MFIPPA privacy work for Ontario institutions
New municipal privacy duties start January 1, 2027.
From that date, every institution under the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) must assess privacy in writing before it collects personal information, keep that information safe, and report serious breaches to the Information and Privacy Commissioner of Ontario (IPC). We prepare the policies, templates and your first privacy impact assessment for a fixed price, ready for your head to review and sign.
Free, no obligation. We reply within 2 business days.
- 115public online forms read in full across 38 Ontario municipalities in October 2026See the research
- 10 of 10elements the Act requires in a privacy impact assessment, each a section of our templateLook inside
- Aug 13, 2026date of the IPC guidance our documents are built aroundIPC assessment guide
- 0 meetingsrequired: a short written questionnaire, and a call only if you want oneHow it works
One focus
We do one thing: MFIPPA privacy work for Ontario institutions.
No software to learn and no retainer. We prepare the documents your institution needs for January 1, 2027, built around the IPC’s own guidance, and your head signs them.
Done for you
We write the policies, templates and your first completed assessment. Your staff review them and your head signs.
A price you can see
One fixed price, published on this page and confirmed in a written quote before any work starts.
No meetings needed
A short written questionnaire replaces kick-off meetings. A call only if you want one.
Look before you buy
Read the first page of each core document, a sample readiness check and our October 2026 research on municipal web forms.
Built for
- Municipalities
- Public library boards
- Police service boards
- School boards
- Conservation authorities
- Boards of health and public health units
- Planning and local services boards
- Other local boards under MFIPPA
The full list of institutions is in the definition of “institution” in MFIPPA s. 2(1) on e-Laws.
What changes on January 1, 2027
Bill 97, the Plan to Protect Ontario Act (Budget Measures), 2026, amended MFIPPA in Schedule 11. Five new duties start on the same day. Each one below links to the law itself.
A privacy impact assessment before you collect
Before collecting personal information, the head must make sure a written assessment is prepared. The Act lists ten things it must cover, from the purpose and legal authority to retention and safeguards. It must be updated before any significant change in purpose.
Reasonable safeguards
Take reasonable steps to protect personal information against theft, loss and unauthorized use or disclosure, and to protect records against unauthorized copying, change or disposal.
Breach reports to the IPC
Report a theft, loss or unauthorized use or disclosure of personal information to the Commissioner, as soon as feasible, when it is reasonable to believe there is a real risk of significant harm to someone.
Notice to the people affected
In the same cases, tell the people affected as soon as feasible, unless another law prohibits it. The notice must say they can complain to the Commissioner.
Breach records and annual statistics
Keep a record of every breach you report. Breach numbers go into your annual report to the IPC. The first one covers 2027 and is due March 31, 2028.
MFIPPA s. 30.1(8) and s. 26; due date from the IPC FAQ on annual breach reports
Not new, but often missed: every form that collects personal information must already tell people the legal authority for the collection, its main purpose, and the title, business address and phone number of someone who can answer questions. See MFIPPA s. 29(2) on e-Laws. In our October 2026 research, 84% of 115 municipal web forms were missing at least one of these.
Our documents are built around the IPC’s free guidance: its privacy impact assessment guide and its privacy breach guidelines for public sector organizations, both dated August 13, 2026. Legal references checked October 13, 2026.
What is at stake
An honest picture, so you can explain it to your CAO and council.
The fines are small. A wilful offence under the Act carries a fine of up to $5,000. The bigger exposure is everything around a breach.
IPC reviews and orders
From January 1, 2027, the Commissioner can review your information practices after a breach complaint, or when it has other reason to believe the rules are not being met. It can order you to stop or change a practice, or to return or destroy personal information.
Your assessments, on request
If the Commissioner asks for a copy of a privacy impact assessment, the head must provide it. A missing or thin assessment is hard to explain after the fact.
Complaints from the people affected
Every breach notice must tell people they can complain to the Commissioner, and they generally have one year to do so.
Council and the local paper
The IPC posts its decisions and privacy investigation reports on its website. A breach that reaches residents reaches council, and often the local paper.
The offence itself
From January 1, 2027, the offence covers wilfully collecting or using personal information in breach of the Act, not only disclosing it.
What we found on 40 municipal websites
In October 2026 we checked the websites of 40 Ontario municipalities, small, mid-sized and large. We read 115 public online forms in full, from 38 of them, and checked each against the three parts of the notice that MFIPPA s. 29(2) already requires. We do not name any municipality.
- 84%of forms were missing at least one required part of the notice.
- 42%of forms had no notice of collection at all.
- 5%of municipalities had a privacy breach protocol, or a way to report a breach, that we could find on their website.
