Four things to document before installation
Privacy regulators consistently look for the same evidence, and it is easiest to produce at design time.
- Purpose: the specific problem each camera addresses, written down.
- Notice: visible signage at entrances telling people recording is taking place and who to contact.
- Access: who may view live and recorded video, and how each viewing is logged.
- Retention: how long footage is kept, why that period, and automatic deletion after it.
Where you may not point a camera
Washrooms, change rooms, showers and similar areas are out. Beyond that, proportionality is the test: recording a stock room is easy to justify; continuously recording a single employee's workstation or a break room usually is not.
Audio recording carries a higher bar than video in Canada and should not be enabled by default.
Employee monitoring has extra rules
Quebec's Law 25 imposes its own consent, transparency and breach obligations, and Ontario requires employers above a headcount threshold to maintain a written electronic monitoring policy. In unionised environments, surveillance is often a bargaining matter.
The safe pattern everywhere: tell staff in writing what is recorded, why, who can see it and for how long — before the cameras go live.
Retention and disclosure in practice
Set retention automatically in the recorder, not as a policy someone remembers. Handle police and insurer requests through one named person, log every export, and release only the clip that is responsive to the request.
Individuals may have a right to access footage of themselves; systems that can export a single clip with other people redacted make that request manageable rather than alarming.
Cross-border storage
If cloud video is stored outside Canada, disclose that. Quebec in particular requires an assessment before transferring personal information outside the province. Canadian data residency is available from most major platforms — ask for it explicitly rather than assuming it.