Before you hire an investigator

Investigation scoping
Due diligence
Privacy and legal basis
Partner oversight
Client-side control

011 / 2026

Picture the usual sequence. A general counsel or a family office principal has a worry about a person, a transaction or a pattern of losses. Someone recommends an investigator. A phone call becomes a retainer, and the only written scope is an email that says "find out what's going on." A few weeks later there is a report, a folder of images and an invoice. Nobody on the client side can say what was authorised, on what legal basis, or where the raw material now lives.

The investigator may have done good work. The client still carries the file. In Alberta, licensing rules sit with the investigator, and privacy obligations stay with the organisation that hired them. This Brief sets out what the client should hold in writing before an engagement starts, using the provincial and federal sources that govern the work.

Who is allowed to do the work

Alberta's Security Services and Investigators Act is plain on the first point. Section 2(1) says no person may, without a licence and for remuneration, investigate, conduct surveillance activities, or seek or obtain information about crimes, offences or misconduct (or allegations of them), the cause of an accident, incident, property damage or personal injury, the activity, conduct, character or reputation of a person, the location of property, or the whereabouts of a person. Section 2(2) extends the rule to anyone who advertises, holds out or offers those services. Section 8 adds a separate business licence for any business that provides or employs licensed individuals to do the work.

The province's investigator licence page describes the job in practical terms. Investigators look into accidents and personal injury, damaged or stolen property, the backgrounds and whereabouts of people, and organisations. They collect information, interview people, conduct surveillance, obtain statements and research reports or records. Each individual must complete an approved training course, score 80 per cent or higher on the provincial exam and clear criminal record, vulnerable sector and local police checks. Public Safety and Emergency Services issues the licence under the Act. It runs for two years and stays valid if the investigator changes employers.

For the business behind the investigator, the government's business resources page sets the baseline: a registered Canadian business, an Alberta address, municipal licensing where it applies, and at least $1 million in liability insurance. The same page points to a Business Query and Licence Status search that can list licensed businesses and check whether an individual is licensed. Section 31 of the Act requires every individual licensee to carry the licence and produce it on request.

Two details in the Act are worth knowing before the first meeting. Section 40 bars licensees from using the expression "private detective" in connection with their business, or holding themselves out that way. If a pitch leads with that phrase, ask why. Section 11 lets the Registrar exempt an out-of-province investigator only in a narrow case: the investigator and the employer or client both reside outside Alberta, the inquiry runs partly outside and partly inside the province, and the investigator notifies the Registrar and applies. An Alberta client handing a matter to a Vancouver or Toronto firm should expect the people working here to hold Alberta licences, and should see any exemption on paper.

The Act also carves some work out. Section 10(b) exempts barristers and solicitors acting within their profession. Section 10(m) exempts an employer, and people it engages, doing investigative work solely about its own employees or contractors, subject to stated exceptions. Section 10(h) exempts a person engaged only to advise another person about that person's security requirements. Whether a carve-out fits your matter is a question for your counsel. A vendor's sales call should not settle it.

A licence does not move the privacy obligation

A licence tells you the investigator may do investigative work in Alberta. It tells you nothing about whether your organisation may collect the information you are asking for.

For most provincially regulated private-sector organisations in Alberta, that question sits under the Personal Information Protection Act (PIPA). The federal Privacy Commissioner's summary of Canadian privacy laws notes that PIPEDA does not apply to organisations operating entirely within Alberta unless the personal information crosses provincial or national borders, and that federally regulated businesses are always subject to PIPEDA. A matter that touches a subject in another province, a foreign database or a cross-border transfer can bring federal law into the same file. Ask counsel which statute governs before the scope is signed, because the answer changes the wording of everything after it.

Three parts of PIPA frame the engagement.

Section 5(2) says that where an organisation engages the services of a person, whether as an agent, by contract or otherwise, the organisation is responsible for that person's compliance with the Act with respect to those services. Section 5(6) adds that this does not relieve the contractor of its own obligations. Hiring a licensed firm shares the obligation; the client keeps its half.

Section 14(d) permits collection without consent where it is reasonable for the purposes of an investigation or a legal proceeding. "Investigation" is defined in section 1(1)(f) as an investigation related to a breach of agreement, a contravention of an enactment of Alberta, Canada or another province, or circumstances or conduct that may result in a remedy or relief at law, where the conduct has or may have occurred or is likely to occur and it is reasonable to conduct an investigation. Section 11(2) limits collection to the extent reasonable for the purpose.

