Security systems are personal-information machines. Cameras capture identifiable faces, access control logs who went where and when, visitor systems record names and plates. PIPEDA is the federal law that governs all of it in the private sector, and the security trade touches it on nearly every project.
The shape of the law
PIPEDA applies to organizations collecting, using, or disclosing personal information in the course of commercial activity, across Canada except where a province has its own substantially similar private-sector law (Alberta, British Columbia, and Quebec do; their laws apply instead inside those provinces). The law is built on ten fair information principles rather than prescriptive rules: accountability, identifying purposes, consent, limiting collection, limiting use and retention, accuracy, safeguards, openness, individual access, and challenging compliance. Every obligation that matters to a security operator is one of those principles applied.
What the principles mean for security systems
Purpose and proportionality. The organization must be able to say why it collects what it collects, and the collection must be limited to that purpose. For surveillance, the Commissioner’s guidance expects a real problem, a reasonable expectation that the system addresses it, and consideration of less invasive alternatives before deployment.
Notice. People are entitled to know collection is happening. For cameras that means signage; for access and visitor systems it means policies employees and visitors can actually find.
Retention and safeguards. Keep recordings and logs only as long as the purpose requires, then dispose of them, and protect them while you hold them: access controls on the VMS, named accounts, exports logged, systems patched and off the open internet.
Access rights. Individuals can request the personal information an organization holds about them, including video of themselves and their own access records, and the operator needs a workable way to retrieve, redact, and provide it.
Where the trade meets the law
Installers are not usually the accountable organization; their clients are. But the installer builds the system the client must be accountable with, which makes privacy-competent design a service: masking configured, retention set deliberately, audio disabled unless justified, signage discussed at handover. Our PIPEDA and video surveillance guide covers the camera-specific rules in depth, and data residency matters as soon as footage leaves for a cloud.
What trips people up
Assuming employee monitoring is exempt (it is not; workplace surveillance has its own case law and, in federally regulated workplaces, direct PIPEDA exposure). Treating consent as a formality while collecting far beyond the stated purpose. And Quebec: Law 25’s requirements, including privacy impact assessments in more circumstances and meaningfully larger penalties, exceed PIPEDA, so national operators should design to the strictest province they operate in.
Related guides
References
Last updated 2026-07-24.