Canadian Business Compliance Checklist

Why?

Sending commercial messages without consent is illegal under CASL. Fines start at $200 per violation and can reach $1M for individuals, $10M for businesses.

Benefit

Proper consent protects you from massive fines, keeps your sender reputation clean, and builds a list of people who actually want to hear from you.

Why?

CASL requires senders to clearly identify themselves and provide contact information. Vague 'from' names or missing addresses are non-compliant on their own.

Benefit

Clear identification also improves deliverability and open rates — people open emails from names they recognize and trust.

Why?

CASL requires a functioning unsubscribe mechanism in every single commercial message — no exceptions, not even for one-time promotions.

Benefit

An easy unsubscribe keeps your list healthy (fewer spam complaints), improves deliverability, and keeps you legally protected at no cost.

Why?

Continuing to email someone who has unsubscribed is a separate CASL violation for each message sent after the request. The clock starts immediately.

Benefit

Fast processing protects you from compounding violations and maintains your email sender reputation with providers like Gmail and Outlook.

Why?

If the CRTC investigates, you must prove consent was given. 'I'm pretty sure they agreed' is not a legal defence — undocumented consent doesn't count.

Benefit

Consent records are your legal defence. They also help you segment your list by quality and target only engaged, warm contacts.

Why?

Someone who purchased from you more than 2 years ago is no longer covered by implied consent. Emailing them without refreshing consent is a fresh violation.

Benefit

Regular audits keep your list clean, improve engagement metrics, and reduce your legal exposure — while focusing your marketing on people most likely to buy again.

Why?

Operating above the threshold without registration violates the Excise Tax Act — the CRA can assess back taxes, interest, and penalties going back years.

Benefit

Registration also lets you claim Input Tax Credits (ITCs) on your business purchases, often recovering thousands in tax you've already paid.

Why?

Charging the wrong rate means either undercharging (you absorb the tax yourself) or overcharging (customer complaints, and potential CRA penalties).

Benefit

Correct rates mean clean books, no CRA surprises, and professional invoices that your business clients can use for their own Input Tax Credits.

Why?

Late filings trigger an immediate 1% penalty plus 0.0274% interest per day — small amounts that compound quickly into hundreds of dollars per year.

Benefit

On-time filing keeps you penalty-free, maintains a clean CRA account, and avoids the stress of a compliance notice arriving unexpectedly.

Why?

ITCs require documented proof. Without receipts, you can't claim deductions during a CRA audit — even if you genuinely made the purchase and paid the tax.

Benefit

Solid records maximize your legitimate ITC claims and provide a clean defence if you're ever audited — typically recovering far more than the cost of keeping them.

Why?

Once registered, displaying your number on qualifying invoices is a legal requirement. Omitting it exposes you to penalties and frustrates business clients.

Benefit

Compliant invoices protect you legally and allow your clients to claim their own ITCs — making you noticeably easier to do business with.

Why?

PIPEDA and provincial laws require businesses to have a publicly accessible privacy policy. Operating without one leaves you exposed to complaints filed with the OPC.

Benefit

A clear privacy policy builds customer trust, reduces hesitation on forms and checkout pages, and protects you legally if there's ever a data dispute.

Why?

PIPEDA requires someone to be accountable for privacy compliance. 'Nobody owns it' is not acceptable — it's a compliance gap that the OPC specifically looks for.

Benefit

Having a named person ensures privacy is someone's actual job, reducing your risk of a breach going unaddressed and quietly becoming a major liability.

Why?

Collecting unnecessary data increases your liability in a breach. You're legally responsible for protecting everything you hold — including data you never use.

Benefit

Minimal data collection reduces your security risk, your storage costs, and your compliance burden. It's the easiest privacy win available.

Why?

Using customer data for purposes beyond what they consented to is a privacy violation under PIPEDA. Each unauthorized use is treated as a separate issue.

Benefit

Proper consent builds long-term trust and protects you from privacy complaints to the Office of the Privacy Commissioner of Canada.

Why?

Law 25 requires privacy impact assessments, mandatory breach notifications within 72 hours, and data portability rights. Fines reach $25M or 4% of worldwide revenue.

Benefit

Full Law 25 compliance opens the Quebec market with no hesitation from large clients, and demonstrates a privacy-first commitment that increasingly wins contracts.

Why?

Operating under an unregistered name can invalidate contracts, expose you to personal liability, and make it impossible to open a business bank account.

Benefit

Proper registration protects your business name from competitors, limits personal liability if incorporated, and is required for most commercial leases and financing.

Why?

Operating without a required licence can result in fines, a forced closure, or complications renewing other permits — often discovered at the worst possible moment.

Benefit

Having your licence means you're legally permitted to operate and can advertise, sign leases, and take on contracts without hidden compliance risk.

Why?

A single liability claim — a customer injured on your property or a mistake on a client project — without insurance can wipe out years of business savings in one event.

Benefit

Insurance lets you take on clients, sign contracts, and bid on commercial work confidently, knowing one bad day won't end the business.

Why?

Mixing funds makes bookkeeping a nightmare, complicates tax filing, and can pierce the corporate veil in a legal dispute — exposing your personal assets to liability.

Benefit

Separate accounts give you a clear picture of business health, make tax season manageable, and protect your personal savings from business liabilities.

Why?

The CRA can audit up to 6 years back. Records that no longer exist can't prove deductions were valid — the CRA will simply disallow them and bill you.

Benefit

Complete records maximize your deductions, give you a clean defence in an audit, and provide the financial history you need to make smart business decisions.