Video that identifies people can be personal information. Businesses should define why surveillance is used and how footage is accessed, retained and disclosed.
At a glance
- Federal privacy guidance treats identifiable video surveillance as personal information in applicable private-sector contexts.
- Organizations should establish a business purpose before using surveillance.
- Access, retention and disclosure should be controlled and documented.
What this means in practice
The official rules establish a baseline, but a workable security assignment still needs property-specific decisions. The client and provider should turn general requirements into clear instructions about what is checked, who can authorize exceptions, what must be documented and when another authority takes over.
Questions to confirm
- What is the stated purpose of the cameras?
- Who is authorized to view footage?
- How long is footage retained and why?
Picture this at your property
A retailer installs cameras for security and later wants to use recordings to track unrelated customer behaviour. Privacy guidance emphasizes using surveillance for the stated purpose or another lawful basis.
The value of the example is the decision process: identify what is known, what remains uncertain, who has authority, and what information should be preserved for follow-up.
Practical takeaway
The strongest security process is usually the one that makes responsibilities, observations and escalation clear. That creates a service that can be understood and reviewed without overstating what security can guarantee.
Official sources & verification
1. Guidelines for Overt Video Surveillance in the Private Sector — Office of the Privacy Commissioner of Canada
2. Privacy Guide for Businesses — Office of the Privacy Commissioner of Canada
3. Section 8: Legal authorities — Government of Ontario
Last reviewed: 2026-08-08. This resource provides general information and is not privacy or legal advice. Privacy obligations depend on the organization, activity and applicable law. Confirm current requirements with the appropriate privacy regulator or qualified legal counsel.