your company developed and documented internal policies for staff that address your privacy obligations under the law?

21. Does your organization regularly provide staff with privacy training and education?

22. Does your company have procedures in place for responding to customer requests for access to their personal information?

23. Does your company have procedures in place for dealing with complaints from customers who feel that their information has been handled improperly?

24. Does your company take any of the following actions to safeguard the personal information of customers? Please answer yes or no. [MODIFIED SINCE 2023: EMPLOYEES REMOVED] [READ ITEMS; ROTATE ITEMS]

1. Require passwords to access accounts
2. [SPLIT SAMPLE: 50%] Use multi-factor authentication
3. [SPLIT SAMPLE: 50%] Use voice prints authentication
4. [SPLIT SAMPLE: 50%] Use encryption
5. [SPLIT SAMPLE: 50%] Control employee access to electronic files
6. [SPLIT SAMPLE: 50%] Use intrusion detection systems [NEW]
7. [SPLIT SAMPLE: 50%] Use end-point protection tools, such as anti-malware or antivirus software [NEW]

25. Does your company collect personal information from customers who are minors, that is under the age of 18? [READ LIST]

26. [IF Q25=01] When collecting information from young people, does your company do any of the following? Please answer yes or no. [READ ITEMS; ROTATE ITEMS]

1. Verify age
2. [SPLIT SAMPLE: 50%] Obtain parental consent if under 13
3. [SPLIT SAMPLE: 50%] Explain privacy policies and practices in simple, age-appropriate language
4. [SPLIT SAMPLE: 50%] Use strong privacy settings by default, for example, automatically turning off location tracking
5. [SPLIT SAMPLE: 50%] Make it easy for young people to delete their account or information they’ve posted

Section 5: Privacy Policies

27. Does your company have a privacy policy? [READ LIST]

28. [IF Q27=01] Does your privacy policy explain in plain language...? [READ LIST; ROTATE ITEMS; SPLIT SAMPLE]

1. [SPLIT SAMPLE: 50%] How your company collects, uses and discloses customers’ personal information?
2. [SPLIT SAMPLE: 50%] What personal information your company is collecting from customers?
3. [SPLIT SAMPLE: 50%] The reason customers’ personal information is being collected, used or disclosed?
4. [SPLIT SAMPLE: 50%] With which parties customers’ personal information will be shared?
5. [SPLIT SAMPLE: 50%] For how long your company keeps customers’ personal information?
6. [SPLIT SAMPLE: 50%] The risk of harm to the individual, if any, in the event of data breach?
7. ALL How your company disposes of customers’ personal information once it is no longer needed?

Still thinking about your company’s collection and use of customers’ personal information…

29. [IF Q27=01] Does your company do any of the following? [READ LIST; ROTATE ITEMS; SPLIT SAMPLE]

1. [SPLIT SAMPLE: 50%] Notify customers when making changes to your company’s privacy policy?
2. [SPLIT SAMPLE: 50%] Obtain consent from customers when making changes to your company’s privacy practices?
3. [SPLIT SAMPLE: 50%] Make clear whether the collection, use or disclosure of information is a condition of service?
4. [SPLIT SAMPLE: 50%] Make privacy information easily accessible to your customers?
5. [SPLIT SAMPLE: 50%] Explain how customers can raise a privacy concern or ask a privacy question?
6. [SPLIT SAMPLE: 50%] Explain how customers can request access to their personal information?
7. [SPLIT SAMPLE: 50%] Explain how customers can file a formal privacy complaint?
8. [SPLIT SAMPLE: 50%] Actively promote your company’s privacy practices?

Section 6: Risk Assessment and Breaches

Data breaches can be caused by criminal activity, theft, hacking, or employee error such as misplacing a laptop or other portable device.

30. To what extent is your company prepared to respond to a data breach involving personal information? Please use a scale of 1 to 7, where 1 is not at all prepared to respond in the event of a privacy breach, and 7 is extremely prepared to respond.

31. Has your company ever experienced a breach where the personal information of your customers was compromised? [READ LIST]

32. [IF Q31=01] Does your company ensure that it keeps records of all data breaches involving your customers’ personal information?

Section 7: Corporate Profile

These last questions are for statistical purposes only, and all answers are confidential.

33. In what industry or sector do you operate? If your company is active in more than one sector, please identify the main sector. [DO NOT READ LIST. ACCEPT ONE RESPONSE]

34. What is your own position within your company? [DO NOT READ LIST. ACCEPT ONE RESPONSE]

This concludes the survey.

Thank you for your time and feedback, it is much appreciated.