Security Ethics & Professional Conduct — the standard you carry on every shift.

Security Ethics & Professional Conduct is Module 38 of the Stafferin Security Field Training series. It is a standalone course: you do not need to have completed other modules to take this one, and completing it does not require completion of other modules.

Who this course is for

This course is designed for:

• Licensed security guards in Ontario who want to understand the PSISA Code of Conduct and its practical application.
• Licensed private investigators in Ontario who need to understand conflict-of-interest, data-handling, and Criminal Code exposure in their investigative work.
• Security supervisors and managers who want to understand the ethical obligations of the guards and investigators they supervise — and their own vicarious liability for conduct they direct or permit.
• New security industry entrants who are completing their initial training before applying for a PSISA licence.
• Experienced guards who want to consolidate and formalise their understanding of the legal frameworks that govern their professional conduct.

How to complete this course

Work through the six lessons in order. Each lesson contains:

• A hook paragraph that frames the lesson's central problem.
• Three subsections that develop the legal content in depth.
• A mini-drill that places you in a realistic security scenario and asks you to make the right call. The drill gives immediate feedback with full explanations.
• A supporting component (flip cards, matrix table, checklist, or stat tiles) that consolidates the key points.
• A closing paragraph that summarises the lesson's practical takeaway.
• A "Mark Complete" button that records your progress and advances the progress ring.

After completing all six lessons, the "Take the Exam" button unlocks. The 30-question certificate exam tests all six lesson themes. You need 20/30 or higher to pass. There is no time limit on the exam and no penalty for retaking it.

What this course covers — the five legal frameworks

The course integrates five legal frameworks that apply simultaneously to every Ontario security professional:

• Ontario Regulation 363/07 (the PSISA Code of Conduct) — the foundational professional ethics rule that binds every licensed guard and investigator from the moment the licence is issued.
• Criminal Code of Canada (ss.122, 334, 346, 380) — the criminal provisions that capture the most serious forms of security misconduct: breach of trust, theft, extortion, and fraud.
• PIPEDA (Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5) — the federal privacy statute that governs how security professionals handle the personal information they collect in their roles (CCTV, access logs, incident reports, visitor registers).
• Ontario Human Rights Code (R.S.O. 1990, c. H.19) — the provincial statute that prohibits discrimination in services (including security services) based on race, disability, gender identity, creed, and other protected grounds.
• Whistleblower/reporting framework — PSISA s.31 (mandatory cooperation with the Registrar), the PSOA (S.O. 2006, c. 35, Schedule A) whistleblower protection framework, and the common-law protection for private-sector employees who report illegal conduct in good faith.

A note on jurisdiction

This course is written for Ontario's regulatory framework. The PSISA and O. Reg. 363/07 are Ontario statutes. The Criminal Code, PIPEDA, and the ASIS International Code of Ethics apply across Canada. The Ontario Human Rights Code applies in Ontario; other provinces have equivalent human rights statutes. If you work in another province, substitute the relevant provincial human rights legislation for the OHRC, but the foundational principles are the same across all Canadian jurisdictions.

Every licensed security guard and private investigator in Ontario operates under two sets of rules simultaneously — the employer's internal policy and the provincial statutory Code of Conduct. The second set is not optional. Ontario Regulation 363/07, made under the Private Security and Investigative Services Act, 2005 (PSISA), binds every licensed individual from the moment the licence is issued. A breach does not merely expose you to an internal disciplinary hearing: it can result in licence suspension or revocation, a Registrar order, and — depending on the conduct — a criminal charge. Knowing the exact words of the Code is the difference between a defensible decision and an indefensible one.

What the PSISA Code of Conduct requires

Ontario Regulation 363/07 sets out enumerated duties for security guards. The core obligations fall into four clusters. Lawful authority: a guard must not use force except as permitted by law (Criminal Code s.25 — protection of persons acting under authority — and, for citizen's arrests, s.494), must not detain a person without lawful authority, and must not search a person or their property without consent or lawful authority. Integrity: a guard must not consume alcohol or drugs while on duty, must not accept a gratuity that could reasonably be seen as compromising their duties, and must not use their licence or uniform to advance a personal interest. Conduct: a guard must behave in a professional manner, must not make statements known to be false, and must not threaten or intimidate any person. Compliance: a guard must cooperate with police and must carry and produce their licence on demand.

