What the Act requires on every form
When personal information is collected, MFIPPA s. 29(2) says the institution must tell the person three things: (a) the legal authority for the collection, (b) the principal purpose or purposes for which the information will be used, and (c) the title, business address and business telephone number of an officer or employee who can answer questions about the collection. This duty is in force today; it is not one of the January 1, 2027 changes. Source: MFIPPA s. 29(2) on e-Laws.
Because part (c) has three pieces of contact information, we checked five items on each form.
Which parts were present
Share of the 115 forms on which each item appeared, on the form or in a collection notice linked from it.
| Item | Forms | Share |
|---|---|---|
| Legal authority | 47 | 41% |
| Principal purpose | 66 | 57% |
| Contact title | 47 | 41% |
| Contact business address | 36 | 31% |
| Contact business phone | 40 | 35% |
By size of municipality
Share of forms missing at least one required part, by 2021 Census population: small (under 10,000), mid-sized (10,000 to 99,999) and large (100,000 or more).
| Size | Municipalities | Forms | Missing a part |
|---|---|---|---|
| Small | 19 | 57 | 95% |
| Mid-sized | 13 | 42 | 76% |
| Large | 6 | 16 | 69% |
Website-level checks
Share of the 40 municipalities whose public website showed each item.
A breach protocol does not have to be published, and privacy impact assessments are usually internal documents, so these two numbers say what residents can see, not what exists inside each office.
What this means for your institution
If your forms look like these, the quickest win is one standard notice block reused on every form. It is a duty in force today, and it is the easiest gap for a resident, a reporter or the IPC to see.
The January 1, 2027 duties are harder to see from outside, because assessments, safeguards and breach response mostly live in internal documents. On the websites we checked, 2 of 40 municipalities showed a breach protocol or a way to report a breach, and 6 mentioned privacy impact assessments.
A free readiness check applies the same method to your own public forms and privacy pages.
Method
Who. 40 municipalities chosen from the Province’s list of Ontario’s 444 municipalities to cover every size and region: 20 small (under 10,000 people), 14 mid-sized and 6 large (100,000 or more), by 2021 Census population, across Eastern, Central, Southwestern and Northern Ontario. This is a chosen sample, not a random one.
Which forms. On each municipality’s official website we looked for up to four public online forms that collect personal information: a general contact form, a service request form, a recreation registration or facility booking form, and one permit or licence application. Fillable PDF forms counted. We skipped anything behind a login or an account.
What we counted. We looked at 159 forms and counted only the 115 we could read in full, from 38 municipalities. We left out 24 forms we could only partly read, 17 we could not read from the public page without interacting with them, and 3 that were not municipal collections, such as a provincial form hosted on a municipal site. None of these is in any percentage.
How we coded. For each counted form we checked five items: the legal authority, the principal purpose, and the title, business address and business phone number of a contact. An item counted as present if it was on the form or in a collection notice linked from the form. A general website footer did not count as the contact details. A bare mention of MFIPPA did not count as the legal authority, because MFIPPA sets the rules for collection rather than authorizing a particular program. When unsure, we marked an item missing and noted why. If a notice that names only MFIPPA were counted as giving the legal authority, 83% of forms (96 of 115) would still be missing at least one part.
Website checks. For each of the 40 municipalities we searched its website for a privacy policy or statement, a privacy breach protocol or a page telling residents how to report a breach, and any mention of privacy impact assessments. “Not found” means we could not find it, not that it does not exist.
When. All pages were read on October 13, 2026. We did not submit any form, log in, or contact any municipality. We keep the underlying data privately and do not name any municipality.
Limits
- This is a review of public web pages, not a legal audit. A notice can also be given in other ways, such as on a paper form, at a counter or in a confirmation email, which we could not see.
- Some collections do not need a notice, for example some law enforcement collections or where the Minister waives it (s. 29(3)). We did not assess exemptions.
- The sample is chosen, not random, and the number of forms per municipality varies, so the results describe these forms, not every Ontario municipality.
- Forms we could not read in full are left out. If they differ from the forms we could read, the results would change.
- Coding involves judgment, especially for the contact person’s title. When unsure we marked an item missing, which may overstate gaps slightly.
- Breach protocols and privacy impact assessments are usually internal documents. Not finding them on a website does not mean they do not exist.
- Websites change. A form may have been updated since October 13, 2026.
Want to know how your own forms compare? Ask for a free readiness check. We review your public forms and privacy pages and send a short PDF within 2 business days.