Video of an identifiable person is personal information under Canadian privacy law. That single fact drives everything else: a business camera system is not just a technical project, it is a collection of personal information that the client is legally accountable for. Installers who understand the rules protect their clients and win work from those who do not.
Which law applies
PIPEDA is the federal private-sector privacy law and covers most businesses recording video in the course of commercial activity. Alberta, British Columbia, and Quebec have their own private-sector laws that apply instead of PIPEDA inside those provinces, with Quebec’s Law 25 setting the strictest expectations in the country. Public bodies such as municipalities and school boards fall under separate public-sector statutes. The obligations rhyme across all of them, so the practices below hold up anywhere in Canada.
The test before the cameras go in
The Privacy Commissioner’s guidelines expect an organization to justify surveillance before deploying it, not after a complaint. The questions come from case law and are worth walking a client through in plain terms: is there a real, demonstrated problem the cameras address, will cameras actually help, is the privacy loss proportional to the benefit, and is there a less invasive way to get the same result. A client who can answer those four questions has a defensible system. A client who bought cameras because they were cheap does not.
Notice and signage
People must be told they are being recorded before they enter the monitored area. In practice that means clear signage at every entrance to the surveilled space stating that video surveillance is in use, who is operating it, and who to contact with questions. Hidden or unmarked recording of customers or the public is treated as covert surveillance, which the Commissioner considers justifiable only in narrow, documented, last-resort circumstances such as an active investigation. Advise clients to treat covert recording as legal-counsel territory, not an installer decision.
Aim the cameras at the problem
Collection must be limited to what the stated purpose needs. Cameras covering a loading dock are easy to defend. Cameras sweeping a neighbour’s property, a public sidewalk, staff break rooms, or change areas are not. Use privacy masking to blank areas the client has no business recording, and document the field of view of each camera at commissioning. Audio deserves special caution: recording conversations raises separate legal exposure under both privacy law and the Criminal Code, and most commercial systems should ship with microphones disabled.
Retention, access, and security
Footage should be kept only as long as the purpose requires, then overwritten. Many commercial systems settle between 14 and 90 days, and the number should be a decision, not whatever the recorder defaulted to. Two more obligations surprise clients. First, individuals have a right to request footage of themselves, so the operator needs a way to find and export it, and to mask other people in the frame. Second, if footage is used to make a decision about someone, such as a dismissal, it must be retained long enough for that person to exercise their access rights. Secure the system itself: unique accounts, no shared logins, exported clips logged, and the recorder off the open internet. Our network hardening guide covers the technical side, and if the footage lives in the cloud, data residency matters too.
What installers should build into every quote
Signage at monitored entrances, privacy masking configured and documented, audio off by default, a written retention setting, named user accounts, and a one-page handover note telling the client who is responsible for access requests. None of this costs meaningful money at install time, and all of it is expensive to retrofit after a complaint. If a project involves workplaces in Quebec, unionized sites, or any covert element, recommend the client get privacy advice before the first camera is mounted. Firms in our consultants directory handle exactly this.
References
Last updated 2026-07-24.