Physical Security and Branch Access Policy

Approval Date: September 28, 2026

Purpose

The purpose of this Policy is to establish a consistent enterprise-wide framework for the governance, assignment, management, review, and oversight of physical security and branch access across Toronto Public Library (TPL or “the Library”) facilities. This includes the administration of identification badges, electronic access credentials, mechanical keys, and physical security systems to support the safety and security of Library Users, staff, visitors, facilities, assets, and information. Access to Library facilities and restricted spaces is granted only for legitimate operational purposes and may be assigned, modified, or revoked to support safety, privacy, legal compliance, operational requirements, and sound security practices.

Scope

This Policy applies to all TPL facilities, including branches and non-branch locations, and applies to Library staff, volunteers, contractors, students, vendors, and service providers while on Library premises.

The Policy applies to all access control systems, and access credentials used to manage entry to and movement within Library facilities. This Policy operates in alignment with applicable legislation, collective agreements, City of Toronto corporate policies, and TPL procedures. Where conflicts occur, legislative requirements take precedence.

Underlying Principles

The Toronto Public Library strives to maintain safe, welcoming, and accessible Library spaces while protecting the privacy, dignity, and rights of Library Users, staff, volunteers, and visitors, and safeguarding Library facilities, assets, and information. TPL recognizes that a governance-based approach to physical security and branch access is required to support operations across a large urban library system. Physical security systems and access controls (such as identification badges, fobs, cards and keys) are used to support safety, operational continuity, and risk management in a way that is consistent with the Library’s values and legislative obligations.

