By Liv Saville, Head of Growth at Worthington

A seller signs paperwork to list on a Friday afternoon and, almost as an aside, asks who else sees the information she's handing over: her phone number, her mortgage pre-approval, the reason she's moving. It's a fair question. Between the CRM, the website's lead-gen form, whatever drafts the follow-up emails, and the e-signature platform, a single seller's file can pass through half a dozen systems before the ink is dry. Every one of those systems is collecting, using, or disclosing personal information under Canada's federal privacy law, whether anyone in the transaction thought about it that way or not.

What PIPEDA actually asks of a real estate business

PIPEDA, the Personal Information Protection and Electronic Documents Act, is Canada's federal privacy law for the private sector. It applies to any organization, real estate brokerages included, that collects, uses, or discloses personal information in the course of commercial activity, which covers most of a normal transaction: a buyer's budget, a seller's timeline, a lead's phone number, a pre-approval letter.

The law is built around a set of fair information principles, and in a real estate file the ones that come up most often are consent, limiting collection, and safeguards. Consent means a client has a reasonable idea of what's being collected and why before it happens, not something buried in a form nobody reads. Limiting collection means only gathering what the transaction actually requires: for a listing, the property details and the seller's contact information, not an open-ended intake of unrelated personal history. Safeguards means the information is protected appropriately once it exists, whether it's sitting in a CRM, an email thread, or a spreadsheet.

None of this is unique to real estate. What makes it worth a second look in this industry specifically is how many different tools touch one file. A single lead can move through a website form, a CRM, an email tool, and a transaction management platform before an offer is even written, and PIPEDA doesn't stop applying just because a vendor is technically doing the processing. The agent, or the brokerage, stays accountable for what happens to the client's information along the way.

What compliance looks like day to day

For most solo agents and small teams, PIPEDA compliance isn't a legal department, it's a handful of habits. Someone in the business, often the broker or the agent themselves, is the practical point of contact if a client asks a privacy question, close to what the law expects from a business this size. Consent gets captured at the point information is first collected: a line in an intake form, or a verbal confirmation before a lead's number gets added to a follow-up list, rather than assumed after the fact.

The collection side matters more than agents usually expect. A property listing needs the property's details and the seller's contact information. It doesn't need a buyer's employer, income, or family situation gathered just in case, before there's a reason to ask. Financing details are the same story: a pre-approval amount is directly relevant once a buyer is close to writing an offer, but collecting it earlier than that, or holding onto it after a deal falls through, is exactly the kind of over-collection the principle is meant to discourage.

Clients also have the right to ask what's on file about them and to have it corrected if it's wrong, which in practice usually means being able to answer "what do you have on me, and can you fix this phone number" without a scramble through three different tools. And because so much of a transaction now moves through software rather than paper, the practical version of reasonable safeguards is asking each vendor a plain question before signing up: where does this information go, who else can see it, and what happens to it if the agent stops using the tool.

Where the software an agent uses fits in

An agent's own habits only cover part of the picture, since most client information now passes through several vendors before a transaction closes. Worthington is one of the tools that sits inside that flow for agents who use him, reading a connected inbox, keeping contact records, and drafting replies. Every reply he drafts waits for the agent's review before it goes out, except for leads that have clearly passed qualification and safety checks under a setting the agent controls. That keeps a person deciding what gets sent using a client's information in most cases, not the software.

Worthington doesn't give legal or compliance advice, and no single tool makes a business PIPEDA compliant on its own. The useful habit, for any piece of software an agent evaluates, is the same one that applies to a CRM or a lead-gen widget: ask what it touches, who else can see it, and what happens if they stop using it.

Questions agents ask about PIPEDA and real estate software

It applies to anyone conducting commercial activity, which includes an individual agent, not just the brokerage as an entity. Brokerages often set baseline policies, but each agent is still responsible for how they personally collect and handle client information day to day.
Anything that identifies a person and relates to them: name, phone number, email, address, a pre-approval amount, even a note about why someone is selling. If it's about an identifiable person and isn't already public, it's worth treating as covered.
Yes. Quebec has its own private-sector privacy law, Law 25, which runs alongside PIPEDA and adds requirements of its own. Agents working in Quebec should treat provincial rules as an addition to PIPEDA, not a replacement for it.
PIPEDA gives clients the right to ask what personal information a business holds about them and to request a correction if it's inaccurate. Being able to answer that request without digging through five different tools is one of the more practical tests of whether a small business's data habits actually hold up.
Yes. PIPEDA applies to how personal information is collected, used, and disclosed regardless of what software is doing the work, so a tool that reads an inbox or scores a lead is handling personal information the same way a person doing that job manually would be. The agent stays accountable for that handling either way, which is why it's worth asking any vendor how they handle client information before connecting them to a live inbox.

The seller who asked who sees her information on a Friday afternoon deserved a straight answer, and giving one doesn't take a legal team, just knowing what each tool in the business actually touches. Most of PIPEDA, applied to a real estate practice, comes down to collecting only what's needed, being clear about it, and being able to answer for it later. That's a reasonable bar for any tool working inside an agent's business, Worthington included.