What Bill 97 changes for Ontario’s municipal institutions

Who carries the duties: the head

Almost every new duty is written as a duty of “the head of an institution”. Who that is depends on what your council or board has decided:

• Municipality. Council may, by by-law, designate one of its members or a committee of council as head (s. 3(1)). If it has not, the head is the council (s. 3(3)(a)).
• Local board. The members of a library board, police service board, school board, conservation authority, board of health or other board may designate one of themselves, or a committee, in writing (s. 3(2)). If they have not, the head is the members (s. 3(3)(b)).
• Delegation. The head may delegate a power or duty in writing to one or more officers, such as the clerk or a privacy coordinator, with any limits it sets (s. 49(1)).

In practice the clerk or a privacy or freedom of information coordinator usually does the work under a written delegation. Check that yours covers the new duties: assessments, breach decisions and the yearly report.

Privacy impact assessments January 1, 2027

New s. 28(3) says that, unless the regulations provide otherwise, before collecting personal information the head must ensure that a written assessment is prepared that contains:

1. the purpose of the collection, use and disclosure, and why the information is necessary to achieve it;
2. the legal authority for the collection, use and disclosure;
3. the types of personal information, and how each type will be used or disclosed;
4. the sources of the information;
5. the position titles of the officers, employees, consultants or agents who will have access;
6. any limits or restrictions on collection, use or disclosure;
7. how long the information will be kept, in line with s. 30(1);
8. the administrative, technical and physical safeguards that will protect it under s. 30(5), and a summary of the risks to individuals if it is stolen, lost, or used or disclosed without authority;
9. the steps the institution will take (i) to prevent or reduce the likelihood of a theft, loss or unauthorized use or disclosure, and (ii) to mitigate the risks to individuals if one happens;
10. any other information the regulations prescribe.

Around that list:

• Timing of the steps. The steps in item 9 must be in place before collecting or, if that is not possible, within a reasonable time after (s. 28(4)).
• Updates. Before any significant change to the purpose for which the information is used or disclosed, the head must update the assessment and put any extra steps in place (s. 28(5)).
• The IPC can ask. On request, the head must give the Commissioner access to, or a copy of, any assessment or update (s. 28(6)).
• Information that is not written down counts. For s. 28, s. 29 and, from January 1, s. 30(5), personal information includes information that is not recorded, such as what is said at a counter or on the phone (s. 28(1)).
• The collection rule itself is unchanged. A collection must still be expressly authorized by statute, used for law enforcement, or necessary to the proper administration of a lawfully authorized activity (s. 28(2)).
• Regulations may add content or exceptions (s. 47(1)(b.1)). We found none on October 13, 2026, and the IPC’s guide says none had been made when it was published.

What the IPC recommends. Its guide Planning for Success: Privacy Impact Assessment Guide for Ontario’s Public Institutions (August 13, 2026) sets out four steps: preliminary analysis, project analysis, privacy analysis and the assessment report. It treats any new or changed program, process or system that involves personal information as a project, asks that someone other than the person who prepared the assessment review it, and publishes free worksheets. The IPC also says deciding whether and how to conduct an assessment should be done with your privacy, technical and legal experts.

How we build on this: our assessment template follows the IPC’s four steps, with one section for each of the ten items.

Safeguards January 1, 2027

“The head of an institution shall take steps that are reasonable in the circumstances to ensure that personal information in the custody or under the control of the institution is protected against theft, loss and unauthorized use or disclosure and to ensure that the records containing the personal information are protected against unauthorized copying, modification or disposal.” MFIPPA s. 30(5)

The Act does not list required safeguards. The test is what is reasonable in the circumstances, and a regulation may set standards (s. 47(1)(c)). Some security rules are already in force and keep applying:

• Reasonable measures to prevent unauthorized access to records must be “defined, documented and put in place” (Regulation 823, s. 3(1)).
• Only people who need a record for their duties may have access to it (Reg. 823, s. 3(2)).
• Reasonable measures must protect records from inadvertent destruction or damage (Reg. 823, s. 3(3)).
• Verify the identity of a person asking for their own personal information before giving access (Reg. 823, s. 2(3)).
• Measures to preserve records under your retention rules must be developed, documented and put in place (MFIPPA s. 4.1).
• Used personal information is kept for the period in Reg. 823, s. 5 (MFIPPA s. 30(1)), and disposal follows the regulations (s. 30(4)).

