Workplace Privacy and Employee Monitoring Laws in Canada: What Employers Need to Know

As of February 2026, the Personal Information Protection and Electronic Documents Act (PIPEDA), enacted in 2000, remains the primary federal private-sector privacy law in Canada.

Canada’s Federal Privacy Framework: PIPEDA Still Governs

As of February 2026, the Personal Information Protection and Electronic Documents Act (PIPEDA) remains the primary federal private-sector privacy law in Canada. That matters because the much-discussed Bill C-27, the Digital Charter Implementation Act, 2022, did not become law. It died on the Order Paper when Parliament was prorogued in January 2025 and was not revived before the 2025 federal election. As a result, employers should continue to treat PIPEDA as the governing federal framework unless and until new legislation is enacted.

Under PIPEDA, federally regulated private-sector employers must follow the fair information principles when collecting, using, or disclosing employee personal information. In the context of workplace monitoring, the Office of the Privacy Commissioner of Canada has consistently emphasized three themes:

Monitoring must be reasonable and proportionate to a legitimate business purpose,
Employers should collect only the minimum information necessary, and
Employees must receive clear notice about monitoring practices.

The OPC’s more recent guidance also recommends that employers conduct privacy impact assessments before introducing new monitoring tools, evaluate less intrusive alternatives, and avoid blanket waivers of privacy rights as a condition of employment. PIPEDA’s breach-notification rules, in force since 2018, also require organizations to report certain privacy breaches involving a real risk of significant harm.

Sources

https://www.priv.gc.ca/en/privacy-topics/employers-and-employees/

Provincial Privacy Landscape

Canada’s privacy framework is not uniform. Three provinces have private-sector privacy statutes deemed substantially similar to PIPEDA:

British Columbia: Personal Information Protection Act (PIPA)
Alberta: Personal Information Protection Act (PIPA)
Quebec: Act respecting the protection of personal information in the private sector, as amended by Law 25

Quebec now has the strictest private-sector privacy regime in Canada. Law 25 requires stronger consent practices for sensitive personal information, mandatory privacy impact assessments in many cases, transparency around automated decision-making, and broader rights relating to deletion and portability. Administrative monetary penalties can reach up to $25 million CAD or 4% of worldwide turnover, whichever is greater.

Ontario’s electronic monitoring rule is not PIPEDA

Ontario does not have a general private-sector privacy statute comparable to PIPEDA, Alberta PIPA, or BC PIPA. However, Ontario does have a specific employment-law rule on monitoring.

Effective October 11, 2022, amendments to the Employment Standards Act, 2000 require Ontario employers with 25 or more employees to maintain a written electronic monitoring policy. The policy must describe whether and how employees are electronically monitored, the circumstances in which monitoring occurs, and the purposes for which the information may be used.

That is an ESA disclosure requirement, not a PIPEDA rule. It does not prohibit monitoring itself. It requires transparency.

2026 trend — AI transparency: If software is used to track keystrokes, active time, or generate productivity scores, this must be disclosed in the Electronic Monitoring Policy. Employers should clearly describe the purpose and scope of any AI-driven monitoring tools used in the workplace.

Sources

Practical Rules for Surveillance and Tracking

Canadian privacy law does not ban all workplace monitoring, but it does require restraint.

Video surveillance

Covert video surveillance is generally justifiable only in exceptional circumstances, such as documented serious misconduct where less intrusive measures have failed. Overt cameras Cameras in washrooms, change rooms, or other highly private spaces are generally indefensible.

GPS and location tracking

GPS tracking may be justified for fleet management, safety, dispatch, or time verification for mobile workers. But the tracking should be limited to working time where possible, employees must be informed, and the collected data must be proportionate to the stated purpose. Tracking outside working hours or on personal vehicles raises significant compliance concerns.

Email and computer monitoring

Employers usually have greater latitude to monitor employer-owned devices and networks, especially where employees have been given clear notice through acceptable-use or monitoring policies. Even so, indiscriminate or continuous surveillance is harder to justify than targeted monitoring in response to a specific concern. Under Quebec’s Law 25, automated profiling and decision-making also create additional transparency obligations.

Across all forms of monitoring, the central question remains the same: is the monitoring necessary, proportionate, and the least intrusive available option?

Sources

Enforcement and Breach Notification

Under PIPEDA, enforcement is still largely complaint-driven. Individuals may complain to the Office of the Privacy Commissioner of Canada, which can investigate and issue findings and recommendations. In some circumstances, matters can proceed to Federal Court. PIPEDA itself does not currently impose the kind of administrative monetary penalties that Bill C-27 would have introduced.

Quebec is different. The Commission d’accès à l’information (CAI) has stronger enforcement powers under Law 25, including administrative monetary penalties that can reach very high levels for serious non-compliance.

Since November 1, 2018, PIPEDA has also required organizations to report breaches of security safeguards that create a real risk of significant harm. Organizations must notify the OPC, notify affected individuals as soon as feasible, and keep records of all breaches for at least 24 months.

Looking ahead

Canada’s federal privacy framework is widely seen as outdated. The federal government has signalled interest in replacement legislation, but as of 2026 no successor bill has been enacted. Until that changes, employers should continue to comply with PIPEDA, applicable provincial privacy statutes, and sector-specific employment disclosure requirements like Ontario’s monitoring-policy rule.

For many multi-province employers, aligning internal privacy practices with Quebec’s Law 25 is a sensible way to set a higher national baseline.

Sources

Key Takeaways

PIPEDA remains the main federal private-sector privacy law in 2026 because Bill C-27 did not become law.
Ontario’s 25+ employee electronic monitoring policy rule comes from the Employment Standards Act, 2000, not PIPEDA.
BC and Alberta each have their own private-sector PIPA statute, and Quebec’s Law 25 is now the strictest privacy regime in Canada.
Employee monitoring must be reasonable, proportionate, tied to a legitimate purpose, and clearly disclosed.
Covert surveillance should be rare and carefully justified; blanket or continuous monitoring is much harder to defend.
PIPEDA requires reporting privacy breaches that create a real risk of significant harm and keeping breach records for at least 24 months.
Multi-province employers should consider using Quebec’s Law 25 as a higher privacy baseline.