AutowriteVisit Website →
← Back to blog

Privacy Consent Wording for Canadian Mortgage Brokers

October 26, 2026
Privacy Consent Wording for Canadian Mortgage Brokers

Good privacy consent wording tells the client, in plain language and before you act, what personal information you collect, who receives it and why, what choices they have, and how to withdraw. For a mortgage broker, that means naming the credit bureau pull, the lender submissions and any extra uses such as marketing, then recording the client's agreement before any of it happens. A general privacy policy on your website does not do that job.

This guide walks through what the Office of the Privacy Commissioner of Canada (OPC) expects, shows sample wording you can adapt, and covers the timing and record-keeping mistakes that cause trouble in audits.

Autowrite
Spend Less Time on Mortgage Paperwork
Autowrite streamlines mortgage document intake, classification and data extraction, helping Canadian brokers spend less time on paperwork and more time with clients.
Explore Autowrite

TL;DR

  • Consent is valid only when the client can reasonably understand what they are agreeing to, including the nature, purpose and consequences of the collection, use and disclosure.
  • Name the information, the purposes and the recipients (lenders, credit bureaus, service providers) as specifically as you can. A vague reference to "third parties" may not be enough.
  • Get express consent before pulling a credit report or sending personal information to a lender, and record it before the activity happens.
  • Keep marketing and other non-essential uses as a separate, opt-in choice, and tell clients how to withdraw.
  • A privacy policy is not a substitute for a clear consent request placed where the client signs.

Table of Contents

The OPC describes consent as the individual knowing about and agreeing to the collection, use and disclosure of their personal information for specified purposes, with a reasonable understanding of the nature, purpose and consequences of what they are agreeing to. The test is understanding, not a signature alone.

The OPC's guidelines on meaningful consent reinforce this: consent is not valid merely because a privacy policy exists. The client must be able to understand what is happening to their information.

In mortgage work, the stakes are real. You collect identification, employment and income records, bank statements and often a Social Insurance Number (SIN). The OPC says income records are almost always sensitive, which pushes you toward clear, express consent.

Which law applies in your province

The federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies to commercial activity, except in provinces that have their own private-sector privacy laws. It still applies to federally regulated organizations and to interprovincial and international transactions.

That matters if you work in Ontario, British Columbia, Alberta or Quebec, or if you submit files across provincial lines. Some provinces have their own statutes, and a file that crosses a border can bring PIPEDA into play. Confirm with your regulator, your brokerage's compliance officer or legal counsel which statute governs your files, and write your wording to the stricter standard if you are unsure. The OPC's meaningful consent guidelines are a sound baseline for the whole country.

If you work in Quebec, also have your wording reviewed for French-language and provincial requirements before you use it with clients.

Which law applies in your province — overview diagram

The OPC's guidelines point to a handful of elements. A mortgage consent request should cover each of them.

Five elements of a mortgage consent request

1. The information collected

Identify what you are collecting with enough precision that the client knows what they are handing over. The request should identify the personal information and the purposes for which it is collected, used or disclosed.

The OPC's audit of selected mortgage brokers lists typical items: identification documents, SINs, CRA T4 slips and bank statements. The same audit says a SIN is not required for a credit check and should not be used as a general identifier. If you ask for a SIN, say specifically why, or leave it out.

2. The purposes

State why you need each category. Separate the purposes that are integral to the service (assessing the application, submitting it to lenders) from those that are not (newsletters, referral requests, product offers). The OPC asks organizations to distinguish integral purposes from others and explain available options.

3. The recipients

Tell clients which types of information go to third parties, and name the parties as specifically as practicable. The OPC says a generic reference to third parties may be inadequate.

For a broker, the natural groups are:

  • lenders and insurers to whom you submit the application
  • credit reporting agencies
  • appraisers or other service providers who help you complete the file
  • your brokerage, and any assistant or software provider who handles the file on your behalf

You do not have to list every lender in advance if you do not know them yet. You can say that you will submit the file to lenders you and the client agree on, and confirm each name as the file progresses.

