Does PIPEDA apply to employee information in Ontario?

Founders often assume PIPEDA covers everything they hold about people. For employees at an Ontario startup, it usually doesn’t, though that doesn’t mean anything goes.

Why doesn’t PIPEDA apply?

PIPEDA’s section 4 covers personal information collected in commercial activity, and employee information only in connection with a federal work, undertaking or business. Managing your own staff isn’t commercial activity in that sense, and most startups aren’t federally regulated. Section 4(1)(b) treats job applicants the same way, so a provincially regulated employer’s own applicant information is generally outside PIPEDA. A third-party recruiter or hiring platform collecting candidate information as part of its own business is a different case: it’s engaged in commercial activity and is generally subject to PIPEDA.

PIPEDA still applies to information about your customers and users, including where an employee is also a customer.

What rules still apply in Ontario?

Source	What it requires
ESA electronic monitoring policy	Employers with 25 or more employees on January 1 must have a written policy saying whether and how they electronically monitor employees, and for what purposes, by March 1. See the ESA guide
Common law	Ontario courts recognize a privacy tort, intrusion upon seclusion, for deliberate and highly offensive intrusions (Jones v. Tsige, 2012 ONCA 32)
Human rights law	Limits on collecting and using information about disability, family status and other protected grounds
Employment contracts and policies	What you promised employees about monitoring and confidentiality
PHIPA	Personal health information held by a health custodian, including about staff who are also patients

What changes for staff in other provinces?

Quebec, British Columbia and Alberta have private sector privacy laws that cover employee information. If you hire remote employees there, their information is subject to those laws, with rules on notice, purposes and, in Quebec, privacy impact assessments and incidents.

Can I monitor remote employees?

Within limits. Be open about it in your electronic monitoring policy if you have 25 or more employees, monitor for legitimate purposes, collect no more than you need, and secure what you collect. Keystroke logging, webcam capture and AI productivity scoring carry more legal and practical risk than standard security logging. The ESA policy rule is about transparency: Ontario’s ESA guide says it doesn’t create a right not to be monitored or any new privacy rights, so the limits come mainly from the common law, human rights law and your own contracts and policies.

What should I do?

• Keep HR records secure and access limited.
• Write an electronic monitoring policy before you reach 25 employees. See what workplace policies an Ontario employer needs.
• Treat health and medical information about staff as highly sensitive.
• Check the provincial law for employees outside Ontario.
• Be careful with AI hiring and monitoring tools. See Ontario’s job posting rules.

What to do next

We prepare employment agreements with confidentiality terms, at fixed fees on our fees page.

This guide is general information about Ontario and Canadian law, not legal advice for your situation. To talk through monitoring or employee data, book a free 15-minute consult.