There is no Canadian employee monitoring law. There are four regimes that might apply to you, and which one does depends on facts about your business rather than anything about the monitoring itself.
That is genuinely the hardest part. Most compliance guidance skips to the requirements without answering the prior question, so employers end up applying the wrong statute and are surprised later.
Work out which regime applies first
Start here, because everything downstream changes.
If you are a federally regulated private-sector employer — banks, airlines, railways, telecoms, broadcasting, interprovincial transport and shipping, and a handful of others — PIPEDA governs your employees' personal information regardless of which province they sit in. This catches employers who assume provincial law applies because their office is in Calgary.
If you are not federally regulated, provincial law governs employee data, and only British Columbia, Alberta and Quebec have private-sector privacy statutes covering the employment relationship. In the rest of the country there is no comprehensive private-sector employee privacy statute, which does not mean monitoring is unregulated — common law, arbitral jurisprudence in unionised workplaces, and employment standards obligations still bite.
And separately from all of that, Ontario imposes a written-policy requirement through its employment standards legislation, which applies whether or not a privacy statute does.
Employers with staff in several provinces get the union of these, not the easiest one.
The reasonableness standard, which is the actual test
PIPEDA's core requirement is that personal information may only be collected for purposes a reasonable person would consider appropriate in the circumstances. That sentence is doing more work than it appears to.
Privacy commissioners and arbitrators have consistently read it as a proportionality test with roughly four questions. Is the monitoring necessary to meet a specific need? Is it likely to be effective at meeting it? Is the loss of privacy proportionate to the benefit? And is there a less privacy-invasive way to achieve the same result?
That last question is the one that decides cases. If a capacity question can be answered by aggregate activity data, deploying screen recording to answer it fails — not because recording is prohibited, but because a less intrusive route existed and you did not take it. The same logic runs through GDPR and the UK's ICO guidance, and it is why a metadata-first architecture is easier to defend everywhere.
Ontario: a disclosure rule, not a limit
Ontario's electronic monitoring provisions are widely misread, so it is worth being precise.
Employers with 25 or more employees in Ontario as of 1 January in a given year must have a written policy on electronic monitoring in place by 1 March of that year. The headcount includes part-time employees and those on layoff or leave. New employees must receive a copy within 30 days of starting.
The policy has to state whether the employer electronically monitors employees and, if so, a description of how and in what circumstances, and the purposes for which the information may be used. Employers that do not monitor at all must say that explicitly rather than staying silent.
Here is the part that surprises people: this creates no new right to privacy and imposes no limit on what you may monitor. It is a transparency obligation under employment standards law, enforced through that system rather than a privacy commissioner. You can monitor as much as the applicable privacy regime allows — you simply have to write it down and hand it over.
Which, in practice, is a good discipline. Writing the policy is the moment most employers discover they cannot articulate why they are collecting something. Our monitoring policy template is a reasonable starting shape, though the Ontario-specific elements need adding.
Quebec is the strictest
Quebec's private-sector privacy legislation, as modernised by Law 25, applies to all private-sector employers in the province and sets a higher bar than the rest of the country.
The most consequential difference for monitoring is the expectation of a privacy impact assessment before implementing a system that collects personal information — the Canadian analogue of a DPIA, and a real piece of work rather than a form. Transparency obligations are also more prescriptive, and individual rights including data portability are stronger.
If you have employees in Quebec, plan your deployment around the Quebec requirements and let the rest of the country inherit them. Doing it the other way round means retrofitting, which is always more expensive.
What this means practically
The through-line across every Canadian regime is that a narrow, well-explained deployment is defensible and a broad, vague one is not. A workable sequence:
- Establish which regime or regimes apply, and write it down. This takes an hour and prevents the most common failure.
- Write the purpose before choosing the tool. If you cannot state the decision the data will inform, the reasonableness test has no anchor.
- Choose the least intrusive method that serves the purpose, and record why the more intrusive options were rejected. That record is what a proportionality assessment consists of.
- Produce the written policy, in Ontario because it is mandatory and elsewhere because it is the cheapest evidence of transparency you will ever create.
- Set retention deliberately. Indefinite retention converts a reasonable collection into an unreasonable holding.
- Give employees access to their own data. In every Canadian regime this is easier than fielding requests, and it changes how monitoring lands with staff.
Where ProdView fits
Most of what a Canadian proportionality assessment asks about, ProdView answers by construction. It collects activity and application metadata rather than screen content or keystrokes, screenshots are optional and off by default, employees see the same dashboard their manager does, and retention is configurable. SOC 2 Type II, one agent across Windows, macOS and Linux, $4.99/user/month with three seats free.
When not to pick us: you are federally regulated with a security mandate requiring session recording or DLP, or a client contract specifies them. Those are legitimate purposes and a UAM tool is the honest answer for the seats they apply to.
Try before you commit
Three seats are free forever, which is enough to run your reasonableness assessment against a real deployment rather than a datasheet — and the Ontario policy is much easier to write when you can describe what the tool actually does.
General information about Canadian privacy and employment standards law as of August 2026, not legal advice. Requirements differ by province and by whether you are federally regulated; take Canadian counsel before deploying.