Policy Statement

  1. General    
    • 1.1 Physical security systems and access controls will balance safety and risk management with maintaining welcoming Library environments by managing access to locations.
    • 1.2 Only authorized Library staff and service providers are permitted to operate, maintain, or modify physical security and access control systems.
    • 1.3 All authorized staff and service providers are expected to review and comply with this Policy, the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), and other relevant statutes, applicable guidelines and standards in performing duties that are related to the operation of physical security systems and access controls.
    • 1.4 To ensure a common understanding of how physical security and access control systems are used to support the safety and security of Library Users, staff, volunteers, and Library facilities and property, the Library will:
      • Consult and communicate changes in physical security and access control functions regularly with authorized staff and service providers; and
      • Ensure that staff and service providers are informed of applicable guidelines and standards and understand their application
  2. Design and Installation of Physical Security Systems Technology    
    • 2.1. The Library commits to developing and implementing physical security system design and privacy features in all areas identified as requiring physical security technology enhancements.
    • 2.2. Where the City of Toronto or Province of Ontario has provided for relevant security equipment design and installation standards, the library will meet or surpass those standards.
    • 2.3. Physical security systems will be designed or redesigned to ensure the safety of Library Users and facilitate equity, inclusivity, and accessibility.
    • 2.4. Where required, physical security technology such as fob access, and door locking hardware will be installed in locations or areas where there is a demonstrably need to add security. Given the open and public nature of the library's facilities and property, physical security systems may operate 24 hours a day if deemed appropriate for the purposes of safety and security.
    • 2.5. Physical security equipment will never monitor the inside of areas where individuals have a higher expectation of privacy (e.g. change rooms and washrooms).
    • 2.6. Every reasonable effort will be made to ensure physical security technology, hardware, or other equipment capable of retaining data, are not in a position that enables unauthorized individuals to gain access.
    • 2.7. Physical security systems and footage will be safeguarded in accordance with the requirements set out in TPL’s Information Security Policy for systems containing personal information.
  3. Physical Security System Access    
    • 3.1. Only authorized Library staff or service providers will be permitted to operate physical security systems or modify system settings and/or camera angles.
    • 3.2. Only authorized Library staff or service providers will be permitted to access and administer physical security systems.
    • 3.3. All requests for security system information are subject to the requirements of MFIPPA and the Library's Access to Information and Protection of Privacy Policy. The Library will prohibit all Library employees from accessing or using information from the security system, its components, files, or database for personal reasons.
    • 3.4. Requests for security system information are to be directed as per this Policy and the accompanying Physical Security & Branch Access Guidelines.
  4. Retention and Disposal of Security System Information    
    • 4.1. All information collected and retained by the Library's security systems are subject to the Library’s Records Management Policy and Records Retention Schedules.
    • 4.2. The Library will take all reasonable efforts to ensure the security of physical security and access records in its control/custody and ensure their safe and secure disposal. Old storage devices must be disposed of in accordance with an applicable technology asset disposal process ensuring personal information is erased prior to disposal and cannot be retrieved or reconstructed. Disposal methods may include shredding, burning, or erasing depending on the type of storage device.
    • 4.3. Any Library employee who becomes aware of any unauthorized access, use or disclosure of physical security information has a responsibility to notify Public Safety to ensure containment and update access permissions, as well as the Policy, Planning and Performance Management division to investigate a potential privacy breach.
  5. Physical Security Program Management and Oversight     
    • 5.1. The Library will provide physical security program management and oversight, consistent with sound operational management principles that benefit all Library users, through facility security design, the use of access control management principals, awareness and training as identified above.
    • 5.2. Library Staff are included, and welcome to make recommendations for physical security program improvements through various committees and user groups to Enterprise Projects & Facilities Management.
  6. Electronic and Mechanical Access Management     
    • 6.1. The Library will provide safe and secure access to Library Facilities that supports all Library Users in a manner that takes into consideration their personal property, safety, and security.
    • 6.2. All Library Users are accountable for protecting and safeguarding their own personal property. Library staff are accountable for protecting and safeguarding library property through the use of electronic and mechanical credentials.
    • 6.3. Procedures for Branch access and security management will consider the needs of all Library Users, including accessibility.
  7. Access Credentials, Keys, Fobs, Access Cards.    
    • 7.1. The Library will utilize high security access card credentials that include photos.
    • 7.2. TPL Staff and third-party vendors will not be required to wear TPL issued access badges while working at all TPL locations.
    • 7.3. Unassigned and unused credentials such as keys and access cards will be secured in the most effective manner possible.
    • 7.4. Access Credentials shall never be shared, loaned or duplicated.
    • 7.5. Management of keys will be the responsibility the regional Facilities management Staff.
    • 7.6. All new and renovated properties will be designed with standard keying systems.
    • 7.7. All new and renovated properties with new industry standard keying systems will follow a traditional keying system design with a Grand Master and sub-master systems.
    • 7.8.Keys for FOB or Card access enabled doors must be kept to a minimum and not widely distributed.

Specific Directives

This Policy provides non-binding guiding principles for how TPL will work to create, maintain and promote physical security of people and property and commits the Library to improving physical security in both the short and longer term. Physical security technology design features will be implemented where feasible through planned renovation and new construction projects as part of implementation of the Facilities Master Plan and the 10-year Capital Plan Policy.

Accountability

The Director of Enterprise Projects & Facilities Management is accountable for implementation of this Policy.

Related Legislation

Related Library Policies

Definitions

Accessibility:
Refers to the absence of barriers that prevent individuals and/or groups from fully participating in all aspects of society. The term is often linked to people with disabilities and their right to access goods, services, employment opportunities, and facilities.
Assets:
All property, both intellectual and real owned or leased by TPL
Credentials:
Key card, fobs, mechanical keys, access codes used to gain access into TPL property
Library Facilities:
Includes all library branches and administrative buildings, as well as bookmobiles.
Library User:
Includes anyone who uses the Library’s spaces, e.g., customers, staff, volunteers, third-party contractors, the public.
Physical Security:
Physical security are the safeguards in place to prevent and delay unauthorized access to assets, detect attempted and actual unauthorized access, and activate appropriate responses. The protection of personnel, hardware, facilities, and data from physical actions and events that could cause serious loss or damage to an enterprise, agency or institution.

Contact

Director, Enterprise Projects and Facilities Management

Print this page