PIPEDA for Property Management: Tenant Privacy Guide

Quick links

PIPEDA Compliance Guide CASL Compliance Guide Quebec Law 25 Guide Free compliance check

Property management companies hold some of the most sensitive personal information in any industry — rental applications with financial details, background checks, maintenance records detailing personal health or family situations, and video surveillance of residential buildings. PIPEDA creates significant obligations for Canadian property managers and landlords.

Last updated: April 2026

Does PIPEDA Apply to Landlords and Property Managers?

PIPEDA applies to property management companies that collect, use, or disclose personal information in the course of commercial activities.

Provincial note: Landlord-tenant relationships are governed by provincial tenancy legislation (Ontario's Residential Tenancies Act, BC's Residential Tenancy Act, Alberta's Residential Tenancy Act, etc.). PIPEDA applies in addition to (not instead of) these provincial rules.

Alberta property managers: PIPA Alberta applies for purely provincial activities
BC property managers: PIPA BC applies
Ontario property managers: PIPEDA applies directly (Ontario has no substantially similar private-sector law)
Quebec property managers: Quebec Civil Code + Law 25

For condominium corporations (strata) in BC: the BC Information and Privacy Commissioner has issued privacy guidelines for strata corporations and strata agents on meeting their obligations under PIPA BC when handling owner information.

What Personal Information Do Property Managers Collect?

Rental Application Information

Full name, date of birth, current and previous addresses
Employment information (employer, position, income)
SIN (for credit check purposes — highly sensitive)
Banking information (for credit checks or pre-authorized rent payments)
References (previous landlords, personal references)
Credit report (requested from Equifax or TransUnion)
Criminal background check (in some jurisdictions)
Government ID (driver's licence, passport)

Active Tenancy Information

Move-in/move-out dates and condition reports
Rent payment history
Lease amendments and correspondence
Maintenance requests (which may reveal personal circumstances — illness, disability, family changes)
Incident reports and noise complaints
Communications between tenant and property management

Building Operations

CCTV footage from common areas (lobbies, parking, amenities)
Access card/fob records (showing entry/exit times)
Visitor logs (in buildings with concierge or controlled access)

Key PIPEDA Obligations for Property Managers

1. Rental Application Process

Rental applications collect extremely sensitive information. PIPEDA requires:

Limiting collection: Only collect what's reasonably necessary to assess tenancy eligibility. Asking for a SIN to run a credit check is common — but explain why the SIN is needed and how it will be protected.

Consent: Before running a credit check, provide an authorization form explaining:

That a credit check will be conducted
Which credit bureau will be used
How the information will be used (assess tenancy application only)
That the credit report will not be retained after the application is decided

Rejected applicants: Don't retain rejected application files indefinitely. Retain for a reasonable period (6-12 months in case of a dispute) then securely destroy.

2. Social Insurance Numbers

SINs collected for credit check purposes are among the most sensitive pieces of personal information you can hold. Best practices:

Collect SINs only after the applicant has signed an authorization for the credit check
Don't retain SINs after the credit check is completed
Never include SINs in general tenant files or property management software profiles
Store SIN authorizations in a separately secured location if retained at all

3. CCTV in Residential Buildings

Residential building surveillance raises heightened privacy concerns because tenants have a reasonable expectation of privacy in their home environment.

What's permitted:

Cameras in common areas (lobby, parking garage, amenity rooms, building entrances)
Cameras are disclosed to tenants (in the lease or building notice)
Footage retained for a limited period (30-60 days) and overwritten

What's not permitted:

Cameras aimed at private areas (individual unit doorways that capture interior, balconies where residents have privacy expectations)
Using camera footage for purposes other than building security
Covert surveillance without notice

Requirements under PIPA (Alberta/BC): Before or at the time of collection, notify individuals of the purposes for collecting their information (Alberta PIPA s. 13; BC PIPA s. 10). In practice, give notice of surveillance to tenants and include CCTV usage in your privacy policy.

4. Maintenance Records

Maintenance requests often reveal personal information about tenants:

A request for accessibility modifications reveals a disability
A request to address pest issues reveals the tenant's living conditions
Health and safety complaints reveal personal circumstances

This information should be:

Used only for the maintenance purpose
Not shared with other tenants
Not used to discriminate (especially where the information reveals a protected characteristic under human rights law)

5. Sharing Tenant Information with Third Parties

You may need to share tenant information with:

Contractors and repair services (for maintenance access)
Collection agencies (for unpaid rent)
New property owners (on sale of the building)
Courts (for tenancy dispute applications)
Credit bureaus (for negative tenancy reporting)

Each sharing should be covered by your consent language in the lease or covered by a PIPEDA exception (legal proceedings, law enforcement, etc.).

Negative rental history reporting: If you report unpaid rent or damage to a rental history database (like NABORLY or similar services), this disclosure should be disclosed to tenants at application.

6. Access to Tenant Files

Former tenants have the right to access personal information held about them. Respond within 30 days. Provide:

Lease and amendments
Payment history
Move-in/move-out condition reports
Correspondence you have on file

You may withhold information about other tenants (e.g., complaints made by neighbours that identify other individuals).

Privacy Policy and Lease Language

Your tenant-facing documents should address:

What information is collected and why
Who the information is shared with
Tenant's right to access their information
CCTV notice (if applicable)
How long information is retained

Adding a Privacy Notice section to your lease agreement is the most practical approach. Keep it in plain language.

Compliance Checklist for Property Managers

Update rental application to include privacy consent language
Create separate SIN authorization form for credit checks
Post CCTV notice in the lobby and include in lease
Document and publish CCTV retention and access policy
Establish an access request response procedure
Create a document retention schedule (leases, applications, maintenance records)
Train property management staff on privacy basics
Review third-party contractor agreements for data protection clauses
Establish a breach response procedure

Frequently Asked Questions

Q: A prospective tenant refuses to provide their SIN. Can we require it for the application? A: You can require a credit check, but there are other ways to run credit checks beyond a SIN. The SIN is the most common identifier, but some credit bureaus accept other forms of ID. You cannot refuse to consider an application based solely on a refusal to provide a SIN if other identification methods are available.

Q: How long must we keep lease documents after a tenancy ends? A: Check provincial residential tenancy legislation for specific requirements. Generally, retain lease documents and key tenancy records for at least 2-3 years after the tenancy ends for potential dispute resolution purposes. Then securely destroy.

Q: Can we share a previous tenant's rental history with another landlord who calls as a reference? A: Only if the tenant has authorized reference checks as part of their application process. Providing rental history without tenant consent to a third party is a PIPEDA disclosure violation.

Property Management Privacy Made Simple

Canada Compliance AI helps Canadian SMEs work through CASL, PIPEDA and Quebec Law 25: a free two-minute compliance check, readiness scores, a prioritized task plan, a 24-month breach register and an exportable audit log. See what's live and what's planned.

Start your free trial today — protect your tenants' data, protect your properties.

PIPEDA for Property Management Companies: Tenant Privacy Guide