Photos can add useful context to a report, but organizations should collect only what is needed for a defined purpose and protect personal information appropriately.
At a glance
- Security work often involves personal information, and Ontario training addresses collection, storage, dissemination and destruction.
- Privacy guidance emphasizes purpose limitation and reasonable safeguards.
- A photo should support a legitimate reporting need rather than become routine collection without a reason.
What this means in practice
The official rules establish a baseline, but a workable security assignment still needs property-specific decisions. The client and provider should turn general requirements into clear instructions about what is checked, who can authorize exceptions, what must be documented and when another authority takes over.
Questions to confirm
- What is the photo intended to document?
- Does it capture people or information unrelated to the incident?
- Where will the image be stored and who can access it?
Picture this at your property
A guard photographs a damaged gate. The frame also captures a resident’s licence plate and face. The organization should consider whether the wider image is necessary and how the file will be protected.
The value of the example is the decision process: identify what is known, what remains uncertain, who has authority, and what information should be preserved for follow-up.
Practical takeaway
The strongest security process is usually the one that makes responsibilities, observations and escalation clear. That creates a service that can be understood and reviewed without overstating what security can guarantee.
Official sources & verification
1. Privacy Guide for Businesses — Office of the Privacy Commissioner of Canada
2. Section 8: Legal authorities — Government of Ontario
3. Section 4: Report writing — Government of Ontario
Last reviewed: 2026-08-08. This resource provides general information and is not privacy or legal advice. Privacy obligations depend on the organization, activity and applicable law. Confirm current requirements with the appropriate privacy regulator or qualified legal counsel.