Document 1
Privacy impact assessment policy
A short policy your head adopts, so everyone knows when an assessment is needed and how it moves from draft to signature.
- The law behind it
- MFIPPA s. 28(3), (5) and (6); s. 49(1) for delegation
- Who signs
- Your head, or the head’s written delegate, adopts it
What it contains
- When an assessment is needed: before any new collection, and before any significant change to the purpose for which information is used or disclosed. Following the IPC, also when practices change in ways that could increase harm, such as a new platform, a new purpose or a new retention period.
- A first check of whether a project involves personal information at all, with the conclusion recorded either way, as the IPC recommends.
- Roles: who leads the project, who prepares the assessment, who reviews it (someone other than the preparer, as the IPC recommends), and who signs.
- How risks that will not be fully mitigated are accepted, by whom, and how that is recorded.
- Where signed assessments are kept, and how a request from the IPC for a copy is logged and answered.
- A review cycle: we suggest at least once a year and after any breach that touches the project.
- A list of your ongoing collections, ordered so the riskiest are assessed first.
Document 2
Privacy impact assessment template
The template your staff use for every future assessment. It follows the four steps in the IPC’s Planning for Success guide (August 2026), and its core is one section for each of the ten items the Act lists. Each part shows, with a label, what the Act requires, what the IPC recommends, and what we suggest.
- The law behind it
- MFIPPA s. 28(3) to (6), s. 28(2), s. 29, s. 30, s. 31 and s. 32
- Who signs
- Each completed assessment: your head or delegate, after a review by someone other than the preparer
What it contains
- Step 1 check: does the project involve personal information, whose, and the recorded conclusion.
- Part A, project details: title, department, project lead, assessment lead, version, start date, what is in and out of scope.
- Part B, project analysis: the team, a checklist of key features (a service provider, storage outside Ontario, cameras or location data, online forms, linked databases, sharing with others) and an information flow table: how each type of information is collected, used, kept, secured, disclosed and disposed of.
- Part C, the ten required elements: purpose and necessity; legal authority under s. 28(2), s. 31 and s. 32; types and uses; sources and the notice of collection wording; position titles with access; limits; retention under Reg. 823, s. 5; safeguards, with the risks to people using the harms listed in s. 30.1(10); steps to prevent and to mitigate; anything prescribed.
- Part D, risk table: what could go wrong, who is affected, likelihood, harm, priority and the step that addresses it.
- Part E, mitigation plan: each step with an owner, whether it is in place before collection, and if not, why and by when, as s. 28(4) requires.
- Part F, sign-off: prepared by, privacy review, project lead, and the head or delegate with the delegation reference, plus any risks accepted without mitigation.
- Part G, copies to the IPC: a log of every request under s. 28(6).
- Part H, review schedule: versions, changes and the next review date.
Items a regulation may set are marked, so your staff know to check for new regulations before relying on them.
Document 3
Your first completed assessment
The template filled in for one real collection you choose, so your staff have a finished example to copy and your riskiest collection is covered first.
- The law behind it
- MFIPPA s. 28(3) and (4)
- Who signs
- Your head or delegate. Your solicitor or clerk confirms the legal authority line.
Common first choices
- Municipalities: online recreation or camp registration, which often collects children’s health notes through an outside booking service.
- Library boards: library card registration, or a room booking or program system run by a vendor.
- Police service boards: a camera system, or an online reporting or request form.
- School boards: a registration form, or an education app that can see student information.
- Conservation authorities: permit applications, or camp and education program registration.
- Boards of health: a program or course registration outside personal health information.
What we prepare it from
The forms, the system or vendor it runs on, who can see the information, how long it is kept, the vendor contract terms you have, and the legal authority you rely on. We record the authority you cite; we do not conclude whether a collection is lawful. That line is for your solicitor or clerk.
Document 4
Breach response protocol
Who does what in the first hours and days after a suspected breach, set out so a clerk can follow it on a bad day.
- The law behind it
- MFIPPA s. 30.1; the IPC’s breach guidelines (August 2026)
- Who signs
- Your head or delegate adopts it
What it contains
- A roles table with position titles and backups: the breach lead, the head or delegate who determines that a breach occurred and decides the test, the IT lead or provider, and a communications or legal adviser.
- The IPC’s six steps in order: assess and contain; assess the real risk of significant harm; notify the people affected; report to the IPC; investigate; reduce the risk of future breaches.
- Containment checklists: getting information back or destroyed with written assurance that no copies were kept, changing passwords, pausing a system or a staff member’s access.
- Internal targets, which are our suggestion and not legal deadlines: the breach lead and head told the same business day; the decision recorded within 2 business days; any report and notice aimed for within 5 business days of the head’s determination.