The Office of the Information and Privacy Commissioner of Alberta has applied that definition. In Order P2018-04, a dispute over shopping-centre video, the adjudicator agreed with an earlier finding that when surveillance is continuous and captures all activities, an investigation into a particular incident is merely possible, and wrote that "'Merely possible' is not sufficient to authorize a collection without consent for the purpose of an investigation." The same paragraph notes that surveillance targeted at a particular time, person or place because the conduct is reasonably likely may be interpreted differently. For a client hiring an investigator, the practical step is to write down why the conduct is believed likely, and what specific question the work answers, before anyone collects anything.

One more boundary. OIPC Alberta's guidelines on video surveillance in the private sector say they apply to overt surveillance of the public in publicly accessible areas, and that they do not apply to covert surveillance such as that conducted by private investigators on behalf of insurance companies, or to surveillance of employees. Your building's camera policy does not authorise a surveillance engagement. That needs its own decision record.

The service agreement the federal Commissioner already drafted

The most useful public checklist for this work is the Office of the Privacy Commissioner of Canada's Guidance on Covert Video Surveillance in the Private Sector. It is written for PIPEDA, and the OPC says it is guidance only, with each complaint considered case by case. Its structure still transfers well to an Alberta engagement, because PIPA asks the same questions about purpose, reasonableness, contractors and safeguards.

The OPC calls covert video surveillance an extremely privacy-invasive form of technology that must be considered only in the most limited cases. Its purpose tests are specific. There must be a demonstrable, evidentiary need, and acting on a mere suspicion is not enough. There should be a strong likelihood that the collection achieves the stated objective. The loss of privacy should be proportional to the benefit gained, and less privacy-invasive measures should be considered first. The guidance also corrects a common belief: surveillance in a public place does not release an organisation from its privacy obligations.

On investigation firms, the OPC states that both the hiring organisation and the firm are responsible for making sure collection, use and disclosure comply with privacy law. It strongly encourages a service agreement that includes, among other terms:

• the hiring organisation's acknowledgement that it has authority to collect from, and disclose to, the firm the personal information of the person under investigation
• a clear description of the purpose and of the type of personal information requested
• collection limited to that purpose, third-party information avoided unless relevant, and unnecessary third-party information deleted or depersonalised as soon as practicable
• the firm's confirmation that it collects consistently with applicable law and trains its investigators on privacy and on the equipment they use
• safeguarding by both parties, with every instruction from the hiring company documented
• no subcontractor unless agreed in writing and bound by the same terms
• a designated retention period, secure destruction instructions, and a right for the hiring company to audit

The OPC also expects a documented record of each decision to undertake surveillance, with its progress and outcome. That record covers the alternatives tried and their result, the kind of information collected, the duration, the names of everyone who viewed the material, what it was used for, and when and how images were disposed of.

What the client should own in writing

Here is the file I would expect a client to hold before an Alberta engagement begins. The licensed partner keeps its own records; section 32 of the Act requires a business licensee to keep complete records of all security or investigative work undertaken. Those records belong to the partner's compliance file. The client needs its own.

Start with the question. One or two sentences that name the decision the work supports and the facts it has to establish. "Is the claimant working while on disability leave?" is a question. "Look into him" is not. A scope that cannot be written in plain language is hard to defend later.

Next, the legal basis. Counsel's note on which privacy statute applies, whether the work relies on consent or on an investigation exception, and why the conduct is believed to have occurred or to be likely. Record the less invasive steps tried first and what they produced. Both the OIPC order and the OPC guidance point toward this record.

Then the partner, verified. The business licence and each individual licence checked against the province's search, proof of insurance, and any Registrar exemption for team members working from outside Alberta. Note the date you checked.

Write down the methods in and the methods out. Name the approved methods, such as public records, interviews, open-source research, or surveillance at stated times and places, and name what is excluded. Pretexting, access to private accounts and anything touching private communications should be addressed in writing with counsel. The OIPC Alberta guidelines remind organisations that cameras capturing sound raise Criminal Code provisions on the collection of private communications. Treat audio as excluded unless counsel says otherwise.

Set the rule for third parties. Family members, colleagues and bystanders will appear in the material. The OPC's position is that PIPEDA does not allow collecting the personal information of people merely found in the company of the subject without their knowledge or consent. The agreement should say how they are avoided, and how they are blurred or deleted when they are not.

Fix evidence custody before the first collection. Where raw notes, images, recordings and statements are stored, who holds originals, how copies move between the partner, counsel and the client, who may view them, and how each hand-off is logged. If the matter could reach a tribunal or a court, counsel should set these terms.