The Registrar of Private Security and Investigative Services administers the PSISA. The Registrar may revoke or refuse to renew a licence under PSISA s.23 if a licensee has been found guilty of an offence that is relevant to their suitability — which includes Criminal Code offences of dishonesty (theft, fraud, extortion) and offences involving violence. Because the revocation is administrative, not criminal, the standard of proof is the balance of probabilities, not beyond a reasonable doubt. A conviction is not required; a finding of conduct incompatible with the Code is enough.

The licence as a conditional grant

A security guard's licence under PSISA s.10 is a conditional grant from the Province. The licensee agrees, as a condition of holding the licence, to abide by O. Reg. 363/07. This matters because it means the Code of Conduct applies even when a guard is off duty in uniform, even when no member of the public is watching, and even when the employer has said nothing about a specific situation. Courts and the Registrar both treat the licence as importing the Code's obligations into every situation where the guard is identifiable as such — in uniform, in a marked vehicle, or in any context where they have identified themselves as a security professional.

Revocation grounds you must know

The most common revocation triggers in Ontario Registrar decisions are: (a) Criminal Code offences of dishonesty (theft, fraud, extortion, breach of trust); (b) Criminal Code offences involving violence or threats (assault, criminal harassment, uttering threats); (c) misuse of the licence or uniform for a personal purpose; (d) failure to cooperate with a Registrar investigation; and (e) making false statements in a licence application or renewal. A revocation permanently bars the individual from holding a PSISA licence unless they obtain leave from the Licence Appeal Tribunal (LAT). The LAT hearing is de novo — the individual can present fresh evidence — but the burden shifts to the applicant to show they are suitable.

The four pillars of the PSISA Code of Conduct

The PSISA Code of Conduct is not a suggestion list — it is a statutory condition of holding your licence. Every interaction where you are identifiable as a security professional is governed by O. Reg. 363/07. Lawful authority, integrity, professional conduct, and compliance are the four pillars. Breach any one of them and the Registrar has grounds to act, regardless of whether you are ever charged criminally.

The security officer who accepts a free meal from the vendor whose delivery dock they guard, the guard who lets a client's supplier through without proper screening because the supplier "always takes care of them," the investigator who passes information about a subject to a business competitor — these are not isolated bad actors. They are predictable products of a conflict of interest that was never identified, disclosed, or managed. O. Reg. 363/07 prohibits accepting gratuities that could compromise duties, but the legal rule is only the floor. Understanding why conflicts corrupt, and how to spot them before they trap you, is the professional skill.

What is a conflict of interest

A conflict of interest arises when a security professional's personal interest — financial, relational, or reputational — could influence, or could reasonably appear to influence, the discharge of their professional duty. The test is objective: not whether the guard actually made a biased decision, but whether a reasonable observer would conclude that the conflict might do so. The ASIS International Code of Ethics applies this same objective test to private security professionals. A conflict does not have to be acted upon to be a problem — its mere existence, undisclosed and unmanaged, is the breach.

Three categories of conflict are most common in security work. Financial conflict: a guard has a side-business relationship — supplier, contractor, tenant — with a person or entity they are assigned to oversee. Relational conflict: a guard is assigned to a post where a family member, romantic partner, or close friend is employed or is a subject of investigation. Positional conflict: a guard uses information obtained in their security role — access logs, incident reports, personal data — to benefit a business, employer, or third party other than the client who owns that information.

The gratuity rule under O. Reg. 363/07

O. Reg. 363/07 prohibits a security guard from accepting any gratuity, benefit, or reward that could reasonably be seen as compromising their security duties. The prohibition is not absolute — incidental hospitality is not a legal problem. The test is proportionality and appearance: a gratuity is prohibited when its value or circumstances could reasonably lead an objective observer to conclude that the guard's professional judgment was influenced. This is a lower threshold than bribery under the Criminal Code (which requires intent to influence). The employer's internal gift policy may be stricter than the Code; where it is, the stricter rule governs.

Practical bright lines widely adopted in Canadian security firms: no gift with a value over $25–$50 from any single source in a calendar year; no cash gifts under any circumstances; no gifts offered by a person whose facility access, complaint status, or investigation outcome the guard controls. When in doubt, the correct move is always to disclose — to the supervisor or, if the potential benefit is from the supervisor, to the supervisor's manager — before accepting anything.

Disclosing and managing conflicts

The obligation to disclose a conflict of interest exists whether or not the guard believes their judgment is actually compromised. The ASIS International Code of Ethics states that members must "avoid conflicts of interest" and must "act in a manner that will not bring discredit to the security profession." Disclosure does not resolve a conflict — it initiates the management process. The employer decides whether to reassign the guard, add oversight, or in rare cases conclude that the conflict is too significant to manage at all. Undisclosed conflicts discovered after the fact are treated far more harshly by regulators, clients, and courts than disclosed ones that were actively managed.

