Security Evidence Governance for Ontario Cannabis Facilities

Canada eased several cannabis security requirements on March 12, 2025. For an Ontario operator still paying to maintain an older setup, the practical question is understandable: what can change without leaving the business short of evidence?

Health Canada’s summary of the changes describes relief for specified federal licence classes, including motion-activated recording retention and removal of the requirement to keep a list of people entering and leaving storage areas. Required video still has a one-year minimum retention period for the covered licences.

Before changing anything, confirm which rules apply to your licence, check what your system actually preserves, and assign responsibility for retrieving and protecting it. A lower regulatory burden can support a simpler arrangement. It still needs to produce usable evidence when an incident or review requires it.

What changed, and why does it matter now?

The changes give affected operators room to reconsider parts of their security arrangements. They also make older checklists a risky basis for decisions.

The Canada Gazette’s explanation of the amendments reports support from consultation respondents for physical-security changes. It also records a suggestion to reduce video retention from twelve months to six months that was not adopted. That distinction matters: an idea raised in a consultation is different from a rule that took effect.

This is a regulatory development, rather than evidence of a new Ontario crime trend. The useful consequence to understand is narrower. If a facility changes its recording or deletion settings using an outdated summary, it could lose material it was required to retain. Conversely, keeping every old procedure without review can create unnecessary work.

The aim is to connect each retained record to a current obligation or justified operational purpose. Someone should be able to explain why it exists, who can use it and when it may be deleted.

Which rules apply to your facility?

Start with the licence and activities at the site. The word “cannabis” on a security quote does not identify the governing requirements.

The federal Cannabis Regulations, section 62, identify the licences covered by the increased-security provisions. These include standard cultivation, standard processing, sale authorizing possession, and certain cannabis drug licences. Other federal licence classes have different requirements. Check the actual licence, relevant exceptions and any conditions with the person responsible for compliance.

Retail is a separate context. Ontario’s retail guidance identifies the AGCO as the regulator licensing cannabis retail operators and authorizing stores. Do not carry a store’s retention settings across to a federally licensed production site because both businesses handle cannabis.

Our earlier Ontario cannabis facility security guide provides background on security-system categories, but predates the March 2025 changes. Its general statements should not determine current licence-specific retention or regulatory responsibilities. Use the current official sources linked here when reviewing those decisions.

This article focuses on evidence handling for federally licensed facilities in Ontario, particularly those subject to the increased-security provisions. It is not a complete retail compliance checklist or site-specific legal advice.

What must you be able to produce later?

Treat video and the written account of a security occurrence as separate records. They answer different questions.

Under section 73, covered licence holders retain required visual recordings for at least one year after they are made. Where the recording device is motion-activated, the provision covers recordings depicting movements; without that feature, all those recordings must be retained. The required occurrence document under subsection 72(3) has a minimum retention period of two years after preparation.

Subsection 72(3) specifies the occurrence date and time, the measures taken in response, and when those measures were taken. A saved clip alone does not describe the response.

Use this practical separation when reviewing your arrangements:

Record	Question it helps answer	What to check
Required video	What was visible during the relevant period?	Correct camera, readable playback and actual oldest available recording
Required occurrence document	What happened and what did the team do?	Event time, response actions and response times
Export and disclosure record	What copy was provided, to whom and why?	Approver, scope, recipient and transfer details
Maintenance and review record	What gap was found and how was it addressed?	Fault, affected period, responsible person and follow-up result

The last two rows are recommended management practices, rather than a claim that section 73 assigns them the same retention period. Set their handling according to applicable obligations and purpose.

Could the footage disappear even when the settings look right?

Yes. A retention setting needs enough working storage and a recording process that actually captures the required material.

The AXIS Camera Station Pro manual provides a concrete example: recordings can be deleted before the configured number of days when allocated storage becomes full. This is product-specific documentation, but it illustrates why a screenshot of a setting cannot demonstrate the history available at your site.

Ask an authorized operator to retrieve an older recording from each important camera group. Compare the available history with the requirement for that group. Then ask the service provider how the system reports a camera fault, storage problem or interrupted recording. Keep the result so the next review can identify whether the gap has returned.

Motion-based retention deserves a controlled test before adoption. Have a qualified provider check representative movements in the relevant lighting and operating conditions. Review the saved footage, including the beginning and end of the activity. A cost-saving change should preserve the evidence the site requires.

Health Canada’s physical-security principles and practices addresses recording performance, power interruptions, retrieval and storage. It reinforces the need to assess the arrangement as it operates, including when conditions are difficult.

Do not manufacture a live security failure for a test. Schedule controlled checks with the appropriate personnel and preserve existing records before maintenance.

Who can view the evidence, and what happens when someone asks for it?

Name the people who can approve access, retrieve a recording and release a copy. Give them a documented backup so a request does not wait indefinitely for someone who is away.

For illustration, imagine a facility receives a request concerning an event near a storage door. A useful response starts by establishing the requester’s authority and the relevant time and area. The authorized operator preserves the original material, creates the approved copy and checks that it plays. The release record identifies what was sent and the basis for sending it. This is a suggested workflow, not an account of a Securitron customer incident.

Avoid circulating footage through personal messaging accounts or giving everyone broad access because one person needs a clip. Ask your provider which permissions distinguish viewing, exporting and deleting, and whether administrative activity can be reviewed.

The Office of the Privacy Commissioner of Canada’s retention and disposal guidance explains that retention depends on purpose and legal requirements, and that unnecessary accumulation increases exposure. Mandatory retention still needs to be met. Have the appropriate adviser resolve preservation duties, disclosure authority and the privacy framework applicable to your organization.

Keep a documented way to suspend routine deletion for relevant evidence when an authorized preservation requirement arises. Record who approved it and arrange a later review. A retention exception should remain explainable rather than becoming an indefinite collection of forgotten copies.

What should happen when the system stops recording?

Escalate the gap promptly and document what is known. Repairing the equipment and accounting for the missing period are separate tasks.

A useful fault record identifies the affected cameras or records, when the failure was discovered, the last confirmed working period, the people notified and the steps taken. Avoid claiming an exact outage start unless the evidence supports it. Ask the compliance lead to determine any applicable reporting or operating implications; a service ticket alone does not resolve those questions.

After repair, verify new recording, playback and export. Ask whether older material remains accessible and whether the underlying cause was corrected. Someone should own that confirmation rather than closing the matter as soon as a live image returns.

Cameras can document activity under suitable conditions. They cannot guarantee prevention, reconstruct footage that was never recorded or explain staff actions without supporting information. That is why the written response and clearly assigned responsibilities matter alongside the equipment.

What should you review before spending more?

Start with a small evidence-readiness review using the existing system:

1. Confirm the licence-specific rule behind each retention setting.
2. Retrieve an older required recording and check playback outside the normal viewing screen.
3. Compare a past occurrence document with the required information and identify omissions.
4. Confirm who can approve an export, protect relevant material from deletion and cover absences.
5. Review an actual maintenance record to see whether restoration was verified.

Keep equipment that meets the need. Missing permissions, unclear responsibility or an untested export process may be addressed without replacement. Capacity or reliability gaps may justify targeted work after their cause is understood.

Ask for separate costs for configuration, storage, maintenance, export assistance and ongoing checks. Compare the effort of maintaining the proposed arrangement as well as the installation price. No universal savings figure can tell you whether a change suits your facility.

Securitron Canada can help review the recording and retrieval capabilities of an Ontario cannabis facility security system. Bring the current licence requirements and your existing procedures to the review so the technical work supports a clearly defined evidence need.