Agree the reporting cadence. A dated rhythm of short status notes and a written report at close, plus stop conditions: what the partner must report immediately and what ends the engagement. Ask for a report that separates what was verified, what was alleged and what remains unresolved, and that states its own limits.

Get a conflicts declaration. The partner should confirm in writing that it has not acted for the subject, an opposing party or a related entity, and agree to disclose if that changes mid-file. Apply the same check to anyone on the client side who will see the results.

Set retention and destruction. PIPA section 35 allows an organisation to keep personal information only as long as it reasonably needs it for legal or business purposes, then requires destruction or de-identification within a reasonable time. Put the period and the destruction instruction in the agreement, and ask for written confirmation at the end.

Name the client-side owner. One person approves scope changes, receives reports, and answers if the subject later asks what was collected. PIPA section 5(3) already requires every organisation to designate someone responsible for compliance. That person, or a named delegate, should sit on the file.

Where an advisor fits, and where it stops

Forged-CS works on the client side of this table. We help define the investigative question, write the scope and the oversight standard, check the partner's licensing and terms, and hold the partner to the agreed cadence, custody and reporting. Regulated investigative work in Alberta, including surveillance and interviews, is carried out by vetted licensed partners under the Act. We do not present ourselves as the investigator, and we do not give legal advice. Counsel sets the legal basis, the partner does the licensed work, and the client owns the file.

Forged-CS is the client-side control layer — risk architecture and partner oversight, not more coverage.

The same pattern runs through earlier Briefs. Third-party ID vendor diligence asked who on the client side owns the identity data a vendor holds. OT isolation diligence asked who owns the offline plan when a partner runs the vital systems. An investigation engagement puts a partner in charge of sensitive personal information on your behalf, usually about someone who does not know it is happening. It deserves at least the same written standard.

Control before coverage

More hours from an investigator will not repair a scope nobody wrote down. Before the retainer is signed, write the question, get counsel's note on the legal basis, verify the licence and insurance, put the service agreement terms into the contract, and name the client-side owner. Then decide how much investigative work the question needs.

If you are scoping a private investigation or due diligence matter in Alberta, or want the engagement tested inside a wider security risk assessment or intelligence picture, start with the written scope. The operating idea behind it is set out in Control before coverage.

Hassan Sukhera | Forged-CS | forged-cs.com

FAQs

Does an Alberta investigation have to be done by a licensed investigator?

For remunerated work, generally yes. Section 2 of Alberta's Security Services and Investigators Act says no person may, without a licence and for remuneration, investigate, conduct surveillance or seek information about matters such as misconduct, the cause of an accident, a person's conduct or reputation, or a person's whereabouts. Section 10 exempts some people, including lawyers acting within their profession and, in some cases, employers investigating their own employees or contractors. Whether an exemption fits a specific matter is a question for counsel.

How do I check that an Alberta investigator or firm is licensed?

The Government of Alberta's security, investigation and locksmith business resources page points to a Business Query and Licence Status search that can list licensed businesses and check whether an individual is licensed. Section 31 of the Act requires individual licensees to carry their licence and produce it on request. Licensed businesses must also carry at least $1 million in liability insurance, so ask for proof.

If the investigator is licensed, is my organisation covered on privacy?

No. A licence permits investigative work; it does not authorise your organisation's collection. Under Alberta's PIPA, section 5(2) makes an organisation responsible for the compliance of anyone it engages by contract, and section 14(d) allows collection without consent where it is reasonable for an investigation or legal proceeding as the Act defines them. If personal information crosses provincial or national borders, PIPEDA can also apply. Confirm the governing statute with counsel before the scope is signed.

What should a service agreement with an investigation firm include?

The federal Privacy Commissioner's guidance on covert video surveillance suggests terms including: the client's acknowledgement of its authority to collect and disclose; a clear purpose and the type of information requested; collection limited to that purpose and third-party information avoided or deleted; documented instructions; safeguards on both sides; no subcontractors without written agreement; a retention period with secure destruction; and a client right to audit. Add evidence custody, reporting cadence, a conflicts declaration and a named client-side owner.

Does Forged-CS carry out investigations or surveillance?

No. Forged-CS works on the client side: defining the investigative question, writing the scope and oversight standard, checking a partner's licensing and terms, and holding the partner to cadence, custody and reporting. Regulated investigative work in Alberta, including surveillance and interviews, is carried out by vetted licensed partners under the Security Services and Investigators Act. Forged-CS does not give legal advice; counsel sets the legal basis.