Biometric time clock rules in Canada change at provincial borders. Learn what Quebec Law 25 and its 60-day CAI notice require, when PIPEDA applies, how Alberta and BC PIPA treat employee information, and a five-step plan for consent and audit at UKG sites using Intouch devices or CloudApper AI TimeClock.
- What Stays the Same Across Provinces
- Where the Rules Diverge
- Build Consent and Audit Into the Rollout
- Where Hardware Choice Comes In
Sixty days. That is how far ahead Quebec expects notice to its privacy regulator before a database of biometric characteristics goes into service. Miss it, and a rollout ready in Ontario sits idle in Montreal. The rules change at provincial borders and apply whether the device is a UKG Intouch DX or a tablet running CloudApper AI TimeClock. This is general information, not legal advice.
What Stays the Same Across Provinces
UKG Ready and Pro WFM remain the system of record in every province. Intouch devices support biometric and non-biometric identification and can be deployed in line with Canadian requirements when configured and documented correctly. The privacy obligations attach to how biometrics are collected and stored, not to the brand of device.

Where the Rules Diverge
Quebec. The Act to establish a legal framework for information technology (sections 44 and 45) requires express consent before biometrics are used to verify identity, and a biometric database must be disclosed to the Commission d’accès à l’information at least 60 days before it goes into service. Law 25 also treats biometric data as sensitive and requires a privacy impact assessment for qualifying information system projects.
Federally regulated employers. PIPEDA governs employee information for federal works such as banks, airlines, and interprovincial transport.
Alberta and British Columbia. Each province’s PIPA allows employers to collect personal employee information reasonably required for managing employment, with notice. Regulators still expect the collection to be reasonable and proportionate.
Build Consent and Audit Into the Rollout
- Map sites to regimes. Tag each location by province and federal status.
- File early in Quebec. Submit the CAI disclosure and complete the privacy impact assessment before installation.
- Capture consent at enrollment. Record express consent with a timestamp, and offer a non-biometric option.
- Support withdrawal. Let employees switch to PIN or badge without penalty and delete their template.
- Set retention. Purge templates when employment ends or devices are retired.
A PIN and photo verification option gives employees who decline a workable alternative, and our guide to Canadian provincial labor law in UKG covers the pay rules side.
Where Hardware Choice Comes In
Compliance is a process question, so the device decision comes down to cost and coverage. That is where CloudApper AI TimeClock fits for organizations expanding biometric capture without a terminal at every location.
CloudApper AI TimeClock at Canadian Sites
CloudApper AI TimeClock runs on an iPad or Android tablet and syncs directly with UKG Ready and UKG Pro WFM. Consent screens, PIN and QR alternatives, and multi-language prompts are configured at the kiosk. CloudApper prices it at roughly 25% of the cost of traditional UKG clocking hardware such as the Intouch DX. Plan template deletion with our biometric template purge guide, review US-side rules in BIPA, CUBI, and Washington, and prepare IT with the tablet security review and kiosk mode setup.

Frequently Asked Questions
Q: Does Quebec require employee consent for a biometric time clock?
Yes. Quebec’s IT framework act requires express consent before biometrics are used to verify identity, and a biometric database must be disclosed to the CAI at least 60 days before it goes into service.
Q: Does PIPEDA apply to employee biometric time data?
Only for federally regulated employers such as banks, airlines, and interprovincial transport. Provincially regulated private employers fall under provincial law where it applies.
Q: Can employees refuse a biometric time clock in Canada?
Offer a PIN or badge option everywhere; in Quebec, where consent must be express, it is expected.
Q: Do Alberta and BC require consent for biometric time clocks?
Each PIPA allows collecting personal employee information reasonably required for managing employment with notice, but the collection must be reasonable and proportionate.
Q: Does a tablet time clock change Canadian privacy obligations?
No. The obligations attach to how biometrics are collected and stored, whether the device is an Intouch terminal or a tablet.
Start With the Site Map
Tag your Canadian sites by regime before the next hardware order. See how CloudApper AI TimeClock handles consent at Canadian UKG sites and book a walkthrough.




