Rule 29 of 33

Ontario electronic-monitoring + disconnecting policies

Do I need an electronic monitoring policy in Ontario?

If you have 25 or more employees in Ontario, yes. You must have a written policy stating whether you electronically monitor employees, how and in what circumstances, and the purpose of the data. It must be given to staff within 30 days of a change and kept for three years.

What the rule requires

Written policies due 1 March each year.

Who it catches

Ontario employers with 25+ employees on 1 January - the same trigger as the job-posting rules.

What this looks like in practice. You had 25+ staff on Jan 1 but never wrote an electronic-monitoring policy or a disconnecting-from-work policy. Both were due, must be handed out within 30 days, and kept for three years.

How to check whether you comply

The checkDo you have both a written electronic-monitoring policy and a disconnecting-from-work policy, distributed within 30 days and kept for 3 years after they end?

Read it yourself

We would rather you checked us than took our word for it. This links to the law as published, not to our summary of it.

Primary source Ontario ESA ↗ Real case ESA prosecution: to $100,000 and 12 months for a person; $100k/$250k/$500k for a corporation ↗

Questions people ask

Do I need an electronic monitoring policy in Ontario?

If you have 25 or more employees in Ontario, yes. You must have a written policy stating whether you electronically monitor employees, how and in what circumstances, and the purpose of the data. It must be given to staff within 30 days of a change and kept for three years.

Who does Ontario electronic-monitoring + disconnecting policies apply to?

Ontario employers with 25+ employees on 1 January - the same trigger as the job-posting rules.

How do I check whether we comply with Ontario electronic-monitoring + disconnecting policies?

Do you have both a written electronic-monitoring policy and a disconnecting-from-work policy, distributed within 30 days and kept for 3 years after they end? You can also run our free website check, which tests 25 technical items in about twenty seconds, or book a review if this rule needs a documented answer.

Other rules that catch the same businesses

Rule 30CASL (Canada’s Anti-Spam Legislation) Rule 31PCI DSS v4.0.1 (card-data security) Rule 32Subscription auto-renewal laws (ROSCA + state ARLs) Rule 33Colorado AI Act (SB 24-205, as amended) All of themThe full 33-rule table, searchable

Find out which of the 33 apply to you

The fine risk check asks a few questions about your business and tells you which rules catch you, with the deadlines. Nothing you tick leaves your browser.

Check my fine risk

This page summarises a legal obligation in plain language so you can work out whether it applies to you. It is not legal advice, and the primary source linked above governs. Last reviewed 2026-10-03.