The IPC’s Privacy Breaches: Guidelines for Public Sector Organizations (August 2026, section 6.1) lists the security practices it expects, among them a designated privacy officer, yearly privacy and security training and confidentiality undertakings, limited access privileges, multi-factor authentication, encryption, timely updates, backups and monitoring of staff access.

How we build on this: our safeguards policy and register.

Breach reports to the IPC January 1, 2027

What counts. Any theft, loss or unauthorized use or disclosure of personal information in the institution’s custody or under its control (s. 30.1(1)). A misdirected email, a lost USB key, a stolen laptop, ransomware, or a staff member looking up a neighbour’s file with no work reason can all qualify.

The test. The head must report to the Commissioner if “it is reasonable in the circumstances to believe that there is real risk that a significant harm to an individual would result”, or if other prescribed circumstances exist (s. 30.1(1)).

Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record, and damage to or loss of property (s. 30.1(10)).

Factors to weigh (s. 30.1(7)): (a) the sensitivity of the information; (b) the probability that it has been, is being or will be misused; (c) whether the individual could take steps to reduce the risk or mitigate the harm; (d) any direction, recommendation or guidance from the Commissioner on what is a real risk of significant harm; and (e) any other prescribed factor. The IPC says not every factor has to point the same way before notice is required.

When and how. The report must contain the prescribed information, in the prescribed form and manner, “as soon as feasible” after the head determines that the breach occurred (s. 30.1(2)). The Act sets no number of days. The IPC accepts reports through its online form for reporting a breach at your organization, and asks you to report what you know and send more as you learn it. If you will notify a large number of people, it strongly recommends reporting to it first.

Service providers. The IPC says an institution remains responsible for notice when a breach happens at a contractor that holds information for it, and that contracts should require contractors to report breaches to the institution immediately.

Notice to the people affected January 1, 2027

In the same cases, and unless another law prohibits it, the head must notify each individual whose information was involved (s. 30.1(3)). If another law prohibits notice, the report to the IPC is still required.

• Content set by the Act. A statement that the individual is entitled to complain to the Commissioner, and any other prescribed information, in the prescribed form and manner, as soon as feasible after the head’s determination (s. 30.1(4)).
• Content the IPC expects. A description of the breach and the information involved, what the institution is doing about it, steps people can take to protect themselves, and contact details for someone at the institution (IPC FAQ).
• Direct or indirect. Direct notice by phone, letter, email or in person is generally preferred. The IPC’s guidelines describe when indirect notice, such as a prominent website notice, may be appropriate, for example when the people affected cannot be identified.
• Complaints. A complaint must be in writing and filed within one year after the matter came, or should reasonably have come, to the complainant’s attention, whichever is shorter (s. 30.1(5)). The Commissioner may extend the time in some cases (s. 30.1(6)).

How we build on this: our decision guide, notice templates and the insight the first 48 hours after a breach.

Breach records and the yearly statistics report From January 1, 2027

• Record. Keep and maintain a record of every breach reported to the IPC under s. 30.1(1), in line with any prescribed requirements (s. 30.1(8)), and give the Commissioner access or a copy on request (s. 30.1(9)).
• Annual report. From January 1, 2027 the head’s annual report to the Commissioner covers the previous calendar year (s. 26(1)) and includes the number of breaches recorded under s. 30.1(8) (s. 26(2)(c.1)), by the date and in the form the Commissioner specifies (s. 26(5)).
• First due date. The IPC says the first municipal breach report is due March 31, 2028, for the 2027 reporting year, and on March 31 each year after. It asks for the number and type of reported breaches and the number of people affected by each.
• Categories. When we read the IPC’s statistics guidance on October 13, 2026, it counted each breach once, as stolen, lost, used without authority or disclosed without authority, with sub-types such as ransomware, unencrypted portable equipment, paper records and misdirected emails, and grouped the people affected as 1, 2 to 10, 11 to 50, 51 to 100 and over 100.

