Employers: Canada's Five Step Test for Workplace Video Surveillance
Yes, employers can use workplace video surveillance in Canada, but only when they have a lawful, documented purpose and safeguards that make the collection necessary and proportionate under federal or provincial privacy laws. Video of identifiable people counts as personal information, so employers must give notice, consider less invasive options first, and limit retention and access to what the stated purpose requires.
TL;DR:
Employers must demonstrate a real, documented problem and consider less intrusive solutions before installing surveillance cameras.
Signage, purpose limitation, and secure access controls are essential to maintain compliance and avoid privacy breaches.
Covert surveillance and audio recording are only justified in narrowly defined, documented circumstances, and AI features require separate governance and assessments.
Jurisdictional differences include Quebec’s mandatory privacy impact assessments for system overhauls and British Columbia and Alberta’s permissive data collection with proportional notice requirements.
Regulatory cases emphasize the importance of documenting purpose, testing effectiveness, and avoiding scope creep or repurposing footage without disclosure.
NetFusion Designs Inc
Strengthen Your IT Security Foundations
NetFusion Designs helps Canadian businesses manage security, compliance, monitoring, cloud, and Microsoft 365 with enterprise-grade tools.
Which laws and regulators govern workplace video surveillance in Canada
There is no single national statute that covers every camera in every workplace. Which law applies depends on who employs you and where you operate.
Federally regulated employers, think banks, telecommunications companies and interprovincial transportation, fall under PIPEDA. Most other private businesses answer to provincial statutes instead: British Columbia and Alberta each have their own Personal Information Protection Act, while Quebec governs private-sector information, including filmed images, through its own Act respecting the protection of personal information in the private sector. Public bodies, including municipalities and school boards, answer to freedom of information statutes such as Ontario’s FIPPA and MFIPPA, and Ontario’s public sector has seen recent legislative attention worth monitoring.
Before installing or auditing a camera system, check which regulator’s guidance applies to your organization:
The Office of the Privacy Commissioner of Canada (OPC) for federally regulated employers and PIPEDA interpretation
The Office of the Information and Privacy Commissioner of British Columbia for PIPA matters in BC
Alberta’s Office of the Information and Privacy Commissioner for Alberta PIPA
Quebec’s Commission d’accès à l’information for the provincial private-sector Act
The Information and Privacy Commissioner of Ontario (IPC) for Ontario’s public-sector rules
Knowing which office has jurisdiction over your workplace saves time later, especially if a complaint or an audit ever lands on your desk.
When video surveillance is permitted: the regulator test
Regulators do not ask whether cameras would be convenient. They ask whether they are justified. The OPC’s guidelines for overt video surveillance set out a test that shows up, in one form or another, across every Canadian jurisdiction.
Identify a real, pressing problem, such as repeated theft, vandalism, or a documented safety hazard, not a vague sense that monitoring might help.
Show that cameras would actually be effective at addressing that problem, rather than assumed to work.
Confirm that no less intrusive option, better lighting, access controls, or a supervisor walkthrough, could solve the problem instead.
Limit the collection, in scope, location and duration, to what the identified purpose actually requires.
Write down the assessment: the problem, the alternatives considered, and why cameras were chosen.
That last step matters more than most employers expect. A regulator reviewing a complaint will ask for the documentation, not just the explanation you give after the fact.
Practical compliance steps employers must take
Passing the necessity test is only half the job. Employers also need operational controls that keep the program defensible day to day.
Draft and publish a written video-surveillance policy that states the purpose, who can access footage, how long it is kept, and who to contact with questions.
Post meaningful signage at entrances and near monitored areas, explaining why cameras are there and how to reach someone about access requests. A government privacy notice statement is a useful template to adapt.
Narrow each camera’s field of view to the area it needs to cover, and never point one into a washroom, change room, or other space with a high expectation of privacy.
Limit pan, tilt and zoom functions that could capture more than the stated purpose allows, and keep the total camera count proportionate to the problem you identified.
Set a retention period tied directly to your purpose, with secure storage, role-based access controls, and a clear process for preserving footage under a legal hold when an incident occurs.
Pro Tip:Review your signage wording the same day you review your retention schedule. A sign that just says “video surveillance in use” tends to fail the same notice test that an undocumented retention policy fails.
Our PIPEDA compliance checklist walks through these obligations in more detail if you are building a policy from scratch.
Special issues: audio, covert surveillance and AI-driven monitoring
A few features change the legal analysis entirely, and employers often underestimate this.