The Bill 97 Readiness Pack
What a small institution needs for the January 1, 2027 duties, written around your own forms and practices and ready for your head to review and sign.
Privacy impact assessment policy and template
When an assessment is needed, who prepares it and who approves it. The template covers all ten required elements.
Your first completed assessment
For one real collection you choose, such as online recreation registration.
Breach response protocol
Who does what in the first hours and days, step by step.
“Real risk of significant harm” decision guide
A short guide to decide whether a breach must be reported and people notified, and to record why.
Notice templates
Draft wording for your report to the IPC and for the notice to affected people.
Breach log
One record of every breach, set up so your annual statistics are quick to prepare.
Safeguards policy and register
Administrative, technical and physical safeguards, and where each one stands today.
Personal information inventory
What you collect, where it is kept, who can see it and how long you keep it.
One-page council briefing
What changed, what you have done and what council needs to know, on one page.
Short staff briefing
So front-line staff know what a breach looks like and who to tell, right away.
Look inside the pack
The opening page of three core documents, as they stand today. In the pack, each is completed for your institution.
-
Privacy impact assessment
Privacy impact assessment template
Template, draft v0.1, October 2026. Not legal advice.
About this template
From January 1, 2027, Ontario’s Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) requires municipal institutions to prepare a written privacy impact assessment (PIA) before collecting personal information (section 28(3)). This template helps a municipality, school board, police service board, library board or other MFIPPA institution do that without in-house privacy staff. It is built around the four steps in the Information and Privacy Commissioner of Ontario’s guide, Planning for Success (August 2026): preliminary analysis, project analysis, privacy analysis and PIA report. At its core is one section for each of the ten items the Act says an assessment must contain, with plain questions to answer under each. It also includes a risk table, a mitigation plan that records when each step will be in place, a sign-off page for the head or the head’s delegate, and a review schedule. Each part shows what the Act requires, what the Commissioner’s guidance recommends and what we suggest.
Full document in the pack
-
Breach decision guide
Real risk of significant harm decision guide
Template, draft v0.1, October 2026. Not legal advice.
About this guide
From January 1, 2027, the head of every Ontario municipal institution must report certain privacy breaches to the Information and Privacy Commissioner of Ontario (IPC) and notify the people affected, under section 30.1 of the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). The test is whether it is reasonable in the circumstances to believe there is a real risk of significant harm, often shortened to RROSH. This guide turns that test into a short decision path a clerk can follow under pressure. It is built around the six response steps in the IPC’s Privacy Breaches: Guidelines for Public Sector Organizations (August 2026): assess and contain, assess the risk, notify, report, investigate, and reduce the risk of future breaches. It includes prompts for each legal factor, a decision record form, checklists for the IPC report and the notice to individuals, and a breach log set up for the annual statistics the IPC collects, first due March 31, 2028.
Full document in the pack
-
Safeguards
Safeguards policy summary and register
Template, draft v0.1, October 2026. Not legal advice.
About this register
From January 1, 2027, section 30(5) of Ontario’s Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) requires the head of every municipal institution to take reasonable steps to protect personal information against theft, loss and unauthorized use or disclosure, and to protect records against unauthorized copying, modification or disposal. Older security rules in Regulation 823 already require documented measures against unauthorized access and damage, and access limited to staff who need a record for their duties. This register gives a small institution one place to show what it does. It contains a short safeguards policy statement the head can adopt, and a table of about twenty common administrative, technical and physical safeguards, each with an owner by position title, a status, the evidence that it is working and review dates. The register also feeds two other documents: the safeguards section of each privacy impact assessment, and the investigation and prevention steps of the breach protocol.
Full document in the pack
How it works
Free check
Within 2 business days
Email your institution’s name. We review your public forms and privacy pages and send a short PDF with what to fix first.
Quote and questionnaire
Week 1
If you want the pack, we send a fixed written quote. Once it is approved, you answer a short written questionnaire and send your current forms, notices and policies. A call only if you want one.
Review and sign
About 3 weeks
You receive the pack, already reviewed by a certified privacy professional. Your head reviews it, makes any changes and signs.
Practical documents, not legal opinions
We write policies, templates and assessments your staff can use. We do not give legal opinions.
Your head decides
Your head reviews, approves and signs. We never sign or make decisions for you.
Reviewed before you see it
A certified privacy professional reviews every pack before it reaches you.
Buying from us
What your purchasing file needs, in writing.
- Price
- One fixed price, shown in the price box above and confirmed in a written quote before any work starts. No hourly billing.
- Payment
- No payment until the pack is delivered. Invoice net 30.
- How to pay
- EFT or cheque.
