Tenant Privacy and Data Protection for Property Managers: PIPEDA, Screening, Cameras, and the Files You Keep

Run a rental for a year and you'll hold a small biography of another human being: their income, their credit file, a copy of their ID, their movements past your cameras, maybe their smart-lock timestamps. Canadian federal law has a name for what that makes you — a custodian of personal information — and a rulebook for how you hold it. And the rulebook has teeth: in one real case, a landlord organization left more than 1,300 tenant files publicly accessible online and ended up the subject of a federal privacy finding. This guide is how you never become that story.

A quick vocabulary note before we start. Personal information is any information about an identifiable individual — recorded or not. PIPEDA is the Personal Information Protection and Electronic Documents Act, Canada's federal private-sector privacy law. The OPC is the Office of the Privacy Commissioner of Canada, the federal regulator whose guidance anchors this article. And consent is the currency the whole system runs on. What follows runs the entire life of a tenant's data as one operating discipline — collect, use, secure, share, access, dispose, breach — written for three readers at once: property managers and landlords, who carry these rules as duties, and tenants, for whom every one of them is a right.

Your rental file is a privacy file: who's covered and what counts

Start with the reach of the law, because the most common privacy mistake in this business is believing it applies to someone bigger. PIPEDA governs how organizations handle personal information in the course of commercial activity, and the Privacy Commissioner's own landlord guidance addresses landlords generally — renting out property is ordinarily commercial activity, which means the obligations typically apply from the first unit, not the fiftieth. (The law doesn't reach individuals acting outside commerce entirely, but a landlord collecting rent is rarely that individual — treat the distinction as a lawyer's question, not a loophole.)

One routing note, then we stay federal: British Columbia and Alberta each run their own Personal Information Protection Act, and Quebec runs its own regime — all substantially similar in principle, with complaints going to the provincial authority. Ontario and most other provinces have no private-sector privacy statute of their own, so PIPEDA applies directly and complaints go to the OPC. This article's spine is the federal law; where an Ontario-specific rule appears below, it's labelled.

Now the definition that makes this everyone's topic. Personal information is any factual or subjective information about an identifiable individual — the OPC's examples include names, dates of birth, banking and financial records, driver's licence and SIN numbers, and photographs and video of an identifiable person. Read that last item again: your lobby camera footage, the photos taken at a showing of an occupied unit, and the entry logs your smart locks quietly accumulate are all personal information, with all the obligations attached.

And here's the tension that makes 2026 the year to get this right: 70 per cent of property management companies report rising application fraud (Second Nature's 2026 North American survey), which pushes firms toward heavier and heavier screening — while the privacy rules haven't moved an inch. The professional answer this article keeps returning to isn't more collection. It's better verification of less data.

Collect: screening without over-collecting

Stage the collection

The single highest-leverage habit in tenant privacy is staging. A viewing needs a name and a way to reach the person — nearly nothing. An application needs the actual screening tools, gathered with consent. Move-in completes the lease file. The canonical over-collection — and the composite we see constantly, labelled ours — is the listing that demands a SIN, three months of full bank statements, and social media handles just to book a fifteen-minute viewing. That's over-collection stacked on premature collection: information gathered before any purpose for it exists, from dozens of people who will never even apply.

The consent ladder

The OPC's framework gives you the operating tool. Purposes must be identified before or at the time of collection, and limited to what a reasonable person would consider appropriate in the circumstances. Then consent scales with sensitivity: a credit check requires express consent — asked directly, in writing, on the application form. Implied consent can be reasonable only for the unsurprising — a properly announced common-area security camera is the OPC's own example. And whenever a collection is sensitive, unexpected, or creates a risk of harm, the rule is simple: ask directly. New purpose for old information? That's a new collection in spirit — ask again.

What you may ask — Ontario's list, and the SIN line

Ontario gives its landlords something most provinces don't: a named list. Under O.Reg 290/98, made under Ontario's Human Rights Code, the permissible screening tools are credit references, rental history, credit checks, income information (only when requested alongside the other tools), and guarantors — and nothing in that regulation permits refusing anyone on a protected ground, which in Ontario explicitly includes receipt of public assistance. Our income verification guide covers the document side in depth, including what self-employed applicants can offer instead of pay stubs. Wherever you are in Canada, one line holds: a SIN is not required for tenant screening — credit checks run without it — and best practice is simply not to ask.

The heavy tools stay holstered

Criminal-record checks reveal sensitive, sometimes untested, often stigmatizing information, and privacy regulators have been blunt that they're hard to justify for ordinary tenancies — British Columbia's commissioner has said landlords can't require one as a condition of renting unless the information is genuinely necessary, and blanket refuse-any-record policies have been challenged at human-rights tribunals. Social-media scanning inherits the same consent rules and the same over-collection risk, which Alberta's privacy commissioner has flagged specifically in recent landlord guidance. The working rule for every tool: use the least intrusive tool that answers the actual question. The question is "will this person pay rent and care for the unit" — not "what is this person's entire life."