Audio recording raises the privacy risk sharply. Regulators have criticized continuous audio-video capture without strong justification, so most workplaces should disable audio unless there is a specific, documented reason to include it.
Covert surveillance is only defensible in narrow circumstances, typically a specific, serious suspicion, such as ongoing theft, where overt cameras would defeat the purpose, and even then it needs its own documented justification and a defined end date.
Facial recognition, behavioural analytics and employee-scoring tools are not just “cameras with extra features.” They need their own governance, their own privacy impact assessment, and data minimization rules separate from standard video retention.
Treat any analytics layer as a new privacy program, not an add-on to your existing camera policy.
Provincial highlights and special rules
Employers operating across more than one province need to track a few jurisdictional differences.
Quebec’s private-sector Act covers filmed information directly, and projects that involve acquiring or overhauling an information system handling personal data, including cloud-hosted camera platforms, often trigger a mandatory privacy impact assessment before procurement.
British Columbia and Alberta’s private-sector PIPAs permit certain employee data collection without consent, but both still demand meaningful notice and a proportionate scope, as BC’s Order P20-04 involving Teck makes clear.
Ontario’s public-sector landscape has seen recent legislative changes that may affect guidance for municipalities and school boards, so public bodies should watch for updated IPC commentary, as the landscape evolves.
If you operate in Quebec, build the PIA into your procurement timeline rather than treating it as paperwork after the cameras are installed.
Regulatory enforcement and case examples employers should learn from
Real cases show where employers typically go wrong.
In settled case #2015-001, the OPC found that a PIPEDA-covered employer had to inform staff of the surveillance, publish a policy, and tie access and retention to the stated purpose, not just install cameras and move on.
In Order P20-04, BC’s Information and Privacy Commissioner found that Teck’s signage and scope fell short of meaningful notice, and that continuous monitoring during working hours exceeded what was reasonable for the stated purpose.
The practical lesson from both: document your purpose before you install anything, test whether the cameras are actually solving the problem, and never repurpose footage for something you did not originally disclose.
Implementation checklist: what to do next
A compliance review does not need to take months. Here is a starting sequence.
Conduct a documented necessity assessment and record the less intrusive alternatives you considered.
Draft or update your surveillance policy, post meaningful signage, and notify any unions with a right to be consulted.
Narrow camera fields of view, disable audio unless justified, and set a retention period tied to the stated purpose.
Run a privacy impact assessment where required, particularly in Quebec or for analytics features, and set up access logging and staff training.
Pro Tip:Build the PIA and the retention schedule at the same time. Treating them as separate projects is the most common reason employers end up revising both twice.
Balancing safety, liability and employee trust
We see the strongest surveillance programs pair clear governance with managed hardware and secure storage, not cameras bolted on without a policy behind them. A secure environment with continuous monitoring can give that governance something to run on.
— Geeshan
How NetFusion Designs can help with compliant surveillance
We help businesses turn a camera project into a defensible compliance program, not just a hardware purchase. Our team manages the policy, storage, access controls and monitoring side so your footage stays secure and tied to a documented purpose.
Next-generation IP cameras and secure, access-controlled storage built around your retention policy
Continuous monitoring through a network operations center, backed by managed cybersecurity and compliant processes
If you are planning a new deployment or auditing an existing one, start with a review of our managed IT services or reach out about our security camera solutions to see how a governed system comes together.
FAQ
What are the legal restrictions on video surveillance in Canada?
Employers need a legitimate, documented purpose, and the collection must be necessary and proportionate under PIPEDA or the applicable provincial statute. Notice through policy and signage is required, and cameras cannot cover areas with a high expectation of privacy, such as washrooms or change rooms.
Can my boss watch me on camera at work?
Yes, but only where the employer has identified a real workplace problem, considered less intrusive alternatives, and limited the cameras’ scope to that purpose. Continuous monitoring during working hours without a clear justification has been found unreasonable in cases like BC’s Order P20-04.
What is the law on CCTV cameras?
There is no single CCTV-specific statute in Canada. Instead, federal PIPEDA or provincial private-sector laws in British Columbia, Alberta and Quebec treat footage of identifiable people as personal information, requiring purpose limitation, notice and secure handling.
What makes surveillance illegal?
Surveillance becomes unlawful when it lacks a documented, legitimate purpose, when less intrusive alternatives were not considered, or when notice and signage fail to explain why cameras are there, as found in settled case #2015-001. Recording in high-privacy areas like washrooms is prohibited regardless of purpose.
%20(1).avif){kind=logo}
%201.avif)
