Sample check | Maple Privacy Desk

What the free privacy notice check looks like

Email us your institution’s name and, within 2 business days, you receive a one-page PDF like the one below. It reads your public online forms against the notice of collection that MFIPPA s. 29(2) already requires, form by form, and checks your website for three things. This sample is a real check from October 13, 2026, with the institution’s name, website, links and exact form titles removed.

Maple Privacy Desk

Privacy notice check: [Institution name withheld]

Sample
Anonymized

Website: [Website withheld]
Read on: October 13, 2026. Public pages only: we did not submit any form, log in or contact anyone.
What we read: 3 public online forms, each read in full.

Notice of collection on each form

Two of the three forms we read leave out part of the notice of collection the Act already requires.

Each item of the s. 29(2) notice, form by form
Form	Legal authority	Purpose	Contact title	Business address	Business phone
Complaint form	Act only	Yes	Yes	No	No
Facility booking request	No	No	No	No	No
Burn permit application	Yes	Yes	Yes	Yes	Yes

What the Act already requires

When personal information is collected, MFIPPA s. 29(2) says the institution must tell the person (a) the legal authority for the collection, (b) the principal purpose or purposes, and (c) the title, business address and business telephone number of an officer or employee who can answer questions. This is in force today. A bare mention of MFIPPA does not give the legal authority, because MFIPPA sets the rules for collection rather than authorizing a program.

A notice you can reuse on each form:

Personal information on this form is collected under the authority of [by-law or statute] and will be used to [purpose]. Questions about this collection can be directed to the [title], [Institution], [business address], [business phone].

Website checks

Three things a resident can look for
Item	Result	Note
Privacy policy or statement	Found	[Link withheld]
Breach protocol, or a way to report a breach	Not found	We searched the public site and could not find one. It may exist internally.
Any mention of privacy impact assessments	Not found	We searched the public site and could not find one. It may exist internally.

What starts January 1, 2027

Bill 97 amended MFIPPA. From January 1, 2027: a written privacy impact assessment before collecting personal information (s. 28(3)), reasonable safeguards (s. 30(5)), breach reports to the Information and Privacy Commissioner and notice to the people affected when there is a real risk of significant harm (s. 30.1), and a record of every reported breach for the annual report, the first due March 31, 2028.

This check covers public web pages only. A notice can also be given on paper, at a counter or in a confirmation email, which we could not see, and some collections are exempt (s. 29(3)). Practical guidance, not an audit and not legal advice.

What the check covers

Up to five public online forms that collect personal information, including fillable PDFs and forms a vendor runs for you.

Each of the five items in the s. 29(2) notice, on each form.

Whether your website shows a privacy policy, a breach protocol or reporting route, and any mention of privacy impact assessments.

A notice block you can reuse, with your institution’s name in it.

What it does not cover

Paper forms, counter conversations and anything behind a login.

Internal policies, vendor contracts, and assessments that already exist inside the office.

Whether a statute or by-law authorizes each collection. That is for your solicitor.

Security testing of any system.