For Ontario institutions under MFIPPA
New municipal privacy duties start January 1, 2027.
From that date, every institution under the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) must assess privacy in writing before it collects personal information, keep that information safe, and report serious breaches to the Information and Privacy Commissioner of Ontario (IPC). We prepare the policies, templates and your first privacy impact assessment for a fixed price, ready for your head to review and sign.
Free, no obligation. We reply within 2 business days.
What changes on January 1, 2027
Bill 97, the Plan to Protect Ontario Act (Budget Measures), 2026, amended MFIPPA in Schedule 11. Five new duties start on the same day. Each one below links to the law itself.
-
A privacy impact assessment before you collect
Before collecting personal information, the head must make sure a written assessment is prepared. The Act lists ten things it must cover, from the purpose and legal authority to retention and safeguards. It must be updated before any significant change in purpose.
-
Reasonable safeguards
Take reasonable steps to protect personal information against theft, loss and unauthorized use or disclosure, and to protect records against unauthorized copying, change or disposal.
-
Breach reports to the IPC
Report a theft, loss or unauthorized use or disclosure of personal information to the Commissioner, as soon as feasible, when it is reasonable to believe there is a real risk of significant harm to someone.
-
Notice to the people affected
In the same cases, tell the people affected as soon as feasible, unless another law prohibits it. The notice must say they can complain to the Commissioner.
-
Breach records and annual statistics
Keep a record of every breach you report. Breach numbers go into your annual report to the IPC. The first one covers 2027 and is due March 31, 2028.
MFIPPA s. 30.1(8) and s. 26; due date from the IPC FAQ on annual breach reports
Not new, but often missed: every form that collects personal information must already tell people the legal authority for the collection, its main purpose, and the title, business address and phone number of someone who can answer questions. See MFIPPA s. 29(2) on e-Laws. This is the first thing our free check looks at.
The IPC has published free guidance for these duties: its privacy impact assessment guide and its privacy breach guidelines for public sector organizations. Our documents follow them. Legal references checked October 13, 2026.
What is at stake
An honest picture, so you can explain it to your CAO and council.
The fines are small. A wilful offence under the Act carries a fine of up to $5,000. The bigger exposure is everything around a breach.
-
IPC reviews and orders
From January 1, 2027, the Commissioner can review your information practices after a breach complaint, or when it has other reason to believe the rules are not being met. It can order you to stop or change a practice, or to return or destroy personal information.
-
Your assessments, on request
If the Commissioner asks for a copy of a privacy impact assessment, the head must provide it. A missing or thin assessment is hard to explain after the fact.
-
Complaints from the people affected
Every breach notice must tell people they can complain to the Commissioner, and they generally have one year to do so.
-
Council and the local paper
The IPC posts its decisions and privacy investigation reports on its website. A breach that reaches residents reaches council, and often the local paper.
-
The offence itself
From January 1, 2027, the offence covers wilfully collecting or using personal information in breach of the Act, not only disclosing it.
The Bill 97 Readiness Pack
What a small institution needs for the January 1, 2027 duties, written around your own forms and practices and ready for your head to review and sign.
Privacy impact assessment policy and template
When an assessment is needed, who prepares it and who approves it. The template covers all ten required elements.
Your first completed assessment
For one real collection you choose, such as online recreation registration.
Breach response protocol
Who does what in the first hours and days, step by step.
“Real risk of significant harm” decision guide
A short guide to decide whether a breach must be reported and people notified, and to record why.
Notice templates
Draft wording for your report to the IPC and for the notice to affected people.
Breach log
One record of every breach, set up so your annual statistics are quick to prepare.
Safeguards policy and register
Administrative, technical and physical safeguards, and where each one stands today.
Personal information inventory
What you collect, where it is kept, who can see it and how long you keep it.
One-page council briefing
What changed, what you have done and what council needs to know, on one page.
Short staff briefing
So front-line staff know what a breach looks like and who to tell, right away.
Start with a free readiness check
Email us your institution’s name. Within 2 business days we send you a short PDF that looks at your own public website, the pages residents actually use, and tells you what to fix first.
