For school boards and school authorities

What applies from January 1, 2027

• A written privacy impact assessment before each collection of personal information (s. 28(3)), updated before a significant change in purpose (s. 28(5)).
• Reasonable safeguards for personal information and records (s. 30(5)).
• Breach reports to the IPC and notice to the people affected when the real risk of significant harm test is met (s. 30.1).
• A record of reported breaches and the count in the annual report to the IPC, first due March 31, 2028.
• IPC reviews of information practices, with orders (s. 38.1).

Since July 1, 2026, records naming software applications a school board acquired that can access students’ personal information are excluded from the Act (s. 52(7)). The exclusion covers records naming the applications, not the student information the applications hold. Every change, section by section.

Who signs

The trustees may designate one of themselves, or a committee, in writing to act as head (s. 3(2)); otherwise the head is the board’s members (s. 3(3)(b)). The head may delegate duties in writing to officers, for example the director of education or a privacy officer (s. 49(1)). If your board already has a freedom of information and privacy office, the pack is written to fit into it, not replace it.

Collections that usually need an assessment first

• Student registration and enrolment: identity, address, custody, medical and emergency information.
• Education technology: learning platforms and classroom apps that can see student information.
• Field trip, before and after school, and special program forms with health and allergy details.
• Cameras in schools and on school property.
• Parent and student surveys.
• Community use of schools permits, volunteer applications and staff hiring.

Some student records, such as the Ontario Student Record, also have their own rules under the Education Act. Where those rules overlap with MFIPPA, your board’s procedures and solicitor decide.

Education apps and vendors

For most boards the hardest part is volume: many applications, each holding some student information. The inventory lists them in one place with what each can see and where it stores data, and the assessment template is designed to be reused quickly for each new application. The IPC expects contracts to require vendors to report breaches to the institution immediately; the safeguards register tracks which contracts do.

What we found on school board websites

We read 130 public forms in full on 64 websites of school boards and school authorities. 95% left out at least one required part of the notice of collection and 32% had none. 28% named only MFIPPA as the authority. School boards were further along on breach readiness than other groups: 34% of their websites showed a breach protocol or a way to report a breach, and 10% mentioned privacy impact assessments. A privacy policy was visible on 81%.

We do not name any board. All institution types compared.

The pack for a school board

• First assessment: a registration form, or one education application chosen as the pattern for the rest.
• Inventory: includes the application list, so you can see which assessments to do next.
• Breach protocol: roles mapped to your existing privacy office, principals and IT.
• Board briefing: one page for trustees. Staff briefing: for school offices and teachers.

Larger boards usually have more collections than one pack’s first assessment covers. The pack gives you the method and the order; extra assessments start at CA$1,500 each. French-language boards: see our answer on French.