We install security cameras for shops, offices, and warehouses across southern Ontario, and one question comes up on almost every commercial quote: "Are we actually allowed to record people?" The short answer is yes, with conditions. The longer answer involves PIPEDA, Canada's federal privacy law for private-sector businesses, and it is worth understanding before the cameras go up.
One thing first: we are installers, not lawyers. What follows is the plain-language version of the rules as we apply them on jobs. If your situation is complicated (unionized staff, medical settings, landlord-tenant disputes), talk to a lawyer who does privacy work.
Why PIPEDA applies to your cameras
PIPEDA governs how businesses collect, use, and disclose personal information in the course of commercial activity. Video of an identifiable person is personal information. That means a camera pointed at your till, your stockroom, or your parking lot is collecting personal information about every customer and employee who walks through the frame.
That does not make cameras illegal. It makes them regulated. The law asks a few reasonable things of you: have a real purpose, tell people, collect no more than you need, protect what you collect, and get rid of it when the purpose is served.
Most businesses we work with are closer to compliant than they think. The gaps are usually signage, retention, and nobody being able to answer "why is that camera there?"
Have a purpose you can say out loud
Every camera should have a reason that a reasonable person would accept: deterring theft, documenting incidents at entrances, protecting staff who close alone, monitoring loading docks. Write those purposes down, even if it is one paragraph in a binder.
What does not pass the reasonableness test: cameras in washrooms or change rooms, cameras whose real purpose is continuous performance monitoring of staff without their knowledge, or audio recording (audio raises much sharper legal problems in workplaces, and we generally recommend leaving microphones disabled on commercial installs).
Camera placement should follow the purpose. If the purpose is protecting the entrance, the camera covers the entrance, not the neighbouring patio. We wrote about placement fundamentals in our camera placement guide, and the same thinking applies here with a privacy layer on top: aim at what you need, and only what you need.
Signage: tell people before they are recorded
Under PIPEDA, people should know they are being recorded before or at the point of collection. In practice that means clear signs at every public entrance, visible before someone enters the monitored area, stating that video surveillance is in use and, ideally, naming who to contact with questions.
For staff, signage alone is thin. Tell employees directly, in writing, that cameras are in use, where they generally are, and why. A short policy in the employee handbook does the job. Surprising your staff with cameras is both a legal risk and a morale problem, and the morale problem usually costs more.
Retention: keep less than you think
There is no single legislated number of days, but the principle is clear: keep footage only as long as your purpose requires, then destroy it. For most retail and office settings we see retention set between two weeks and one month. If nothing happened, old footage is pure liability, and storage limits are a feature here, not a bug.
Two exceptions. If footage captures an incident (a theft, an injury, a dispute), preserve that clip separately, because it now serves an active purpose and may be needed later. And if you receive a legal request or know litigation is coming, do not delete anything relevant.
Access matters as much as retention. Footage should live on a system with individual accounts, not a shared password taped to the recorder, and only people with a genuine need should be able to review it.
When someone asks for footage
People have a right under PIPEDA to ask what personal information you hold about them, and that includes video. If a customer or employee makes a request, you generally have to respond within thirty days. The wrinkle is that footage of them usually includes other people, whose privacy you also have to protect, so you may need to blur or mask other individuals before releasing anything.
Police requests are their own category. You can voluntarily share footage in some circumstances, and you must when presented with a warrant or court order. Our practical advice: designate one person to handle all footage requests, log every request and every disclosure, and never let footage wander out the door on someone's phone.
Getting the technical side right
A compliant camera system is mostly a well-designed camera system. Sensible placement, privacy masking on zones that overlook neighbouring property, retention configured to your written policy, individual user accounts, and recordings stored on hardware you control. These are design decisions, and they are much easier to make before installation than after.
We design and install commercial camera systems with these requirements built in from the first site visit. If you are adding cameras to your business or wondering whether your current setup would survive a hard look, talk to us about a camera installation and we will walk the site with you.
Cabling, networks, cameras, access control, smart homes, hosting and software for homes and small business across Southwestern Ontario. Twenty-plus years in the trade, and we still answer the phone.