What we look at
- Online forms: does each one carry the notice of collection the Act already requires?
- Privacy pages: do they reflect the rules in force since July 1, 2026?
- Breach readiness: can a resident find who to contact about a breach?
- Collection: do any forms ask for more than the service needs?
We look only at public pages. We never need a login, internal documents or personal information about anyone.
Readiness check: Township of Example
- Now. 9 of 14 online forms are missing part or all of the notice of collection.
- Now. The privacy page describes rules that changed on July 1, 2026.
- Before January 1, 2027. Camp registration collects children’s health details through an outside booking service.
How it works
-
Free check
Within 2 business days
Email your institution’s name. We review your public forms and privacy pages and send a short PDF with what to fix first.
-
Fixed quote and kick-off
Week 1
If you want the pack, we send a fixed written quote. Once it is approved, we gather your current forms, notices and policies and hold one kick-off call.
-
Review and sign
About 3 weeks
You receive the pack, already reviewed by a certified privacy professional. Your head reviews it, makes any changes and signs.
Practical documents, not legal opinions
We write policies, templates and assessments your staff can use. We do not give legal opinions.
Your head decides
Your head reviews, approves and signs. We never sign or make decisions for you.
Reviewed before you see it
A certified privacy professional reviews every pack before it reaches you.
Who it is for
Institutions covered by MFIPPA, especially those without a privacy office, where the clerk, the FOI coordinator or a records lead carries privacy on top of everything else.
- Municipalities
- School boards
- Police service boards
- Public library boards
- Conservation authorities
- Boards of health
- Planning and local services boards
- Other local boards under MFIPPA
The full list of institutions is in the definition of “institution” in MFIPPA s. 2(1) on e-Laws.
Questions clerks ask
Is this legal advice?
No. We prepare practical documents and processes: policies, templates, logs, briefings and completed assessments. We do not give legal opinions. If a question needs one, such as whether a particular statute authorizes a collection, we flag it for your solicitor.
Who signs?
Your head does. Under MFIPPA the head of the institution carries these duties and can delegate them in writing, for example to the clerk (sections 3 and 49 on e-Laws). We prepare. Your head reviews, changes what they want and approves. The decisions stay yours.
We already have a privacy policy. Do we still need this?
Probably some of it. A general privacy policy rarely covers the new duties: a written assessment for each collection with the ten required elements, a way to decide and record whether a breach must be reported, and a breach log for your annual report. We start from what you have, keep what works and fill the gaps. The free check shows where you stand.
Can we buy this under our purchasing limit?
The pack is a fixed CA$4,900 plus applicable tax, quoted in writing before any work starts. Your procurement by-law or policy sets what staff can approve directly, so check the amount against your own limit. If your approval process needs a formal quote, we will send one.
Where is our information kept?
In access-controlled accounts with multi-factor sign-in. Before any paid work starts, we confirm in writing which providers will hold your documents and where. If you need documents kept only in Canada, tell us first and we will agree on how. We ask only for what the work needs, and the free check needs no personal information at all. Our privacy notice explains how long we keep things and who can see them.
What do you need from us?
For the free check, only your institution’s name. For the pack: one contact person, your current forms, privacy notices and policies, your records retention by-law, a list of the main systems and outside services that hold personal information, and a kick-off call of about an hour.
Do the new duties apply to forms we already use?
The Act says a written assessment is needed before collecting personal information, and an update is needed before a significant change in purpose (section 28 on e-Laws). How that applies to programs that started before 2027 is a judgment for your head and, if needed, your solicitor. A sensible start is the collections with the most risk, such as children’s programs.
Is the free check really free?
Yes. No cost and no obligation. You get a short PDF within 2 business days. We look only at public pages, so we never need a login, internal documents or personal information.
Ask for your free readiness check
Send your institution’s name to:
hello@municipalprivacydesk.caWe reply within 2 business days. Please do not send personal information about residents or staff. We do not need it.
What to put in your email
- Your institution’s name.
- Your name and role, so we know who the PDF is for.
That is all we need. We find your public forms and privacy pages ourselves.