Who it is for
Every institution under MFIPPA, whatever its size
The January 1, 2027 duties apply to each “institution” defined in MFIPPA s. 2(1). That is a municipality, a list of local boards, and any body a regulation designates. Each board is its own institution, with its own head, its own assessments and its own breach duties, even when it shares a building, staff or software with the town.
Municipalities
Lower, single and upper tier. The head is council unless a by-law names a member or committee; the clerk usually does the work under a written delegation.
93% of 1,044 municipal forms missed a part of the notice
Public library boards
Library cards, borrowing records, children’s programs and the platforms behind them. Separate from the town’s documents.
70% of 150 library forms had no notice part at all
Police service boards
Law enforcement exceptions cover some notices and collections; the new assessment duty has no such exception in its text.
0 of 31 police websites showed a breach protocol
School boards
Students, families and staff, registration systems and many education apps. School authorities too.
95% of 130 school board forms missed a part of the notice
Conservation authorities
Permit applicants and landowners, camps and programs, park passes and reservations.
0 of 29 authority websites showed a breach protocol
Boards of health
PHIPA governs personal health information; the new MFIPPA duties cover the rest of what a health unit holds.
91% of 53 public health forms missed a part of the notice
The full list in the Act
MFIPPA s. 2(1), definition of “institution”, as read on e-Laws on October 15, 2026.
- a municipality;
- a school board, municipal service board, city board, transit commission, public library board, board of health, police service board, conservation authority, district social services administration board, local services board, planning board, local roads board, police village, or joint committee of management or joint board of management established under the Municipal Act, 2001 or the City of Toronto Act, 2006 or a predecessor of those Acts;
- any agency, board, commission, corporation or other body designated as an institution in the regulations.
The readiness pack works for any of them. If your institution is a transit commission, a district social services administration board, a planning board or another body on this list, the same ten documents apply; tell us what you are when you ask for a quote.
One pack covers one institution. A municipality and its library board are two institutions, so they need two sets of documents, each signed by its own head.
What we found, by type
From our October 13 and 14, 2026 review of public websites. Each form is counted once. We do not name any institution.
| Type | Websites | Forms missing a notice part | Privacy policy found | Breach route found | Assessments mentioned |
|---|---|---|---|---|---|
| Municipalities | 441 | 93% | 64% | 8% | 9% |
| Public library boards | 74 | 93% | 78% | 18% | 1% |
| Police service boards | 31 | 94% | 58% | 0% | 0% |
| School boards and authorities | 67 | 95% | 81% | 34% | 10% |
| Conservation authorities | 29 | 88% | 66% | 0% | 0% |
| Boards of health | 25 | 91% | 96% | 12% | 16% |
Start with a free check, or ask for a quote
Email your institution’s name to:
hello@mapleprivacydesk.caWe reply within 2 business days. Please do not send personal information about residents or staff. We do not need it.
What to put in your email
- Your institution’s name.
- Your name and role, so we know who the check or quote is for.
That is all we need. We find your public forms and privacy pages ourselves.