PIPEDA for Daycares and Childcare Centres: Child Privacy Compliance

Daycares and childcare centres hold some of the most sensitive personal information possible — detailed records about young children and their families. PIPEDA applies to private childcare facilities, and the sensitive nature of child-related data makes robust privacy practices especially important.

Last updated: April 2026

Does PIPEDA Apply to Daycares?

PIPEDA applies to private-sector childcare businesses engaged in commercial activities. This includes:

• Private for-profit daycare centres
• Licensed home daycares
• Private preschool programmes
• Before and after school care programmes operated by private providers

Important note: Public school-based childcare programmes operated by school boards may fall under provincial public sector privacy laws (MFIPPA in Ontario, FOIPPA in BC, FOIP in Alberta) rather than PIPEDA.

Provincial context:

• Alberta daycares: PIPA Alberta applies
• BC daycares: PIPA BC applies
• Ontario private daycares: PIPEDA applies
• Quebec daycares: Law 25 applies

What Personal Information Do Daycares Collect?

Enrollment Information

• Child's full name, date of birth, home address
• Parent/guardian names, contact information, employment details
• Emergency contacts (additional family members, friends)
• Health information (allergies, medical conditions, medications)
• Immunisation records
• Special needs, developmental information, accommodations
• Previous childcare history
• Family structure information (relevant to pickup authorisation)
• Financial information (childcare subsidy arrangements, payment details)

Ongoing Care Records

• Daily observation notes and progress reports
• Incident/accident reports
• Photos and videos of the child
• Developmental assessments
• Behavioural records
• Attendance records

Staff Records

• Police record checks (vulnerable sector checks) for all employees
• First aid certifications
• ECE (Early Childhood Educator) credentials
• Personnel files

Key PIPEDA Obligations for Childcare Providers

1. Consent for Child's Personal Information

Young children cannot provide meaningful consent on their own behalf — the OPC takes the position that, in all but exceptional circumstances, this means anyone under 13 (OPC Guidelines for obtaining meaningful consent). Parents or legal guardians provide consent for the collection, use, and disclosure of their child's personal information.

Your enrollment package must obtain consent for:

• Collection of health and medical information for the child's care
• Emergency medical treatment if parents can't be reached
• Daily observation records and developmental reporting
• Photos and videos (see below — this requires special attention)
• Sharing information with substitute care providers, relief staff, and contractors
• Reporting to child welfare authorities (mandatory reporters — this exception covers legal reporting obligations)

2. Photography and Video of Children

This is one of the most sensitive privacy issues in childcare. Photos and videos of children are personal information about both the child and (indirectly) their family.

Best practices for photos/video consent:

• Obtain explicit written consent from parents before photographing children
• Specify where photos will be used: internal records, parent app, website, social media
• Get separate consent for each use — a parent may consent to in-app daily photos but not to public social media posts
• Provide a clear opt-out option for each use category
• Never post photos of children to public social media without explicit consent from each child's parent

Staff phones and photos:

• Many daycares prohibit staff from using personal devices to photograph children
• If you use a daycare app (HiMama, Brightwheel, Tadpoles), the app handles photos — review the app's privacy and data storage practices

3. Health Information and Medical Records

Children's health records (allergies, diagnoses, medications) are highly sensitive. Requirements:

• Restrict access to staff who need this information to care for the child
• Store medication information (EpiPen authorisations, medication logs) separately and securely
• Train all caregiving staff who work with the child (they need to know about allergies/medications, but others don't)
• Destroy medication records and health forms after the child leaves the centre (after a reasonable retention period)

4. Incident and Accident Reports

Incident reports document injuries, behavioural incidents, and safety events. These records:

• Are personal information about the child involved
• May also include information about other children (who must be anonymised or redacted if another parent requests a copy)
• Must be shared with parents promptly (most provincial childcare regulations require this)
• May be subject to mandatory retention under provincial childcare regulations

5. Police Record Checks for Staff

Vulnerable sector police checks for staff are mandatory in most provinces for childcare workers. Handling this sensitive information:

• Collect police checks only once hired (not at initial application stage)
• Store separately from general personnel files
• Restrict access to the director/owner
• Do not share the content of police checks with parents (a statement that all staff have completed required checks is sufficient)
• Destroy after the employment relationship ends (after any applicable legal retention period)

6. Parent Communication Apps

Many modern daycares use apps (HiMama, Brightwheel, Sandbox) to communicate with parents and share daily updates. Before adopting a parent communication app:

• Review the app's privacy policy and data residency (where is the data stored?)
• Obtain parent consent for the app's data collection at enrollment
• Verify whether the app stores photos of children and under what terms
• Ensure the vendor has appropriate security measures

7. Mandatory Reporting and PIPEDA

Childcare workers are mandatory reporters under provincial child protection legislation. If you suspect child abuse or neglect, you must report to child welfare authorities — this is a PIPEDA exception and consent is not required for this disclosure.

Document all mandatory reports and the basis for them. This is both a legal requirement and a PIPEDA recordkeeping obligation.

Document Retention for Childcare Centres

Retention periods for most childcare records (enrollment and health forms, incident/accident reports, medical treatment records, developmental assessments, attendance records, staff police checks) are set by provincial childcare licensing rules and vary by province. Financial and tax records must generally be kept for six years from the end of the last tax year they relate to (Income Tax Act s. 230(4)).

Always check your provincial childcare regulations when setting retention periods.

Privacy Policy for Daycares

Even a simple one-page privacy notice given to parents at enrollment is a good start. It should cover:

• What information you collect about their child
• Why you collect it and how you use it
• Who can access their child's records (staff, emergency contacts)
• Your photo/video policy
• How long records are kept
• How parents can access or correct records

Frequently Asked Questions

Q: A parent wants to see their child's developmental assessment records. What must we provide? A: As the child's legal guardian, the parent has the right of access to their child's personal information. Provide assessments and records. You may redact information about other children.

Q: Can we post a class photo on our daycare's website? A: Only with explicit written consent from every child's parent or guardian in the photo. A single non-consenting parent means the photo cannot be posted.

Q: A separated parent is demanding access to their child's records. How do we handle competing demands? A: Consult provincial family law guidance. Generally, both parents with parenting rights have access to their child's records. If there's a custody order limiting one parent's involvement, seek legal advice.

---

Privacy Compliance for Childcare Professionals

Canada Compliance AI helps Canadian SMEs work through CASL, PIPEDA and Quebec Law 25: a free two-minute compliance check, readiness scores, a prioritized task plan, a 24-month breach register and an exportable audit log. See what's live and what's planned.

Start your free trial today — protecting the most vulnerable data with care.

Related reading: PIPEDA Compliance Guide | PIPEDA Personal Information | Data Breach Response Canada