- Who else to consider telling, as the IPC suggests: police, regulators, technology suppliers and the Canadian Centre for Cyber Security.
- A yearly tabletop exercise, so the protocol is practised before it is needed.
Document 5
Real risk of significant harm decision guide and decision record
The Act’s test turned into a short decision path, with prompts for each legal factor and a form that records the decision and the reasons.
- The law behind it
- MFIPPA s. 30.1(1), (3), (7) and (10)
- Who signs
- Each decision record: the head or delegate who made the decision
What it contains
- A seven-step path: was personal information involved; was it stolen, lost, or used or disclosed without authority while in your custody or control; contain now; work through the factors; decide; check other laws and contracts; record and sign.
- Worked prompts for sensitivity, probability of misuse and the steps people could take, drawn from the IPC’s guidelines, plus a check of IPC guidance and any prescribed factor.
- Two illustrations, clearly marked as examples and not rulings.
- A decision record with about twenty fields: when the breach was found and when the head determined it occurred, what happened (without repeating the personal information), the people and groups affected, containment, the findings on each factor, the decision and reasons, and the dates of any report and notice.
- A note to assess separately any group in the same incident that faces a different risk.
Document 6
Notice templates
Draft wording for the two things the Act requires when the test is met, so nobody writes them from a blank page under pressure.
- The law behind it
- MFIPPA s. 30.1(2) and (4); the IPC FAQ and breach guidelines
- Who signs
- Your head or delegate sends each one
What it contains
- Report to the IPC: the fields the IPC’s online form asked for on October 13, 2026, including what happened, when and how it was found, the information involved, the number of people, containment, notification, and investigation steps done and planned, with a reminder not to include the personal information itself.
- Notice to the people affected: the statement that they can complain to the IPC, as the Act requires, plus what the IPC expects: what happened and when, the information involved, what you are doing, steps people can take, a contact at your institution, how to complain and the one-year limit.
- Direct or indirect notice: the situations in which the IPC’s guidelines say indirect notice, such as a prominent website notice, may be used, and how to make it likely to reach the people affected.
Document 7
Breach log
One record of every incident, with a column for the ones reported to the IPC, set up in the categories the IPC counts so the yearly report takes minutes.
- The law behind it
- MFIPPA s. 30.1(8) and (9); s. 26(2)(c.1)
- Who keeps it
- The breach lead named in your protocol
What it contains
- Columns for the date found, the head’s determination, category and sub-type, the number of people and their band, whether the test was met, report and notice dates, status, and a link to the decision record.
- The categories and bands the IPC used on October 13, 2026: stolen, lost, used without authority or disclosed without authority, each with sub-types; people affected in bands of 1, 2 to 10, 11 to 50, 51 to 100 and over 100.
- A note that only breaches reported under s. 30.1(1) go in the yearly count, while every incident is still recorded.
Document 8
Safeguards policy and register
A short policy statement your head can adopt and a register of 23 common safeguards, each with an owner by position title, a status, the evidence that it works and review dates. Regulation 823 already asks for measures to be “defined, documented and put in place”; the register is one way to show the documented part.
- The law behind it
- MFIPPA s. 30(5), s. 4.1, s. 30(1) and (4); Reg. 823, ss. 2, 3 and 5
- Who signs
- Your head or delegate adopts the policy; each row has an owner
The policy in eight points
Purpose, scope (all formats, including spoken information and information a service provider holds for you), need to know, documented measures, accountability, staff duties, service provider terms, and review.
The 23 starter safeguards
The register feeds element 8 of every assessment, which lists the register IDs that apply, and step 5 of the breach protocol, which uses it as the checklist when you investigate what failed.
Document 9
Personal information inventory
One list of what your institution collects and where it goes. It is the starting point for every assessment and the first thing you need when something goes wrong.
- The law behind it
- MFIPPA s. 28(3), s. 30(1); the IPC’s breach guidelines, section 6.1
- Who keeps it
- Your privacy lead, with each department
What it contains
- Each collection: forms, programs, cameras and systems, online and on paper.
- For each: the department that owns it, where the information is kept, who can see it, how long it is kept under your retention by-law, and which outside service holds it.
- Whether an assessment exists, and the order in which the rest should be done.
Document 10
Council or board briefing, and a staff briefing
Two short documents so the people who need to know, know.
- Council or board
- One page: what changed on January 1, what your institution has done, and what council or the board needs to know, such as who the head is and which duties are delegated.
- Staff
- A short note for front-line staff: what a breach looks like, to tell the breach lead at once and not try to fix it alone, and the everyday habits that prevent the common ones.