Background checks in Ontario, what employers can ask under privacy law

What to take away

• A background check policy in Ontario cannot give an employer unlimited access to your personal history; consent, relevance and provincial privacy rules set the limits.
• Ontario employers may ask for a criminal record check only after a conditional offer, and only if the role justifies it.
• A vulnerable sector check is stricter and only for positions with trust or authority over children or vulnerable adults.
• You must give informed consent before any check, and you can ask how the results will be stored and destroyed.
• Credit checks and social media screening are rarely lawful in Ontario unless the job genuinely requires them.
• If a check goes too far, you can complain to the Office of the Privacy Commissioner of Canada or the Ontario Ministry of Labour.

What Ontario employers may ask, and when

Most Ontario employers ask about your work history, education and references. That is normal. What they cannot do is demand a criminal record check before making a conditional offer. The Ontario Human Rights Code treats a record suspension, formerly a pardon, as irrelevant to most jobs. A blanket rule that excludes anyone with a record can be discrimination.

An employer may ask for a criminal record check when the role involves money, vulnerable people, security or a position of trust. Even then, the request must be tied to the job duties. A warehouse picker does not need the same check as a school bus driver.

The timing matters. A conditional offer lets the employer withdraw if the check reveals something directly relevant. Asking for a check at the application stage screens people out before anyone assesses their skills. That practice invites complaints under Ontario human rights law.

The Ontario Employment Standards Act sets minimum standards for hiring, pay and termination, but it does not authorize background checks. Employers sometimes confuse their right to manage with a right to investigate. The Employment Standards Act guide explains that employers must follow the law when collecting personal information.

For a practical starting point, see this creator privacy settings guide.

If you are asked to sign a consent form, read it. It should name the check, the provider and the purpose. A vague form that covers "any checks we deem necessary" is not informed consent.

Criminal record checks: levels, providers and consent

A criminal record check in Ontario comes in different levels. A basic check confirms whether you have a criminal record and is based on your name and date of birth. A level two check, often called a police record check, adds information such as outstanding charges and discharges.

A level three check is the vulnerable sector check, which we cover next.

Providers include local police services, the RCMP and private companies accredited by the RCMP. The Royal Canadian Mounted Police runs the Canadian Criminal Real Time Identification Services, which supports fingerprint-based checks. Private providers often use the same databases but may add their own identity verification steps.

Consent is the foundation. Under Canadian privacy law, an employer cannot run a criminal record check without your written, informed consent. The consent must be specific to the check and the job. Blanket consent forms that cover future checks are weak.

The Office of the Privacy Commissioner of Canada explains that employers may collect personal information only for purposes a reasonable person would consider appropriate. A criminal record check for a job that involves no risk to people or property fails that test. The OPC's page on employers and employees is a good reference.

Some employers ask for a police check every year. Ongoing checks may be justified for roles with vulnerable people, but not for every employee. A background check policy should state the interval and the reason.

If a check returns a record that is not relevant, you can explain the context. Employers should give you a chance to respond before withdrawing an offer. A fair process includes that step.

Vulnerable sector checks and who qualifies to request them

A vulnerable sector check is a deeper criminal record check in Ontario. It can reveal record suspensions for sexual offences and other convictions that a basic check would not show. It is designed for positions that involve trust or authority over children or vulnerable adults.

The role must qualify. Examples include teachers, nurses, daycare staff, coaches, adoptive parents and volunteers who work with children. A retail cashier or a software developer does not qualify. The police service decides whether the position meets the legal test.

You cannot request a vulnerable sector check for yourself. The employer or volunteer organization must provide a letter confirming the role and its duties. You then take that letter to a police service or an accredited provider. The check is based on your fingerprints and your name.

A vulnerable sector check is not a licence to dig into your entire life. It is limited to criminal record information. It does not include your mental health history, your credit score or your social media activity.

If you are asked for a vulnerable sector check for a role that does not involve vulnerable people, ask why. The employer may be over-collecting. That is a privacy issue.

Volunteer organizations often ask for these checks. The process can take weeks, so start early. Some police services charge a fee, and some waive it for volunteers.

The results belong to you. You can ask for a copy and check it for errors. If something is wrong, you can request a correction. For more on how these checks work in practice, see this background checks article.

Where provincial privacy rules limit an employer's request

Ontario has no general private-sector privacy statute like Quebec's Law 25 or British Columbia's Personal Information Protection Act. Instead, the federal Personal Information Protection and Electronic Documents Act, PIPEDA, covers most private-sector employers in Ontario. PIPEDA requires consent, limits collection to what is necessary and gives you the right to access your information.

PIPEDA falls under the watch of the Office of the Privacy Commissioner of Canada. The OPC has said that employers must not collect personal information indiscriminately. A background check policy that sweeps in credit history, social media and criminal records for every role is likely to violate PIPEDA.

Ontario's public-sector privacy law, the Freedom of Information and Protection of Privacy Act, and its municipal counterpart, the Municipal Freedom of Information and Protection of Privacy Act, cover government bodies. If you apply for a government job, those rules apply instead of PIPEDA.

Ontario's consumer protection law, the Consumer Protection Act, 2002, can also matter. It governs consumer reporting agencies that supply background check reports. If a consumer report contains an error, you have a right to dispute it. The Ontario e-Laws consumer statute page for the Consumer Protection Act, 2002 sets out those rules.

