Ontario’s electronic monitoring policy: what employers with 25 or more staff have to write down

The short version

• The trigger is 25 or more employees in Ontario on 1 January of any year.
• The count is individual people, not full-time equivalents. Every part-timer counts as one.
• Related companies under common control get counted together.
• Policy in place before 1 March, copies to employees within 30 days.
• It is a disclosure obligation. It does not give employees a right not to be monitored.

Who it catches

The requirement sits in section 41.1.1 of Ontario’s Employment Standards Act, 2000. The statutory wording:

The Government of Ontario’s guide to the ESA, last updated 8 July 2024, puts it more simply: employers with 25 or more employees on 1 January of any year are required to have the written policy.

A business with 22 people is not caught this year. If it hires four more before the end of December, it is caught on 1 January and has until 1 March to produce the policy.

How the count actually works, which is where people get caught

This is the part worth reading twice, because three provisions catch businesses that assume they are under the line.

Heads, not hours. Ontario’s guide is explicit:

and

A business with 14 full-time staff and 12 part-timers has 26 employees, not 20 full-time equivalents. It is over.

Almost everyone counts. Included in the count: homeworkers, probationary employees, trainees, corporate officers who perform work, employees on definite-term contracts, employees on layoff whose employment has not been terminated, employees on a leave of absence, and employees on strike or locked out. Employees who are exempt from other parts of the ESA still count here.

Related employers are counted together. This is the one that catches a lot of small Durham businesses:

A group of small operating companies under common control gets aggregated. Three companies with 10 people each are one 30-employee employer for this purpose, even though no single entity is close to the threshold. If your business is structured across multiple corporations, this applies to you.

Two limits worth knowing. Only employees in Ontario are counted, so staff in other provinces do not add to the total. And for temporary help agencies, assignment employees count toward the agency’s threshold, not the client employer’s.

What "electronic monitoring" covers

Broader than most people expect. Ontario’s guidance describes it as all forms of employee monitoring done electronically, and gives examples including GPS tracking on vehicles, electronic scanning sensors, and monitoring which websites employees visit. It applies to monitoring on employer-provided equipment and on an employee’s own equipment used for work.

For a typical business in Durham, that likely includes several things you already have and may not think of as monitoring:

• GPS in vehicles or in a job management app that records arrival times
• Access control fob logs, which record who opened which door when
• Cameras positioned where employees work
• Email and web filtering
• Software recording activity, keystrokes or screen time
• Phone systems logging calls
• Location data from a phone app used for timesheets

If you have access control on your doors with time and attendance reporting, you are electronically monitoring employees, whether or not anyone framed it that way when it was installed.

What the policy must contain

Section 41.1.1(2) requires, at minimum:

1. A statement as to whether the employer engages in electronic monitoring of employees.
2. If it does: a description of how the employer may electronically monitor employees; a description of the circumstances in which it may do so; and the purposes for which information obtained through monitoring may be used.
3. The date the policy was prepared, including day, month and year, and the date of any changes.

Note that a policy saying you do not monitor is a valid policy. If you genuinely do not, you still need the written statement saying so.

Also note the dates requirement. A policy without a prepared date does not meet the section, which is a small thing that is easy to get wrong.

The distribution deadlines

These are where enforcement actually bites, so get them right.

That last row is the one nobody does. Every version of the policy must be kept for three years after it stops being current. Keep an archive folder, dated.

The point almost everybody gets backwards

There is a widespread belief that this law gave Ontario employees privacy rights over workplace monitoring. It did not. The Government of Ontario’s own ESA Policy and Interpretation Manual says so directly:

and

This is a transparency requirement. You must tell people what you do. You are not restricted in what you do.

Enforcement is correspondingly narrow. Per the same manual, an employee may complain about only three things: failure to give an existing employee a copy within 30 days, failure to give a new employee a copy within 30 days, and failure to give an assignment employee a copy within 24 hours.

An employee cannot complain that the policy’s content is inadequate, or that your actual practice goes beyond what the policy describes. The obligation is delivery.

The penalties, and the number that gets attention

Penalties come from Ontario Regulation 289/01, on a government page last updated 31 March 2026. Notice of contravention amounts run on a three-year lookback: $250 for a first contravention, $500 for a second, $1,000 for a third or subsequent.

Here is the part that changes the arithmetic. For provisions of this kind, where multiple employees are affected the penalty is the tier amount multiplied by the number of employees affected.

A first contravention at an 80-person employer, affecting all 80: $250 × 80 = $20,000.

The policy takes an afternoon to write.

A related 2026 obligation with the same threshold

Worth pairing, since it catches the same employers. Effective 1 January 2026, publicly advertised job postings from employers with 25 or more employees must disclose whether artificial intelligence is used to screen, assess or select applicants. Same threshold, same kind of disclosure logic. If you use any AI-assisted screening in hiring, that is a second thing to write down.

Two things this policy does not do

It is not a privacy policy for customer data. That is PIPEDA territory, and PIPEDA governs your customers’ personal information rather than your employees’, for a provincially regulated Ontario business. These two get confused constantly and they are separate obligations.

It does not cover camera notice. Posting notice where cameras record is a separate matter, driven by different considerations. Doing it is good practice regardless of your employee count.

What to do about it

1. Count your employees as at 1 January, using heads rather than full-time equivalents, including part-timers, casuals, people on leave, and everyone at every Ontario location.
2. If you operate through more than one corporation, add them together. This is the most common reason a business is over the threshold without knowing.
3. Inventory what you already monitor. GPS, fob logs, cameras, web filtering, phone logs, timesheet apps. Walk the list above.
4. Write the policy. State whether you monitor, how, in what circumstances, and what the information may be used for. Date it.
5. Distribute it to every employee within 30 days, and add it to your onboarding pack so new hires get it within 30 days automatically.
6. File every version and keep it three years past retirement.
7. Put a reminder in early January to re-do the headcount. The obligation resets annually.

If your monitoring inventory turns out to be a mystery, that is the kind of thing an IT consulting review produces as a by-product, because the systems doing the monitoring are usually the systems nobody has documented.