Gratuity spectrum — acceptable, borderline, and prohibited

Conflicts of interest and gratuity traps are features of the job, not exceptions. Every assignment creates relationships; some of those relationships will generate offers. The professional move is always the same: identify the conflict early, disclose it promptly, and decline anything that could compromise — or appear to compromise — your professional judgment. Integrity is easier to keep than to restore.

A security officer is not a public officer in the constitutional sense — but the Criminal Code of Canada creates specific offences that apply squarely to contractor integrity failures. Section 122 (breach of trust by a public officer) has been interpreted by courts to extend to those who exercise a public function under contract. Section 346 (extortion) captures any threat or inducement used to obtain something of value — and a guard who implies that "problems can go away" for a consideration is extorting. These are not theoretical risks. Canadian court records show guards charged with extortion, fraud, theft, and breach of trust arising directly from their security roles.

Criminal Code s.122 — breach of trust

Section 122 of the Criminal Code makes it an indictable offence for a public officer to commit a breach of trust in connection with the duties of their office. Courts have applied s.122 to private-sector contractors performing public functions — security guards at government facilities, court sheriffs, and contracted enforcement officers have all been found to occupy a sufficient public nexus. Even where the Crown cannot prove the public-officer element for a contracted private-sector guard, the facts that would satisfy s.122 often simultaneously satisfy s.380 (fraud) or s.334 (theft). A guard who diverts client property, manipulates incident records for personal benefit, or leaks access-control information to a third party is at minimum committing fraud or theft — and potentially s.122 if there is a public nexus.

Sentences for breach of trust range from conditional discharges to several years of imprisonment, depending on the magnitude of the breach and whether there was personal gain. The maximum sentence under s.122 is five years imprisonment. The Registrar of Private Security and Investigative Services treats a Criminal Code conviction involving dishonesty as an automatic basis for licence revocation under PSISA s.23.

Criminal Code s.346 — extortion

Section 346(1) provides that every person who, without reasonable justification or excuse, and with intent to obtain anything, by threats, accusations, menaces, or violence induces or attempts to induce any person to do anything or cause anything to be done is guilty of an indictable offence and liable to imprisonment for life. The broad language of s.346 captures the full spectrum of security-post extortion: a guard who implies a report will disappear if payment is made, a guard who threatens to call police over a fabricated incident unless a sum is paid, and a guard who demands a "facilitation payment" to expedite routine access. There is no minimum amount — the offence is complete at the attempt; no actual payment needs to change hands.

Practical risk scenarios for security workers

Three scenarios where guards have faced criminal charges in Canada. (1) Access-log manipulation for gain: a guard deletes CCTV footage or access-control records in exchange for cash or goods from a person who would otherwise be flagged. This is simultaneously extortion (if a demand was made), fraud (creating false records), and breach of trust. (2) Theft from client premises: a guard uses after-hours patrol access to take property from the client site. Criminal Code s.334 applies; PSISA Registrar revocation follows automatically. (3) Information leakage to a competitor: a guard passes business information — supplier lists, staff schedules, security vulnerability assessments — obtained in their role to a third party. This can be s.380 fraud, breach of confidentiality under the employment contract, and a PIPEDA violation simultaneously.

Criminal Code sections every security worker must know

The Criminal Code does not leave a gap for security professionals. Extortion requires no minimum amount and is complete at the attempt. Breach of trust extends into contractor roles at public-function facilities. Fraud and theft follow from almost any misuse of site access. The protection against all four is the same: document everything, accept nothing from a person whose access or outcome you influence, and report any offer immediately.

Security work is data work. Every access-control log, every CCTV recording, every incident report, every visitor register, every licence-plate read, and every personal-information disclosure during an investigation is personal information within the meaning of the Personal Information Protection and Electronic Documents Act (PIPEDA). A guard who shares CCTV footage with a curious neighbour, who texts photos of an incident scene, who tells a media outlet about a subject's identity, or who accesses logs out of personal curiosity is misusing personal information — and the organisation they work for is liable under PIPEDA's accountability principle. Knowing what the Act requires is as important as knowing how to operate the equipment.

PIPEDA's four most relevant fair-information principles

PIPEDA Schedule 1 sets out ten principles of fair information practice. The four most directly relevant to security workers are: Accountability (Principle 1) — the organisation is responsible for personal information it controls, including information in the hands of third parties such as contracted security guards; Identifying Purposes (Principle 2) — personal information may only be collected for purposes a reasonable person would consider appropriate in the circumstances; Limiting Collection (Principle 4) — collection must be limited to what is necessary for the identified purposes; and Safeguards (Principle 7) — personal information must be protected by security safeguards appropriate to the sensitivity of the information.

