Workplace Privacy and Employee Monitoring Laws in Canada: What Employers Need to Know

As of February 2026, the Personal Information Protection and Electronic Documents Act (PIPEDA) remains the primary federal private-sector privacy law in Canada. That matters because the much-discussed Bill C-27, the Digital Charter Implementation Act, 2022, did not become law. It died on the Order Paper when Parliament was prorogued in January 2025 and was not revived before the 2025 federal election. As a result, employers should continue to treat PIPEDA as the governing federal framework unless and until new legislation is enacted. Under PIPEDA, federally regulated private-sector employers must follow the fair information principles when collecting, using, or disclosing employee personal information. In the context of workplace monitoring, the Office of the Privacy Commissioner of Canada has consistently emphasized three themes: Monitoring must be reasonable and proportionate to a legitimate business purpose, Employers should collect only the minimum information necessary, and Employees must receive clear notice about monitoring practices. The OPC’s more recent guidance also recommends that employers conduct privacy impact assessments before introducing new monitoring tools, evaluate less intrusive alternatives, and avoid blanket waivers of privacy rights as a condition of employment. PIPEDA’s breach-notification rules, in force since 2018, also require organizations to report certain privacy breaches involving a real risk of significant harm. Canada’s privacy framework is not uniform. Three provinces have private-sector privacy statutes deemed substantially similar to PIPEDA: British Columbia: Personal Information Protection Act (PIPA) Alberta: Personal Information Protection Act (PIPA) Quebec: Act respecting the protection of personal information in the private sector, as amended by Law 25 Quebec now has the strictest private-sector privacy regime in Canada. Law 25 requires stronger consent practices for sensitive personal information, mandatory privacy impact assessments in many cases, transparency around automated decision-making, and broader rights relating to deletion and portability. Administrative monetary penalties can reach up to $25 million CAD or 4% of worldwide turnover , whichever is greater. Ontario’s electronic monitoring rule is not PIPEDA Ontario does not have a general private-sector privacy statute comparable to PIPEDA, Alberta PIPA, or BC PIPA. However, Ontario does have a specific employment-law rule on monitoring. Effective October 11, 2022, amendments to the Employment Standards Act, 2000 require Ontario employers with 25 or more employees to maintain a written electronic monitoring policy. The policy must describe whether and how employees are electronically monitored, the circumstances in which monitoring occurs, and the purposes for which the information may be used. That is an ESA disclosure requirement, not a PIPEDA rule. It does not prohibit monitoring itself. It requires transparency. 2026 trend — AI transparency: If software is used to track keystrokes, active time, or generate productivity scores, this must be disclosed in the Electronic Monitoring Policy. Employers should clearly describe the purpose and scope of any AI-driven monitoring tools used in the workplace. Canadian privacy law does not ban all workplace monitoring, but it does require restraint. Video surveillance Covert video surveillance is generally justifiable only in exceptional circumstances, such as documented serious misconduct where less intrusive measures have failed. Overt cameras Cameras in washrooms, change rooms, or other highly private spaces are generally indefensible. GPS and location tracking GPS tracking may be justified for fleet management, safety, dispatch, or time verification for mobile workers. But the tracking should be limited to working time where possible, employees must be informed, and the collected data must be proportionate to the stated purpose. Tracking outside working hours or on personal vehicles raises significant compliance concerns. Email and computer monitoring Employers usually have greater latitude to monitor employer-owned devices and networks, especially where employees have been given clear notice through acceptable-use or monitoring policies. Even so, indiscriminate or continuous surveillance is harder to justify than targeted monitoring in response to a specific concern. Under Quebec’s Law 25, automated profiling and decision-making also create additional transparency obligations. Across all forms of monitoring, the central question remains the same: is the monitoring necessary, proportionate, and the least intrusive available option? Under PIPEDA, enforcement is still largely complaint-driven. Individuals may complain to the Office of the Privacy Commissioner of Canada, which can investigate and issue findings and recommendations. In some circumstances, matters can proceed to Federal Court . PIPEDA itself does not currently impose the kind of administrative moneta