The third-party rule — and the investigation to know about

Screening platforms feel like outsourced compliance. They are the opposite: under the principles both the OPC and provincial commissioners apply, you cannot collect through a vendor what you couldn't lawfully collect yourself, and you remain responsible for the vendor's compliance — their vague consent form is your liability. This isn't theoretical: in June 2024, the federal, British Columbia, and Alberta privacy commissioners launched a joint investigation into Certn, a tenant-screening platform, examining whether consent obligations are being met — an investigation that remains a live signal that regulators are watching exactly this corner of the industry. And with 58 per cent of PM companies now using AI (Buildium's 2026 North American survey), remember that an AI screening tool inherits every consent rule its inputs required. A platform can't launder over-collection.

One more principle completes the collection stage, and it's the one that quietly governs everything later: the purpose you named is the only purpose you have. Information collected to assess an application is for assessing the application — not for marketing lists, not for a curiosity search two years later, not for sharing with the owner's cousin who "just wants to know who's living there." A new use is, in spirit, a new collection: name the purpose and ask again. Firms that internalize this one rule almost never end up in the rest of this article's cautionary tales.

And a word about the people on the other side of the form. In supply-tight moments and competitive buildings, applicants over-share to win — volunteering documents nobody asked for, hoping thoroughness reads as reliability (CMHC's 2026 mid-year picture keeps several major markets in exactly that anxious mood). The dignified firm doesn't harvest that anxiety; it hands the extra documents back. Asking for less, and saying why, is both the compliant posture and the humane one.

Secure: files, cameras, and smart locks

The safeguard basics — and the 1,300-file lesson

Once collected, tenant information is guarded in proportion to its sensitivity: locked or encrypted storage, access limited to the people who genuinely need it, staff trained on the basics, and secure disposal at the end (more on that below). The cost of skipping this has a case number: in PIPEDA Case Summary #2009-017, the OPC found that a third-party landlord organization had left more than 1,300 tenant case files publicly accessible online — violations of both consent and use-limitation principles, with the finding underscoring that the third party had its own duty to confirm consent had been properly obtained. Nobody in that story set out to harm anyone. The files were simply never guarded like they mattered.

Cameras, the Commissioner's way

Security cameras can be legitimate — and the OPC's guidance tells you exactly what legitimate looks like. Post signs and distribute a written policy, and advise tenants before installation — not after the cameras are up. Point them at common areas for reasonable purposes like safety and deterring vandalism. Never capture the inside of units. Secure the monitors and recordings, and access footage only for the purposes the policy states. A camera that meets those rules protects everyone; a camera that fails them is a privacy violation running twenty-four hours a day. Entry to units themselves — including photographs at showings of occupied homes — runs through tenancy law's notice rules; our guide to Ontario's 24-hour notice of entry covers that ground in full.

Smart locks and building apps

Every smart lock, fob system, and building app generates something older security never did: a time-stamped record of an identifiable person's comings and goings. There's no special "smart lock law" — and none is needed, because the ordinary principles apply to the logs as personal information: a stated purpose for keeping them, real safeguards around who can view them, and a retention clock so they don't become an accidental forever-archive of tenants' movements. If your entry system's answer to "how long do we keep this?" is "we've never checked," that's the to-do item this paragraph exists for.

Share: consent or don't

Disclosure is where good intentions meet named enforcement. Start with the finding every landlord forum should have pinned: in OPC Report of Findings #2016-002, the federal Commissioner concluded that landlords do not have the right to disclose tenant information — such as poor payment history — to a "bad tenant" list. Alberta's commissioner has issued guidance in accord, warning against both contributing to such lists and consulting them, since accessing one means using personal information collected without valid consent. Both directions, closed. Whatever a tenant did or didn't do, the blacklist is not a lawful tool.

The rest of sharing runs on one word: consent. Reporting rent payments to a credit bureau is a disclosure of personal information, so it operates on consent — and done that way it's genuinely tenant-positive: 67 per cent of renters in one 2026 North American survey want their rent counted toward their credit (Second Nature 2026). References about former tenants are disclosures too, which is why the consent routinely arrives built into the applicant's next application, naming you as a reference to be contacted. And when personal information flows into an LTB or tribunal filing, it moves under legal authority — worth knowing that tribunal orders can end up publicly available, which is one more reason files should contain only what was ever needed.

Access, retention, and the day something leaks

The access right — the tenant's centrepiece

Everything above describes duties; this is where the mirror-image right lives. Under the federal framework, a tenant can make a written request and receive access to the personal information a landlord holds about them within 30 calendar days, with a possible 30-day extension in specific defined circumstances. Denial is allowed only in limited cases — solicitor-client privilege is the OPC's own example — and tenants can challenge the accuracy of what they find and have corrections attached. For the landlord or PM, the habit that makes this right painless to honour is the same habit that makes everything else in this article easier: one findable file per tenancy. Nothing squirrelled across inboxes, nothing on a departed employee's desktop — one file, one place, thirty days is easy.

