Advisory
LPR data handling — emerging municipal and provincial scrutiny
Licence plate recognition is powerful and, increasingly, regulated. Here's what changed in 2026 and how it affects commercial deployments.
Affects
LPR has become table stakes on logistics yards and parkades. It's also attracted regulatory attention — the IPC in Ontario and municipal privacy offices have pushed guidance on retention, minimization, and sharing.
The core principles haven't shifted, but the expectation has: a commercial LPR deployment needs a retention policy, a named purpose for collection, a documented signage standard, and explicit controls on sharing with third parties including police.
The ad-hoc 'keep everything forever' defaults that ship on most platforms don't meet this bar. Neither does 'we'll hand whatever is asked over to any police request.'
Mitigation
What to do this week.
- 01Write a retention policy. Default to 30 days for ordinary reads, 90 days for incident-linked reads.
- 02Configure the platform to enforce the policy — not rely on a human to delete.
- 03Document the signage language. Align with OPC and IPC guidance.
- 04Write a police-disclosure policy. Requests without a warrant are refused unless a documented emergency exception applies.
Want us to apply this to your system?
A 30-minute remote review against this advisory, no obligation. We'll tell you on the call whether you're exposed and what the fix looks like.
Book a review