For municipalities: lower, single and upper tier

What applies from January 1, 2027

• A written privacy impact assessment before each collection of personal information, covering the ten points in s. 28(3), and an update before any significant change in purpose (s. 28(5)).
• Reasonable steps to protect personal information and records (s. 30(5)).
• A report to the IPC, and notice to the people affected, as soon as feasible when a breach creates a real risk of significant harm (s. 30.1).
• A record of every reported breach, with the count in your annual report to the IPC; the first is due March 31, 2028 (s. 30.1(8), s. 26).
• IPC reviews of your information practices, with the power to order changes (s. 38.1).

Already in force: the notice of collection on every form (s. 29(2)), and since July 1, 2026, 45 business days to answer access requests. Every change, section by section.

Who signs

The head of a municipality is council, unless council has designated one of its members or a committee by by-law (MFIPPA s. 3(1) and (3)(a)). The head may delegate powers and duties in writing to officers, such as the clerk (s. 49(1)). Before January 1, check that your delegation covers the new duties: signing assessments, deciding whether a breach meets the test, and the yearly report. Our pack is prepared for that person to review and sign.

Your local boards are separate institutions

MFIPPA lists the public library board, the police service board and other local boards as institutions in their own right (s. 2(1)). Each has its own head and its own duties. The municipality’s pack covers the municipality; a library or police board needs its own documents, even where it shares staff, systems or policies with the town. Boards can adapt the municipality’s documents, but the board’s head signs its own. See library boards and police service boards.

Collections that usually need an assessment first

Start with the collections that are sensitive, high in volume, or held by an outside service:

• Recreation and camp registration: children’s details, health notes, custody notes and payment data, often through a booking vendor.
• Permits and licences: building, burn, special event, lottery, dog and business licences.
• By-law complaints and service requests: names and addresses of complainants and of the people complained about.
• Cameras: facility, park or traffic cameras that capture identifiable people.
• Payments and accounts: property tax, water billing and online payment portals.
• Council delegations and public comments, which can end up in published agendas.

Whether programs that started before 2027 need an assessment is a question the Act does not answer directly; see what we could not confirm. The riskiest ongoing collections are a sensible start either way.

What we found on municipal websites

On October 13 and 14, 2026 we read 1,044 public forms in full on 415 municipal websites. 93% left out at least one required part of the notice of collection and 44% had none at all. Smaller municipalities had more gaps: 96% of forms from municipalities under 10,000 people missed a part, against 84% in municipalities of 100,000 or more.

We do not name any municipality. Method and limits. Your own results, form by form, come with a free check.

The pack for a municipality

• First assessment: usually online recreation or camp registration, because it combines children’s information, health notes and an outside booking service.
• Inventory: built department by department, so clerks, recreation, building, by-law and finance each see their own collections, and the next assessments are ranked.
• Breach protocol: roles written for a small office, with backups for when the clerk is away, and your IT provider named if IT is outsourced.
• Council briefing: one page council can read in five minutes: what changed, what staff have done, and the head and delegation questions council may need to settle.
• Staff briefing: written for front counters, recreation desks and by-law officers, where most everyday breaches start.

Each document is described on the readiness pack page. CA$7,500, invoice after delivery, net 30.

Council and timing

New councils elected on October 26, 2026 take office on November 15. The council briefing is written so the clerk can present it in the first weeks of the term. On purchasing: the pack has one fixed price, so it is easy to check against your procurement by-law, and we send a one-page quote and scope for your file. Accept a quote by Monday, November 30 and the pack arrives by Monday, December 21, provided your questionnaire answers reach us within 5 business days.