Retention with an end date

"Keep everything forever, just in case" feels prudent and is the opposite. Retention needs a reason and an end date: keep what limitation periods and tax rules genuinely require — the money records have their own clock, which our CRA audit guide covers — and then destroy securely: cross-cut for paper, properly wiped for devices, actually deleted for cloud files. Two categories deserve special clocks. Unsuccessful applicants' files go on a short one — a decision was made; there is no reason to warehouse the financial biographies of people you never rented to. And old laptops and phones leave the building wiped, because "sold with the files still on it" is a breach with a receipt. The through-line of this whole section: what you never kept can't leak.

Breach: the plan before the bad day

Federal law makes breach response mandatory, not optional. When a security safeguard fails — the composite here is painfully ordinary: a staff laptop, unencrypted, gone from a car — the sequence is: contain the leak; assess whether it creates a real risk of significant harm to anyone; where it does, notify both the affected individual and the Privacy Commissioner; record what happened; and fix the hole it came through. Two details separate firms that handle this well from firms that make it worse. First, records must be kept of every breach for two years — reportable or not. Second, penalties for getting the breach obligations wrong can reach up to $100,000 — a maximum, not a routine outcome, and precisely the number that justifies writing the one-page plan this afternoon instead of during the incident.

The year ahead: fraud pressure, AI screening, and the minimalist advantage

Here's where the tension from the top of this article resolves. Application fraud is up (70 per cent of PMs report it — Second Nature 2026, North America), screening technology is hungrier than ever (58 per cent of firms using AI — Buildium 2026, North America), and the privacy rules haven't moved. The unprofessional response is to collect more. The professional response is to verify better: confirm the authenticity of the modest set of documents the rules already permit, rather than widening the net. Data minimalism is risk minimalism — what you never collected can't breach, can't be demanded, and never needs shredding. Every field on every form should answer one question: what decision does this change? If the answer is none, the field goes.

The watch list, dated July 16, 2026: the outcome of the commissioners' screening-platform investigation; refreshed landlord guidance from provincial regulators; and rent-reporting consent workflows becoming a standard intake item as those products spread. And one genuinely underused opportunity: after years of breach headlines, handling information properly is a leasing differentiator. The firm that asks for less and explains why reads as trustworthy to exactly the careful, reliable applicants everyone wants.

Key takeaways

• Stage the collection: a viewing is not an application, and an application is not a move-in — each stage collects only what it needs.
• Express consent for credit checks, on the form — and no SIN demands, ever; credit checks run without one.
• Vendors sit under the third-party rule: you can't collect through a platform what you couldn't collect yourself, and their consent forms are your liability.
• Cameras: announced first, common areas only, never inside units, footage secured — and smart-lock logs get a retention clock.
• Access requests: written request, 30 calendar days — kept painless by one findable file per tenancy.
• Retention has end dates: keep what tax and limitation rules require, shred securely, and put unsuccessful applicants' files on a short clock.
• The breach plan exists before the bad day: contain, assess, notify where required, and record every breach for two years.

Only what the purpose needs

The rental business runs on other people's information the way it runs on other people's money, and the custody logic is identical — a theme our guides to multi-owner ledgers and Ontario trust accounting develop on the money side. Collect only what a reasonable person would consider appropriate, for a purpose you named out loud. Guard it like it's valuable, because it is. Share it only with consent or authority — never to a blacklist. Open the file when the tenant asks. Destroy it when its reason expires. And if it ever leaks: report, record, repair. Collection is a setting. Keep yours small, and the Commissioner, the fraudsters, and the shredder all have less to do.

Related resources

• Income Verification for Self-Employed Tenants — the document side of screening, done respectfully
• The 24-Hour Notice of Entry Rule in Ontario — entry, showings, and photos of occupied units
• CRA Audits of Rental Income — the retention clock on the money records
• Ontario Standard Lease 2026 — the lawful paper trail a tenancy starts with
• 5 Things Your Landlord Can't Do in Ontario — the tenant-rights companion
• External: the Privacy Commissioner of Canada's landlord and tenant guidance at priv.gc.ca

Frequently asked questions

Do landlords have to follow PIPEDA?

Generally, yes. PIPEDA governs personal information handled in the course of commercial activity, and renting out property is ordinarily commercial activity — so the obligations typically apply from the first unit. Landlords in British Columbia, Alberta, and Quebec follow their provinces' substantially similar laws instead, with complaints going to the provincial privacy authority.

Can a landlord ask for my SIN in Canada?

A SIN is not required for tenant screening — credit checks run without it — and best practice is not to request it at all. As an applicant, you can decline to provide your SIN and still complete a normal application with consent-based credit and reference checks.

Can landlords use "bad tenant" lists?

No — a named federal finding (OPC Report of Findings #2016-002) concluded landlords may not disclose tenant information to such lists, and regulators warn against consulting them too, since the information in them was typically collected without valid consent. Both contributing and relying on blacklists are off-side.

How do I see what information my landlord has about me?

Make the request in writing — being specific helps. Your landlord should provide access within 30 calendar days, with a possible 30-day extension in specific circumstances, and may deny access only in limited cases. You can challenge the accuracy of anything you find.

Can my landlord put cameras in the building?

Cameras can be legitimate in common areas, for reasonable purposes like safety — but the Privacy Commissioner's guidance requires signs and a policy communicated to tenants before installation, cameras that never capture inside units, secured footage, and access only for the stated purposes.