Questions and answers
The questions clerks and privacy coordinators ask
Short, direct answers. If yours is not here, email hello@mapleprivacydesk.ca and we answer in writing within 2 business days.
The work
Is this legal advice?
No. We prepare practical documents: policies, templates, logs, briefings and completed assessments. We do not give legal opinions. Where a question needs one, such as whether a particular statute authorizes a collection, we flag it for your solicitor. Each assessment records the legal authority you cite, and your solicitor or clerk confirms that line.
Who signs the documents?
Your head. For a municipality that is council, unless a by-law names one of its members or a committee; for a local board it is the board’s members, unless they named one of themselves or a committee in writing (MFIPPA s. 3). The head may delegate in writing, for example to the clerk (s. 49(1)). Your head reviews, changes what they want and signs. We never sign, adopt or file anything for you.
Who reviews the documents?
A certified privacy professional checks every judgment call in the pack before it reaches you, under a written confidentiality agreement, and the review is included in the price. The review covers privacy practice; legal questions go to your solicitor. We do not name reviewers on this site. If your file needs the reviewer’s name and credential, we give them once you accept the quote.
Do you contact the IPC for us?
No, never. Your head makes any report to the IPC, sends any notice to the people affected, and answers any IPC request. The pack gives you the decision guide, the templates and the log to do it quickly.
We already have a privacy policy. Do we still need this?
Probably some of it. A general privacy policy rarely covers the new duties: a written assessment for each collection with the ten required points, a way to decide and record whether a breach must be reported, and a breach log for the yearly report. We start from what you have, keep what works and fill the gaps. The free check shows where your public forms stand.
What if we have already started?
Good. Send what you have, and we build on it. If you need only some of the documents, tell us which and we will tell you whether a smaller written quote fits.
Do the duties apply to forms we already use?
The Act says a written assessment is needed before collecting personal information, and an update before a significant change in purpose (MFIPPA s. 28). It does not say directly how that applies to programs that began before 2027 and keep collecting after. That is a judgment for your head and, if needed, your solicitor. Either way, the riskiest ongoing collections, such as children’s programs, are the sensible place to start. The notice of collection, on the other hand, already applies to every form today.
Does the pack cover PHIPA?
No. For a board of health, PHIPA governs the personal health information the medical officer of health holds as a custodian, and MFIPPA does not apply to it (PHIPA s. 8(1)). The pack covers the MFIPPA side and marks where your existing PHIPA process applies instead. More for boards of health.
Time, approvals and buying
How much staff time does it take?
Most of it is one contact person gathering what you already have: forms, notices, policies, the retention by-law and a list of systems and vendors. They answer a short written questionnaire within 5 business days of accepting, and pass our occasional email questions to the right department. Then your head reads the documents and signs. No meetings and no software to learn. We do not quote a number of hours, because it depends on how your files are kept.
Do we need council or board approval?
Two separate questions. To buy: your procurement by-law or policy sets what staff can authorize directly, and the pack has one fixed price, so it is easy to check against your limit. To sign: the head signs, which is council or the board unless a member, a committee or a written delegate has been named. The one-page council or board briefing in the pack explains what changed and what was done.
How do we buy it?
Ask for a written quote. It is one page, with the scope, the fixed price, what is not included, who does what, the delivery date and payment terms, valid for 30 days, and the service agreement comes with it. Accept by replying “yes” or by sending a purchase order that names it. We invoice after delivery, net 30, by EFT or cheque. Pricing and payment terms.
When would we get it?
About 3 weeks after your questionnaire answers arrive. Accept a quote by Monday, November 30, 2026 and send your answers within 5 business days, and the pack is delivered by Monday, December 21, in time for your head to sign before January 1.
Your information and the documents
Where is our information kept, and by whom?