Security workers are typically custodians of personal information on behalf of the client — they do not own the data and have no independent right to access it beyond what is necessary to discharge their duty. The accountability principle means the client is liable for what the guard does with the data; but the guard is personally liable for any Criminal Code offence (s.342.1 — unauthorized use of computer, s.380 — fraud) and may face civil liability in tort if their misuse causes loss. PIPEDA's Office of the Privacy Commissioner of Canada (OPC) can investigate complaints and issue findings; OPC findings are routinely cited in subsequent Federal Court proceedings.

CCTV, access logs, and the guard's duty

CCTV footage is among the most sensitive data a security guard handles. The OPC has consistently held that CCTV systems in public or semi-public spaces are subject to PIPEDA's limiting-collection and safeguards principles. A guard may access CCTV footage only for the purposes for which it was collected — facility security. Accessing footage to observe a specific individual out of personal curiosity, sharing footage with a third party (media, police without a warrant or consent, a curious colleague), or downloading footage onto a personal device are all PIPEDA violations. The same rules apply to access-control logs: they record the movement of named individuals and are personal information under PIPEDA s.2(1).

Responding to information requests

Guards are frequently asked to share security records — by police, by lawyers, by managers, by media, by members of the public. The correct protocol depends entirely on who is asking and what authority they have. Police with a warrant or production order: the organisation must comply; the guard should hand off to the site manager or security supervisor to process the legal document. Police without a warrant: PIPEDA permits but does not require voluntary disclosure to law enforcement for specified purposes (s.7(3)(c.1)); the guard should not unilaterally decide to disclose — route to the supervisor. Lawyers: require a court order or consent; hand off to the supervisor. Media or public: no disclosure; all media inquiries must be routed to the client's communications team. The guard's job is to hold the data until legally authorised disclosure is directed by the appropriate person.

Data-access request protocol — quick reference

Security data — CCTV, access logs, incident reports, visitor registers — belongs to the client organisation and is protected by PIPEDA. Your role is custodian, not owner. Access only what is necessary for your assigned duty. Decline every unauthorised request and route it to the right person. Document every request regardless of outcome. The safeguards principle is not bureaucratic overhead — it is the foundation of the client's trust in contracted security.

The Ontario Human Rights Code protects every person in Ontario from discrimination based on race, ancestry, place of origin, colour, ethnic origin, citizenship, creed, sex, sexual orientation, gender identity, gender expression, age, marital status, family status, and disability. A security guard who applies these protected characteristics — even subconsciously — in deciding who to question, who to follow, who to ask for identification, who to eject, or who to detain is committing discrimination under the Code. Unlike criminal law, the Human Rights Code does not require proof of discriminatory intent. The test is discriminatory effect: if the guard's conduct would not have occurred, or would have been different, but for a Code-protected characteristic, it is discrimination — and both the guard and the employer are liable.

What racial profiling looks like at a security post

The Human Rights Tribunal of Ontario (HRTO) and Canadian courts have consistently held that racial profiling — using race, colour, or ethnic or national origin, consciously or unconsciously, as a factor in a security decision — is a form of race discrimination under the Code. Indicators that a decision may have been racially motivated include: differential treatment of comparable individuals (a racialized person is asked for ID where a white person in identical circumstances is not); a pattern of stops or ejections disproportionate to the demographic make-up of the venue; and after-the-fact rationalisations that do not withstand scrutiny against the objective circumstances. The HRTO regularly awards damages for injury to dignity and self-respect in racial-profiling cases, in addition to ordering systemic remedies against the employer.

The practical implication: a security firm whose guards disproportionately stop or eject racialized persons can be found to have engaged in systemic discrimination even without proof of discriminatory intent by any individual guard. The Code's effects-based test means that an objectively unjustifiable pattern of differential stops is itself the evidence of discrimination.

Accommodation obligations at the post

The Code imposes an obligation on service providers — which includes security operations as a service to the public — to accommodate persons with disabilities to the point of undue hardship. This means a security protocol that cannot be met by a person with a mobility, communication, or cognitive disability must be modified unless modifying it would cause undue hardship to the operator. A guard who applies the standard identification or screening protocol inflexibly when they know a person has a disability, without exploring reasonable modifications, may be engaged in Code-prohibited discrimination on the basis of disability. The accommodation duty is also engaged by religious dress (creed) — requiring a person wearing a turban, kippah, hijab, or other religious garment to remove it as a condition of entry, without lawful authority and without exploring alternatives, is potentially religious discrimination.