A background check policy should be written, shared with candidates and reviewed regularly. It should state what is checked, why, who sees the results and how long they are kept.

The Ontario e-Laws employment statute page for the Employment Standards Act, 2000 provides the baseline for employment rules, though it does not cover privacy directly.

Credit checks and social media screening under Ontario law

Credit checks are common in finance and accounting roles. They are rarely justified elsewhere. A credit check shows your payment history and debts. It does not show your honesty or your ability to do most jobs. Using it as a general screening tool can breach PIPEDA.

If an employer asks for a credit check, ask what the job requires. Handling cash or signing authority may justify it. A customer service role does not. The employer must also tell you which agency will run the check and get your consent.

Social media screening is a grey area. Employers can look at public profiles, but they cannot demand your passwords or ask you to friend them. That would be an unreasonable collection of personal information. Some employers use third-party tools to scrape public data. Those tools can produce inaccurate results and raise human rights concerns.

Ontario's Human Rights Code protects against discrimination based on family status, disability, religion and other grounds. A social media post about your religion or a family photo can lead to bias. Employers should not use social media to screen candidates unless the role requires a public presence.

If you are asked to hand over social media credentials, you can refuse. No Ontario law requires you to give an employer access to your private accounts. Such a request is a red flag. For more on the risks, see this privacy settings article.

A background check policy that includes social media screening should explain what is reviewed and who reviews it. It should also give you a chance to respond to anything found.

Candidate rights: consent, accuracy and retention

You have rights throughout the background check process. The first is consent. An employer must tell you what is being checked, why and who will see the results. You can withdraw consent, though that may end your application.

The second is accuracy. You can ask for a copy of any report. If it contains an error, you can dispute it with the provider. Under PIPEDA, the provider must correct or annotate the record. The employer must use accurate information.

The third is retention. Employers should keep background check results only as long as needed. A reasonable period is a few months after hiring, unless the role requires ongoing checks. After that, the information should be destroyed securely.

The fourth is access. You can ask an employer what personal information they hold about you. They must respond within a reasonable time, usually 30 days. If they refuse, they must explain why.

The fifth is non-discrimination. A background check policy must not have a discriminatory effect. For example, requiring a credit check for a job that does not need one can exclude people with low incomes.

Here is a checklist for your own records:

• Ask for the written background check policy.
• Confirm the type of check and the provider.
• Ask what information will be collected and why.
• Request a copy of any report before the employer decides.
• Ask how long the information will be kept and how it will be destroyed.
• Note the date you gave consent and to whom.
• Keep a record of any corrections you request.

If you are asked to provide a criminal record check, follow these steps:

1. Get the employer's written request that states the role and the check level.
2. Contact the police service or accredited provider named by the employer.
3. Provide your identification and fingerprints if required.
4. Pay any fee, or ask about a volunteer waiver.
5. Review the report for errors before sending it to the employer.
6. Ask the employer to confirm in writing what they will do with the report.

These steps help you control your personal information. They also create a record if something goes wrong. For more on the rules, see this account security changes 2027 article.

Complaint routes when a background check goes too far

If an employer collects too much information, you can complain. The first route is the Office of the Privacy Commissioner of Canada. The OPC handles complaints under PIPEDA for private-sector employers in Ontario. You can file online or by mail. The OPC may investigate and recommend changes.

If you work for a federal employer, such as a bank or a telecom company, the same OPC process applies. If you work for the Ontario government or a municipality, you can complain to the Information and Privacy Commissioner of Ontario.

The second route is the Ontario Human Rights Tribunal. If a background check leads to discrimination based on a protected ground, you can file an application. You must show that the check had a discriminatory effect. The Tribunal can order compensation and policy changes.

The third route is the Ministry of Labour. If an employer violates the Employment Standards Act, you can file a claim. The guide to the Employment Standards Act explains the obligations employers owe workers, though it does not handle privacy complaints directly.

The fourth route is small claims court. If you suffered a financial loss because of a privacy breach, you can sue. The amount is limited to $35,000 in Ontario.

Before complaining, gather your evidence. Keep copies of consent forms, emails and reports. Note dates and names. A clear timeline helps your case.

The Canadian Centre for Cyber Security offers advice on protecting your personal information if your data is exposed. For workplace rights, the CCOHS rights and responsibilities page explains the balance between employer and employee interests.

If you are not sure where to start, contact the OPC. They can tell you which law applies. For examples of overreach, see this canadian anti-fraud centre report scam article.

Common questions

Can an Ontario employer ask for a criminal record check before a job offer? No. The Ontario Human Rights Code discourages checks before a conditional offer. The employer should assess your skills first and only check if the role justifies it.

What is the difference between a criminal record check and a vulnerable sector check? A criminal record check shows convictions and some charges. A vulnerable sector check is deeper and can reveal record suspensions for sexual offences. It is only for roles with vulnerable people.

Do I have to consent to a background check? Yes. An employer cannot run a check without your informed consent. You can refuse, but the employer may withdraw a conditional offer.

Can an employer ask for my social media passwords? No. That would be an unreasonable collection of personal information under PIPEDA. You can refuse such a request.

How long can an employer keep my background check results? Only as long as needed for the hiring decision. A few months is typical. After that, the information should be destroyed securely.

Where do I complain if a background check goes too far? Start with the Office of the Privacy Commissioner of Canada for private-sector employers. For discrimination, contact the Ontario Human Rights Tribunal.