Most Ontario business owners install security cameras and never think twice about the legal framework. That's fine until something goes wrong — a theft investigation that can't be used as evidence, an employee complaint to the Privacy Commissioner, or a civil suit from a customer who spotted a camera in a location where they had a reasonable expectation of privacy.
Canada's federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), governs how private-sector organizations collect, use, and disclose personal information — including surveillance footage. Ontario doesn't have its own private-sector privacy legislation, so PIPEDA applies to Ontario businesses that operate across provincial borders or handle personal information in the course of commercial activity.
Here's what PIPEDA requires in plain language, specifically for commercial security camera use.
The Core Principle: Legitimate Purpose
PIPEDA's first requirement is that you have a legitimate business purpose for collecting video surveillance data. This is a meaningful standard, not a rubber stamp. You need to be able to articulate why cameras are necessary — preventing theft, ensuring workplace safety, protecting assets — and the coverage you deploy must be proportionate to that purpose.
Cameras in every corner of a small office with no history of theft and no legitimate security need would likely fail this standard. Cameras covering a loading dock where inventory goes missing would easily satisfy it.
Where Cameras Are Permitted
Public-facing areas of your business. Sales floors, lobbies, reception areas, entrances, and checkout counters are all appropriate camera locations. These are areas where individuals do not have a reasonable expectation of privacy and where there is a clear business rationale for monitoring.
Entrances and exits. Every entry and exit point is appropriate — this is standard practice for access verification and is legally unproblematic provided signage is posted.
Parking lots and exterior grounds. Outdoor camera coverage of your property is permitted. This includes perimeter cameras, yard coverage, and gate approaches.
Cash handling areas. Cameras covering cash registers, ATMs, and payment terminals are standard and expected in commercial environments.
Loading docks and receiving areas. Coverage of dock doors, staging areas, and receiving operations is appropriate given the loss prevention rationale.
Stockrooms and back-of-house areas. Internal inventory areas are permissible provided employees are informed that cameras are in use in those areas.
Where Cameras Are Prohibited
Washrooms. No exceptions. A camera in any washroom — regardless of how it's framed or what business rationale is offered — violates PIPEDA and constitutes a criminal offence under the Criminal Code of Canada (voyeurism provisions, s. 162). This applies to single-occupant washrooms as well.
Change rooms and locker areas. Same prohibition. Employees and customers have an absolute expectation of privacy in spaces where they undress. There is no business rationale that makes cameras in these areas legal.
Offices or spaces where employees have a reasonable expectation of privacy. Cameras in private offices where only one employee works, or in break rooms where private conversations occur, are more nuanced. These require stronger justification and are more likely to draw employee complaints or Privacy Commissioner scrutiny. If you have a legitimate reason to monitor a private office, get legal advice first.
Signage Requirements
PIPEDA doesn't specify exact signage language, but the Office of the Privacy Commissioner (OPC) has published clear guidance: individuals must be informed that they are being recorded before they enter a monitored area. In practice, this means:
- A visible notice at every entrance to your monitored premises
- The notice should state that security cameras are in use
- It should identify who is responsible (your company name or contact)
- It should provide a way to get more information (phone number or website)
A sign that says "This property is monitored by video surveillance for security purposes. [Company Name] — (phone)" meets the standard. The sign doesn't need to be large, but it must be placed where people can see it before they enter the monitored area — not inside it.
Employee Monitoring: What You Must Disclose
If cameras are used in areas where employees work, PIPEDA requires meaningful disclosure — not just that cameras exist, but the purpose, what footage is recorded and retained, who has access to it, and how long it's kept. This disclosure should be in writing, acknowledged by employees.
Best practice is a short camera policy (one or two pages) included in your employee handbook or onboarding documentation. It should cover:
- Where cameras are located — general description of monitored areas, not necessarily exact positions
- Why footage is collected — loss prevention, safety, access verification
- Who can access footage — manager, owner, security personnel; not general staff
- Retention period — typically 30–90 days for commercial systems
- When footage might be reviewed — routine review, incident investigation, or law enforcement request
You don't need to give employees a camera map. You do need to give them enough information to understand they're being monitored and why.
Customer-Facing Cameras
For cameras that capture customers rather than employees, signage is the primary compliance mechanism. Customers don't require advance individual disclosure beyond the entrance notices. However, footage of identifiable individuals is personal information under PIPEDA, which means:
- You can only use it for the purpose it was collected (security/loss prevention)
- You can't share it with third parties without consent, except in specific circumstances (law enforcement with proper legal authority, or imminent safety threat)
- You must retain it only as long as necessary and dispose of it securely
Practical Compliance Checklist
Before your next camera installation:
- Post signage at all entrances to monitored areas — before the camera zone, not inside it
- Document your purpose in writing — one paragraph explaining the legitimate business rationale for each monitored area
- Create a written camera policy and include it in employee onboarding
- Define your retention period and configure your NVR accordingly — 30–60 days is standard for most commercial properties
- Restrict access to footage — only designated personnel should have playback access
- Never install in washrooms or change rooms — no exceptions
- Review your policy annually — your camera coverage may change; your policy should stay current
If you receive a Privacy Commissioner complaint or a request to access surveillance footage from an individual, stop using the relevant footage for any other purpose and consult legal counsel before responding. The OPC has investigation and enforcement authority under PIPEDA, and non-compliance findings are published publicly.
The legal framework for commercial surveillance in Ontario is manageable — it's built around reasonable principles most business owners already agree with. The businesses that run into problems are usually those that installed cameras without thinking about these questions at all. A few hours of policy work upfront saves significant trouble later.