The lawful authority exception

Differential treatment is not always discrimination. Where a security guard has specific, articulable, non-Code-based grounds for a decision — a verified description of a suspect, a specific incident report triggering follow-up, or a behaviour-based observation that is equally applicable regardless of protected characteristics — the Code does not prohibit that decision. The test is whether the protected characteristic was a factor in the decision, not whether other factors were also present. A guard can ask any person for identification when they have reasonable grounds related to facility security. What they cannot do is ask only racialized persons, or only young men of a particular appearance, when persons of other characteristics in identical circumstances are not asked.

Human Rights Code obligations at the security post

Human rights compliance at the post is not a bureaucratic constraint on security work — it is the professional standard. Apply protocols consistently across protected characteristics. Document any exception and its specific, articulable grounds. Accommodate persons with disabilities and religious obligations unless doing so creates undue hardship. The guard who does these things is both legally protected and operationally effective.

The hardest call in security ethics is not refusing a $100 gift card — it is reporting a colleague, a supervisor, or a client-side manager for a serious breach. Ontario's Public Service of Ontario Act, 2006 (PSOA) protects public servants who disclose wrongdoing. For private-sector security workers, the protective framework is thinner but real: PSISA s.31 protects a licensed individual who cooperates with a Registrar investigation, and the common law increasingly protects private-sector whistleblowers from retaliatory dismissal through the constructive-dismissal doctrine and the duty of good faith in employment. Knowing the duty — and the protection — is what makes the call possible.

The Ontario Public Service whistleblower framework

The Public Service of Ontario Act, 2006, S.O. 2006, c. 35, Schedule A, Part V establishes a formal whistleblower regime for Ontario public servants. Under ss. 108–116, a public servant who discloses, in good faith, conduct that they reasonably believe is a wrongdoing — including a contravention of provincial or federal law, a gross mismanagement of public funds, a serious and substantial danger to health and safety, or conduct directed at retaliating against a whistleblower — is protected from adverse employment action. The disclosure must be made to the person's supervisor, the Integrity Commissioner, or in specified urgent circumstances directly to a law enforcement body. The PSOA framework sets the standard against which private-sector whistleblower protections are increasingly measured by Ontario courts.

Private-sector security workers employed by a contractor do not have PSOA protection directly. However, Ontario courts have held that a private-sector employee dismissed for reporting illegal conduct by their employer or a client has a cause of action in wrongful dismissal — the termination is without just cause where the employee acted in good faith, in the public interest, and in compliance with legal obligations. The legal trend in Canada, across several provinces, is toward recognising a common-law duty not to dismiss employees for lawful whistleblowing, independently of any statute.

PSISA cooperation obligation

PSISA s.31 requires a licensee to cooperate with a Registrar investigation. A licensee who refuses to answer questions, destroys records, or otherwise obstructs a PSISA investigation commits a PSISA offence and is subject to a fine under s.44. Cooperation with the Registrar is not optional — even where the investigation concerns a colleague or a supervisor. A guard who is asked to give a statement about another licensee's conduct must do so honestly and completely. Giving a false or misleading statement to the Registrar is itself a PSISA offence under s.44(1)(b).

When and how to report

The practical decision tree for a security worker who witnesses or suspects a serious ethical breach is: (1) Is it a criminal matter? Criminal conduct — theft, extortion, assault, fraud — should be reported to police. (2) Is it a PSISA Code of Conduct breach by a licensee? Report to the Registrar of Private Security and Investigative Services at the Ministry of the Solicitor General. (3) Is it an employer internal policy breach? Report through the employer's internal reporting mechanism, typically the supervisor or HR. (4) Is there a risk of retaliation? Document the disclosure and keep a personal copy outside the employer's systems. (5) Is the breach by the supervisor? Report to the supervisor's manager, to HR, or directly to the Registrar (for PSISA breaches) or police (for criminal conduct). The duty to report is not discharged by reporting to a person who is part of the wrongdoing.

Whistleblower decision tree — quick reference

Reporting a colleague is the hardest call in security ethics — and the most important one. The PSISA cooperation obligation is not optional. Document your disclosure, route it above the person who is part of the wrongdoing, and keep a personal record outside the employer's systems. The law increasingly protects private-sector whistleblowers from retaliatory dismissal; the guard who stays silent to avoid difficulty is at greater long-term professional risk than the one who reports. Take the exam to complete this module.