4. The risks and consequences

The OPC expects organizations to explain reasonably foreseeable risks and consequences, including relevant risks from sharing information with third parties. In mortgage terms, this includes the fact that a credit enquiry appears on the client's credit file and that each lender will hold the information under its own privacy practices.

5. The choices and how to withdraw

Give a clear choice for any use or disclosure that is not necessary to provide the service. Allow withdrawal of consent, subject to legal or contractual limits, and say so. You may need to explain, for example, that you cannot continue the application without the information needed to assess it, and that records you must keep by law stay on file.

The OPC's 2021 findings add a practical point: withdrawal information should stay available after the original transaction and include contact details, because a person may no longer have the original form. Put a privacy contact in your email footer and on your website, not only on the signed page.

The OPC says express consent should generally be obtained for sensitive information, uses outside a person's reasonable expectations, or activity that creates a meaningful residual risk of significant harm. Implied consent is reserved for strictly defined circumstances.

For mortgage brokers the mortgage audit is more specific. The OPC says brokers should obtain express and meaningful consent before obtaining credit reports or providing personal information to potential lenders, and should record that consent before the activity occurs.

A simple working rule:

ActivityApproach
Credit report pullExpress consent, recorded first
Sending the file to lendersExpress consent, recorded first
Collecting income and bank recordsExpress consent, with purposes stated
Marketing, newsletters, referral requestsSeparate opt-in, never bundled
Sharing with other service providersName the type of provider and the purpose

The OPC audit also says that disclosures to credit-reporting agencies and lenders may be necessary to obtain a mortgage, but any additional use such as marketing must be clearly stated in the application and consent form and requires express opt-in consent.

The samples below are starting points built from the OPC's expectations, not legal advice. Have your brokerage's compliance lead or counsel review them against the law that applies to your files, and adjust the names, provinces and recipients to match your practice.

What we collect. To assess your mortgage application, [Broker Name] and [Brokerage Name] collect your identification, employment and income records (such as pay stubs and CRA tax slips), bank statements, details about your down payment, and your credit information.

Why. We use this information to verify your identity, assess what you can qualify for, prepare your application and submit it to lenders.

Who receives it. With your permission, we will obtain your credit report from [credit reporting agency names] and send your application and supporting documents to the lenders and insurers we agree with you. We will tell you which lenders before we submit. Our software and document service providers handle your file only on our behalf and for this purpose.

What to know. A credit enquiry will appear on your credit file. Each lender and insurer will also hold your information under its own privacy practices.

Your choices. You can say no or withdraw your consent at any time by contacting [privacy contact, email, phone]. If you withdraw, we may not be able to continue your application. We must keep some records to meet legal requirements.

☐ I have read the above and consent to the collection, use and disclosure of my personal information for these purposes.

Notice what it does. The key points come first, in short sentences, and the client ticks a box for something they have just read, not something buried in a document.

Separate marketing opt-in

☐ I would also like to receive occasional rate updates and mortgage information from [Broker Name] by email. I can unsubscribe at any time by contacting [privacy contact].

Leave this box unticked by default and keep it apart from the core consent. Declining must not affect the mortgage service.

SIN, if you truly need it

We ask for your SIN only when [specific reason, for example, a lender requires it to complete a particular step]. You do not need to provide it for us to obtain your credit report.

The audit finding on SINs is the reason for that last sentence: a SIN is not required for a credit check.

Mistakes that fail in practice

Relying on the privacy policy

A website policy is not a consent request. The OPC's guidance says key information about collection, sharing and purposes should be brought to the individual's attention up front, and that a privacy policy or terms of use is not a substitute.

Hiding the real sharing

In its 2021 findings, the OPC found consent inadequate where a notice did not explain that specific information and the fact of participation would be shared with third parties, even though a separate insert existed. The case did not involve a mortgage broker, but the lesson transfers: an opt-out, however visible, does not rescue a notice that has not first said what is shared, with whom and why.

