Privacy and Personal Information Course 2026
This course is for security guards who handle visitor logs, ID checks, reports and CCTV. It explains what personal information is, which privacy laws apply in Canada, the 10 fair information principles, video surveillance guidelines, access requests and what to do about privacy breaches.
Quick answer
This free course has about 10 minutes of lessons and a 25-question test. Score 80% or more to download a certificate of completion (private, not accredited). Checked against official sources on October 11, 2026.
What you will learn
- Identify personal information in everyday security work
- Explain which privacy law applies in different provinces
- Apply the 10 fair information principles on the job
- Follow good practice for video surveillance
- Handle access requests and report privacy breaches
Score 80% or more to download your certificate.
-
Question 1 of 25
Show answer
Answer: D. A visitor's name and ID number written in a sign-in log
Personal information is information about an identifiable person, such as a name, age or ID number.
-
Question 2 of 25
Show answer
Answer: A. Yes, comments, evaluations and disciplinary actions about a person are personal information
Opinions, evaluations, comments and disciplinary actions about an identifiable person are personal information.
-
Question 3 of 25
Show answer
Answer: B. Private-sector organizations that collect, use or disclose personal information in commercial activity
PIPEDA covers private-sector organizations in their commercial activities, plus federally regulated businesses.
-
Question 4 of 25
Show answer
Answer: C. Alberta, British Columbia and Quebec
Organizations covered by these provincial laws are generally exempt from PIPEDA for activities within that province.
-
Question 5 of 25
Show answer
Answer: A. PIPEDA, because organizations in the territories are considered federally regulated
The Privacy Commissioner says organizations in the Northwest Territories, Yukon and Nunavut are considered federally regulated, so PIPEDA applies.
-
Question 6 of 25
Show answer
Answer: D. Provincial laws
The Privacy Commissioner notes that municipalities, universities, schools and hospitals are generally covered by provincial laws.
-
Question 7 of 25
Show answer
Answer: D. Limiting collection
The principles include accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access and challenging compliance.
-
Question 8 of 25
Show answer
Answer: B. Limiting collection
Collect only what is needed for the identified purpose. Extra information adds risk with no benefit.
-
Question 9 of 25
Show answer
Answer: D. Protect them with security that fits how sensitive they are, such as keeping them locked away
Personal information must be protected against loss, theft and unauthorized access.
-
Question 10 of 25
Show answer
Answer: C. The organization is responsible for the personal information it controls and names someone to oversee compliance
Accountability means the organization is responsible and designates a person, often a privacy officer, to oversee compliance.
-
Question 11 of 25
Show answer
Answer: D. 30 calendar days
Businesses generally must respond within 30 calendar days.
-
Question 12 of 25
Show answer
Answer: B. In limited cases, by up to 30 more days, telling the person within the first 30 days
An extension of up to 30 days is allowed in limited cases, such as when meeting the deadline would seriously disrupt operations.
-
Question 13 of 25
Show answer
Answer: B. Refer the request to the supervisor or privacy officer under site policy
People have a right to access images of themselves, but requests go through the proper process so other people's identities can be protected.
-
Question 14 of 25
Show answer
Answer: A. Where people will see them before they enter the area being watched
Notice should let people know about cameras before they enter, and should include a contact for questions.
-
Question 15 of 25
Show answer
Answer: B. Washrooms, change rooms and similar private areas
The guidelines say cameras must not be aimed at places where people expect more privacy, such as washrooms and change rooms.
-
Question 16 of 25
Show answer
Answer: C. Not unless there is a specific need
Audio recording is more intrusive and should not be used unless there is a specific need.
-
Question 17 of 25
Show answer
Answer: C. Only as long as needed for the purpose, then destroyed securely
Keep recordings only as long as necessary for their purpose and destroy them securely when no longer needed.
-
Question 18 of 25
Show answer
Answer: C. Only when unlawful activity is suspected or observed
Limiting recording reduces the amount of personal information collected.
-
Question 19 of 25
Show answer
Answer: B. Decline, because footage should be used only for its stated purpose or as the law allows
The guidelines give tracking tenants' movements as an example of misuse.
-
Question 20 of 25
Show answer
Answer: A. Follow site procedure, involve the supervisor if required, and record what was given, to whom and why
Disclosures outside the organization should be justified and documented. Sites usually have a process for police requests.
-
Question 21 of 25
Show answer
Answer: C. Report it to the supervisor right away
A lost notebook may be a privacy breach. Reporting quickly lets the organization reduce harm and meet its legal duties.
-
Question 22 of 25
Show answer
Answer: B. When it is reasonable to believe the breach creates a real risk of significant harm
The test is a real risk of significant harm, whatever the number of people affected.
-
Question 23 of 25
Show answer
Answer: A. Humiliation or damage to reputation
Significant harm includes bodily harm, humiliation, damage to reputation, financial loss, identity theft and loss of employment opportunities.
-
Question 24 of 25
Show answer
Answer: C. 24 months after it decides the breach happened
The Breach of Security Safeguards Regulations require a record of every breach for 24 months, whether or not it was reportable.
-
Question 25 of 25
Show answer
Answer: B. Use an employer-approved device and follow policy, rather than storing images on a personal phone
Personal phones are hard to secure and easy to share from. Use approved devices so images stay protected.
Keyboard: 1–4 to answer, Enter for the next question.
What to know before the test
- PIPEDA covers private-sector organizations that collect, use or disclose personal information in commercial activity; Alberta, British Columbia and Quebec have substantially similar private-sector laws.
- PIPEDA is built on 10 fair information principles, including limiting collection, safeguards and individual access.
- The Privacy Commissioner's video surveillance guidelines say cameras must not be aimed at washrooms or change rooms, and recordings should be kept only as long as needed.
- A business generally has 30 calendar days to respond to a request for access to personal information, with a possible extension of up to 30 more days.
- Breaches creating a real risk of significant harm must be reported to the Privacy Commissioner, and records of every breach must be kept for 24 months.
Frequently asked questions
Does privacy law apply to security guards?
Yes. Guards collect personal information for their employer and clients, so they must follow the privacy law that applies (PIPEDA or a provincial law) and their employer's privacy policy.
Can a security guard give CCTV footage to police?
Footage can be used as the law allows, and the Privacy Commissioner's example is sharing car break-in video with police. Follow your site's procedure and document the disclosure.
What should I do if I lose a notebook or report?
Report it to your supervisor right away. It may be a privacy breach that the organization must assess and, if there is a real risk of significant harm, report.
Can people see video of themselves?
Yes, people have a right to access images of themselves. Refer the request to your supervisor or privacy officer so other people in the footage can be protected.
Is the certificate accredited or officially recognised?
No. It is a private certificate of completion for knowledge only. It is not recognised, accredited or approved by any government, licensing body, regulator or educational institution, and it does not replace the security licence training required in your province or territory.
Sources
- PIPEDA in brief (Office of the Privacy Commissioner of Canada)
- Guidelines for overt video surveillance in the private sector (Office of the Privacy Commissioner of Canada)
- Accessing your personal information: businesses (Office of the Privacy Commissioner of Canada)
- What you need to know about mandatory reporting of breaches of security safeguards (Office of the Privacy Commissioner of Canada)
- Breach of Security Safeguards Regulations, SOR/2018-64 (Canada Gazette)
- Security Services Regulation, B.C. Reg. 207/2008 (code of conduct, section 14)