For police service boards

What applies from January 1, 2027

• A written privacy impact assessment before each collection of personal information (s. 28(3)), updated before a significant change in purpose (s. 28(5)), and given to the IPC on request (s. 28(6)).
• Reasonable safeguards for personal information and records (s. 30(5)).
• Breach reports to the IPC, and notice to the people affected unless another law prohibits it, when the real risk of significant harm test is met (s. 30.1).
• A record of reported breaches and the count in the annual report to the IPC, first due March 31, 2028.
• IPC reviews of information practices, with orders (s. 38.1).

Every change, section by section.

The law enforcement exceptions, and where they stop

The Act already makes room for policing in several places:

• A collection may be made “for the purposes of law enforcement” (s. 28(2)).
• Information may be collected indirectly for law enforcement (s. 29(1)(g)).
• The notice of collection is not required where the head could refuse to disclose the information under the law enforcement exemptions in s. 8(1) or (2) (s. 29(3)(a)).
• Notice to people affected by a breach is not required where another law prohibits it (s. 30.1(3)); the report to the IPC is still required.

The new assessment duty in s. 28(3) has no law enforcement exception in its text. It applies “unless the regulations provide otherwise”, and regulations may create exceptions (s. 47(1)(b.1)). We found none on October 13, 2026. Until one exists, plan on assessments for police collections, including administrative ones such as record check applications and alarm registrations.

Who signs for the board

The members of the board may designate one of themselves, or a committee, in writing to act as head (s. 3(2)); otherwise the head is the members (s. 3(3)(b)). The head may delegate duties in writing to an officer (s. 49(1)). Check the board’s current designation and delegation against the new duties: who signs assessments, who decides whether a breach meets the test, and who files the yearly report. A regional board that serves several municipalities is one institution.

Collections that usually need an assessment first

• Police record check applications, which collect identity documents and sensitive history.
• Online crime and collision reporting.
• Alarm registrations, paid duty and event requests.
• Cameras: facility cameras, and in-car or body-worn cameras where used.
• Complaints, delegations and correspondence to the board.
• Job and volunteer applications.

What we found on police websites

We read 54 public forms in full on 27 police service websites. 94% left out at least one required part of the notice, and 35% had none. The most common gap was the legal authority: 43% of forms named MFIPPA itself as the authority, which sets the rules for collection but does not authorize a particular program. A privacy policy was visible on 18 of 31 websites (58%); none showed a breach protocol or reporting route, and none mentioned privacy impact assessments. Some of these forms may fall under the law enforcement notice exception; we did not assess exemptions.

We left out 13 OPP detachment boards, whose only forms were their town’s. We do not name any police service or board. Method and limits.

The pack for a police service board

• First assessment: often a camera system or the record check application.
• Assessment policy: how law enforcement collections are handled, and where the notice exception is relied on, recorded with reasons.
• Decision guide: covers the case where notice to individuals is prohibited by another law but the report to the IPC is still required.
• Inventory: separates the board’s own administrative collections from the service’s operational ones, so each can be assessed in turn.
• Board briefing: one page for board members.

Legal questions, such as whether an exemption applies to a particular collection, go to your solicitor. We record what you decide. CA$7,500, invoice after delivery, net 30. Each document in detail.