Getting the order wrong

The practical failure in the mortgage audit is often timing and documentation. Brokers obtained credit reports before consent was recorded, or could not produce a consent record. The wording can be perfect and still fail if the client agreed after the pull, or if you cannot show when they agreed.

Collecting more than you need

The same audit says brokers should limit collection to what is necessary, restrict use and disclosure to the identified purposes, and retain information only as long as necessary. Consent wording that promises a narrow purpose is worth little if your file practices go further.

The OPC says consent may be collected through a signed application, a check box, oral consent or use of a service, but the method must make it reasonable to expect that the individual understands the nature, purpose and consequences. Whatever method you use, plan to be able to demonstrate it.

A workable record includes:

  1. the exact version of the wording the client saw
  2. the date and time of agreement, before the first credit pull or lender submission
  3. the method (e-signature, check box, recorded verbal consent with a file note)
  4. any optional choices the client accepted or declined
  5. any later withdrawal, with the date and what you did in response

If you take verbal consent, write a file note straight away and confirm in writing by email. Keep your retention periods consistent with your other obligations: our guide to FINTRAC and FSRA record retention on mortgage files covers how those timelines differ. For the wider picture of audit preparation, see our PIPEDA checklists for mortgage brokers and our piece on keeping digital compliance records.

Identity verification is a separate obligation from privacy consent, but the two meet at intake. Our overview of the five FINTRAC client identification methods helps you decide what you must collect, so your consent wording only names what you actually need.

If client documents pass through a document service or CRM, the client should reasonably expect that from your wording, and you remain responsible for how your providers handle the information. Check where data is stored and who can see it. Our guide on privacy controls for mortgage data syncing lists the controls to look for before you connect tools to client files.

Autowrite is an AI-powered operating system built for Canadian mortgage brokers. It handles document intake, classification and data extraction, auto-fills underwriting forms, syncs with mortgage software, assembles e-sign and compliance packages, and supports Canadian data residency. Having the file, the signed packages and the compliance documents in one place makes it easier to show what the client agreed to and when.

Plans are Starter at $99 per month, Pro at $199 per month and Legend at $399 per month, with Enterprise available on request, and each paid plan includes a 14-day free trial. Additional deals cost $20 each, and pay as you go is $35 per deal. See the Autowrite plans and pricing to compare them.

Our perspective

Brokers rarely get into trouble because they never thought about privacy. They get into trouble because the consent sits in one place, the credit pull happens in another, and the proof lives in someone's inbox. Wording is the easy part. Sequence and evidence are where files fall apart.

We build Autowrite around that gap. When intake, classification, signed packages and compliance records sit in one workflow on Canadian data residency, the question "what did the client agree to, and when?" becomes a lookup instead of a hunt. We would rather a broker spend ten minutes writing clear, specific consent language once than hours reconstructing it during an audit.

Our advice: write the wording as if the client will read only the first three lines, name your recipients, keep marketing separate, and never touch a credit report until the record exists.

— Anant Bawa

FAQ

No. The OPC says a privacy policy or terms of use does not replace a prominent, specific consent request. Put the key points where the client signs or ticks the box, and link to the full policy for detail.

Yes, as a safe practice. The OPC's mortgage-broker audit says brokers should obtain express and meaningful consent before obtaining credit reports or giving personal information to potential lenders, and should record it first.

Yes, subject to legal or contractual restrictions. Tell clients how to withdraw and give a contact that stays valid after the transaction. Explain that withdrawal may stop the application and that some records must be kept by law.

Name them as specifically as is practicable. If the lenders are not yet known, state the type of recipient, then confirm each lender with the client before you submit the file. A generic mention of third parties may fall short.

Can I use the client's information to send marketing?

Only with a separate, clearly stated opt-in. The OPC says uses beyond what is needed to obtain the mortgage, such as marketing, must be stated in the application and consent form and need express opt-in consent.

Sources