How we build on this: our breach log, and the yearly report service from CA$750.

IPC reviews and orders January 1, 2027

The Commissioner may review an institution’s information practices after a complaint from someone who was notified of a breach, or when it has other reason to believe the privacy rules in Part II of the Act are not being followed (s. 38.1(1)). It may first try mediation or another informal route (s. 38.1(2)), and may decide not to review for any reason it considers proper (s. 38.1(3)).

A review looks at whether there has been unauthorized collection, use, modification, disclosure, access or retention, and whether the requirements of Part II, “including requirements with respect to notice, retention, security and secure disposal”, have been met (s. 38.1(4)). Staff must co-operate (s. 38.1(5)), and the Commissioner can require relevant information and records (s. 38.1(6)).

After hearing the head, the Commissioner may order the head to discontinue a practice, change it, return, transfer or destroy information, implement a different practice, or make a recommendation on how it could be improved (s. 38.1(7)).

Whistleblowing January 1, 2027

Anyone with reasonable grounds to believe an institution has contravened or is about to contravene the Act may tell the Commissioner and ask that their identity be kept confidential (s. 45.1). Staff, residents and contractors all qualify.

Offences

From January 1, 2027 the offence in s. 48(1)(a) covers wilfully collecting, using or disclosing personal information in contravention of the Act, not only disclosing it. The fine on conviction is up to $5,000 (s. 48(2)). The fine is small; the larger exposure is an IPC review, an order, complaints from the people affected, and the attention a breach draws from council, the board and the local paper.

Already in force since July 1, 2026

These changes to access requests and records took effect on July 1, 2026, for every MFIPPA institution (IPC table of changes):

• 45 business days, instead of 30 calendar days, to answer access requests, and other statutory timelines counted in business days;
• a second time extension in certain circumstances, and plans to give access in stages (s. 17.1);
• fee estimates within set timelines when the fee is over $25, with notice of the right to ask for a waiver;
• 30 business days, instead of 30 calendar days, to appeal to the IPC;
• the personal information bank requirements removed, although the IPC encourages institutions to keep and publish an index;
• certain cyber security records excluded from the Act, including records naming software applications that school boards acquired and that can access students’ personal information (s. 52(7)).

If your privacy or access page still says “30 days” or points residents to a personal information bank directory, it needs an update.

Not new: notice of collection

Every form that collects personal information must already tell people the legal authority, the principal purpose, and the title, business address and business telephone number of an officer or employee who can answer questions (s. 29(2)). From January 1, an IPC review checks notice requirements expressly (s. 38.1(4)(b)). In our October 2026 review, 93% of 1,503 public forms left out at least one part. The findings and method.

What we could not confirm

• Unconfirmed Regulations. The Act lets regulations set extra assessment content and exceptions, the information, form and manner of breach reports and notices, other circumstances that trigger reporting, record-keeping requirements and safeguard standards. We found none on October 13, 2026. Check for new regulations under the Act before relying on any document, including ours.
• Unconfirmed Collections that started before 2027. The Act ties the assessment to the act of collecting (“before collecting personal information”). Neither the Act nor the IPC’s guide says how that applies to programs that began before January 1, 2027 and keep collecting after it. Treat it as a question for your head and, if needed, your solicitor. A sensible start is the riskiest ongoing collections, such as children’s programs.
• Unconfirmed The IPC’s report form. The fields we describe are what the IPC’s online form asked for on October 13, 2026. Its introduction still described municipal reporting as a recommendation; the form may change once the duty is in force or a regulation prescribes the content.
• Unconfirmed Boards of health. PHIPA, not MFIPPA, governs personal health information held by a health information custodian (PHIPA s. 8(1)). Where a particular record falls is a judgment for your privacy lead and solicitor. See boards of health.