Fax vs email for sensitive documents in Canada

What Canadian privacy law expects

PIPEDA applies to many private-sector businesses, and provinces such as Ontario, Alberta, British Columbia and Quebec have their own privacy or health information laws. Lawyers also follow their law society's rules on confidentiality. The common thread is that you must protect personal information with safeguards suited to how sensitive it is.

None of these laws bans email or fax outright. Privacy commissioners have published guidance on both, and it is worth reading the guidance from your own province's commissioner.

Where traditional fax falls short

Paper fax has its own problems. Pages sit in an output tray where anyone walking by can read them. A single wrong digit sends a full document to a stranger, and there is no log of who picked it up. Old machines also store images in memory, which matters when they are replaced or sold.

If you keep a paper machine, place it in a staff-only area, clear the tray often and confirm numbers before dialling.

Choosing between them

Review the policy once a year, or sooner if a near miss happens, and keep it short enough that new staff will actually read it.

1. Check what the recipient accepts. Many clinics, courts and government offices in Canada still list a fax number for documents.
2. Rate the sensitivity. Health records, identity documents and financial statements deserve stronger controls than a meeting agenda.
3. Pick the channel you can control and log. If you cannot encrypt the email or verify the address, fax with number confirmation is often the safer route.
4. Write your choice into a short office policy so staff handle similar documents the same way.