- Terms
- We prepare the documents. Your head reviews, signs and files them. We give no legal advice. Our liability is capped at the fees paid, and British Columbia law governs. If the IPC sends back a report we prepared for a reason inside our scope, we fix it free.
- Paperwork
- We can send a one-page quote and scope for your purchasing file or direct-award justification.
- Timing
- Approve a quote by Monday, November 30, 2026 and your pack is delivered by Monday, December 21, in time for your head to sign before January 1. This assumes your questionnaire answers reach us within 5 business days of approval.
- Canadian supplier
- 1414618 B.C. Ltd. is a British Columbia corporation. Ontario’s Municipal Buy Ontario Procurement Directive, in effect since April 13, 2026, requires the municipal sector to prioritize Ontario and Canadian goods and services. If your file needs it, our quote states where the work is performed.
Two free ways to start
Free readiness check
Email us your institution’s name. Within 2 business days we send a short PDF that looks at your own public website, the pages residents actually use, and tells you what to fix first.
- Online forms: does each one carry the notice of collection the Act already requires?
- Privacy pages: do they reflect the rules in force since July 1, 2026?
- Breach readiness: can a resident find who to contact about a breach?
- Collection: do any forms ask for more than the service needs?
We look only at public pages. We never need a login, internal documents or personal information about anyone.
Bill 97 readiness checklist
A two-page checklist for Ontario institutions: notice of collection, privacy impact assessments, safeguards, breach response and annual reporting, each item linked to the section of the Act. Print it, tick it, share it with your CAO.
- Notice of collection on every form
- Know what you collect
- Privacy impact assessments
- Safeguards
- Breach response
- Reporting and governance
No email address needed. Accessible, tagged PDF with sources.
Questions clerks ask
Is this legal advice?
No. We prepare practical documents and processes: policies, templates, logs, briefings and completed assessments. We do not give legal opinions. If a question needs one, such as whether a particular statute authorizes a collection, we flag it for your solicitor.
Who signs?
Your head does. Under MFIPPA the head of the institution carries these duties and can delegate them in writing, for example to the clerk (sections 3 and 49 on e-Laws). We prepare. Your head reviews, changes what they want and approves. The decisions stay yours.
We already have a privacy policy. Do we still need this?
Probably some of it. A general privacy policy rarely covers the new duties: a written assessment for each collection with the ten required elements, a way to decide and record whether a breach must be reported, and a breach log for your annual report. We start from what you have, keep what works and fill the gaps. The free check shows where you stand.
Can we buy this under our purchasing limit?
The pack has one fixed price, shown in the price box and confirmed in a written quote before any work starts. Your procurement by-law or policy sets what staff can approve directly, so check the amount against your own limit. We can send a one-page quote and scope for your file.
Where is our information kept?
In access-controlled accounts with multi-factor sign-in. Before any paid work starts, we confirm in writing which providers will hold your documents and where. If you need documents kept only in Canada, tell us first and we will agree on how. We ask only for what the work needs, and the free check needs no personal information at all. Our privacy notice explains how long we keep things and who can see them.
What do you need from us?
For the free check, only your institution’s name. For the pack: one contact person, your current forms, privacy notices and policies, your records retention by-law, a list of the main systems and outside services that hold personal information, and answers to a short written questionnaire. A call only if you want one.
Do the new duties apply to forms we already use?
The Act says a written assessment is needed before collecting personal information, and an update is needed before a significant change in purpose (section 28 on e-Laws). How that applies to programs that started before 2027 is a judgment for your head and, if needed, your solicitor. A sensible start is the collections with the most risk, such as children’s programs.
Who reviews the documents?
A certified privacy professional reviews every pack before it reaches you. Your head still reviews and signs the final version, because the decisions belong to your institution.
Insights
Short notes a clerk can forward
Most municipal web forms miss part of a notice the Act already requires
Notice of collection is not new. Our October 2026 review of municipal web forms shows how often it is incomplete, and how to fix it in an afternoon.
Does online recreation registration need a privacy impact assessment?
Registration collects children’s details, health information and payment data, often through an outside booking service. How the January 1, 2027 duty applies.
Real risk of significant harm: the first 48 hours after a privacy breach
The Act says “as soon as feasible”, not 48 hours. A practical way to run the first two days, built around the IPC’s August 2026 guidelines.
Ask for your free readiness check
Send your institution’s name to:
[email protected]We reply within 2 business days. Please do not send personal information about residents or staff. We do not need it.
What to put in your email
- Your institution’s name.
- Your name and role, so we know who the PDF is for.
That is all we need. We find your public forms and privacy pages ourselves.