Does online recreation registration need a privacy impact assessment?

Short answer: for a collection that starts on or after January 1, 2027, yes. Amended MFIPPA s. 28(3) says that, unless the regulations provide otherwise, before collecting personal information the head must ensure that a written privacy impact assessment is prepared (MFIPPA s. 28(3) on e-Laws). Recreation registration collects personal information every time a family signs up. For programs that already run, read on.

What registration usually collects

A typical camp, swim or day program registration asks for a child’s name, date of birth and address, a parent or guardian’s contact details, emergency contacts, and often allergies, medical conditions, medications and custody notes. Payment may run through the same system.

Much of this is sensitive by the IPC’s own description. Its August 2026 breach guidelines list health information and financial information first among examples of sensitive information, and name children and youth among the vulnerable people to consider when assessing a breach (IPC breach guidelines).

Programs that started before 2027

The Act ties the duty to the act of collecting: the assessment comes “before collecting personal information”. Registration is not a one-time event, because families submit new information every season. How the duty applies to a program that began before 2027 is a question to settle with your head and, if needed, your solicitor.

Either way, registration is a strong first assessment. The information is sensitive, the volume is high, and an outside booking service often holds it.

What the assessment must cover

The Act lists ten things (s. 28(3)). For registration they look like this:

1. Purpose: why you collect each item, and why it is necessary.
2. Legal authority: the statute or by-law you rely on.
3. Types of information, and how each type is used or disclosed.
4. Sources: usually the parent or guardian.
5. Position titles with access: program staff, front desk, finance, and the vendor’s support staff.
6. Limits on collection, use and disclosure.
7. Retention, in line with your retention rules (s. 30(1)).
8. Safeguards (administrative, technical and physical) and a summary of the risks to people if the information is stolen, lost or misused.
9. Steps to prevent a breach, and to reduce harm if one happens.
10. Anything else the regulations prescribe.

The steps in item 9 must be in place before you collect or, if that is not possible, within a reasonable time after (s. 28(4)).

Questions to ask your booking vendor

• Where is the data stored, and who at the vendor can see it?
• How fast will the vendor tell you about a breach? The IPC says institutions must make sure, by contract or otherwise, that contractors tell them immediately, because the institution is responsible for notifying people.
• What happens to the data when the contract ends?
• Can you get a record of who accessed what, if you ever need to investigate?

Keep it current

Before a significant change to the purpose for which the information is used or disclosed, for example using registration contacts to send a newsletter, update the assessment first (s. 28(5)). If the IPC asks for a copy, the head must provide it (s. 28(6)).

And while you are looking at the form, check the notice of collection. The form must already tell families the legal authority, the main purpose, and the title, business address and phone number of someone who can answer questions (s. 29(2)). That duty is in force today.

Where to start

The IPC published a free guide, Planning for Success: Privacy Impact Assessment Guide for Ontario’s public institutions, with worksheets, on August 13, 2026. If you would rather have the assessment prepared for you, our Readiness Pack includes a template built around that guide and one completed assessment for a collection you choose. Registration is the one we suggest starting with.