In access-controlled accounts with multi-factor sign-in, used only for your work and seen only by the people working on it. Before any paid work starts, we confirm in writing which providers will hold or process your documents and in which countries. Some of our providers may store data outside Canada. If your institution needs documents kept only in Canada, tell us before you send anything, and we will agree in writing on how, or tell you plainly if we cannot. Working files are returned or deleted within 30 days after the work ends. Our privacy notice.
What do you need from us?
For the free check, only your institution’s name. For the pack: one contact person, your current forms, privacy notices and policies, your retention by-law, a list of the main systems and outside services that hold personal information, and answers to a short written questionnaire. We never ask for logins, passwords, or personal information about residents, students, patrons or staff. The full list.
Do you provide documents in French?
The pack is prepared in English. If your institution needs French versions, for example a French-language school board, tell us before you accept a quote. We will confirm in writing whether we can provide them, by when and at what price, before you commit to anything.
Are the documents accessible?
We write them in plain language with real headings, lists and table headers, and we do not use colour alone to carry meaning, so they work with screen readers and convert cleanly into your own accessible formats. You receive editable files, so you can apply your own templates. Our free checklist on this site is a tagged PDF. If your accessibility policy needs a particular format, tell us when you ask for a quote.
After January 1, 2027
What happens after January 1, 2027?
The duties apply to every collection from then on: an assessment before each new collection and an update before any significant change, a decision each time a breach happens, and the yearly breach statistics by March 31, starting in 2028. The pack gives you the policy, template, protocol and log to do this yourself. If you want help, we prepare additional assessments from CA$1,500 and the yearly report from CA$750.
What if we order after January 1?
The documents are just as useful in January, because the duties apply from then on; the quote gives the delivery date. Until your pack arrives, the most urgent items are a named person who decides whether a breach must be reported, and a way to report to the IPC. Our free checklist lists them.
What if the rules change?
The January 1, 2027 start date is in the law (Bill 97, Schedule 11). If a regulation changes what an assessment must contain before we deliver, we update the documents at no extra charge. If a change removes the need for the work before we start, either side can end the agreement and you get a full refund of anything paid. After delivery, a change that needs new work is quoted first.
What if the IPC finds a problem with a document?
If the IPC finds a document we prepared is missing content the Act requires, for a reason inside our scope, we fix it free. Send us what you received, and we tell you within 2 business days whether the reason is inside our scope. Information that was wrong when you gave it to us, facts that changed after delivery, and decisions that were yours are outside it.
About us
Do you have references?
Maple Privacy Desk is new, so we have no client references to share yet, and we will not offer any we do not have. What you can check instead: the opening pages of our core documents, our October 2026 research on public forms, a free check of your own forms, and a fixed written quote. You pay nothing until the pack is delivered, and either side can end the work before it starts.
Where are you based?
Maple Privacy Desk is a service of 1414618 B.C. Ltd., a British Columbia corporation, Business Number 716678545. We work with Ontario institutions by email. Ontario’s Municipal Buy Ontario Procurement Directive, in effect since April 13, 2026, asks the municipal sector to prioritize Ontario and Canadian goods and services; if your file needs it, the quote can state where the work is performed.
Can you present to council or the board?
The pack includes a one-page briefing your clerk, CAO or privacy lead can present: what changed, what you have done and what council or the board needs to know. We work by email so everything is in writing, and we are glad to answer council’s or the board’s questions in writing before the meeting.
How is the free check different from the pack?
The free check looks only at your public website: the notice of collection on up to five forms, and whether a privacy policy, a breach route or privacy impact assessments are visible. It is free and one page. The pack is the ten documents your institution needs for the January 1 duties, written from your own forms, practices and answers.
Start with a free check, or ask for a quote
Email your institution’s name to:
hello@mapleprivacydesk.caWe reply within 2 business days. Please do not send personal information about residents or staff. We do not need it.
What to put in your email
- Your institution’s name.
- Your name and role, so we know who the check or quote is for.
That is all we need. We find your public forms and privacy pages ourselves.