Privacy Impact Assessments (PIA) are a proactive risk management tool that helps identify and mitigate privacy and security risks associated with the collection, use, retention, and disclosure of personal information. It also supports institutional accountability by ensuring compliance and reducing exposure to privacy breaches.
The requirement to conduct a PIA before collecting personal information, and to implement mitigation steps upfront, serves as a preliminary checklist for handling sensitive data to prove the system is safe and compliant before information is received.
Provincial institutions must conduct PIAs before collecting personal information
Section 38 of FIPPA requires all provincial institutions subject to FIPPA – including ministries, most provincial agencies, boards, and commissions, colleges, universities, and hospitals – to complete a PIA before collecting any personal information and update it whenever there is a substantial change in the purpose for which personal information is used or disclosed.
This requirement was added by the Ford government’s Bill 194 and Bill 97 and started July 1, 2025. PIAs had previously been encouraged by the IPC as a best practice.
Municipal institutions must conduct PIAs before collecting personal information starting in 2027
Starting January 1, 2027, Section 28 of MFIPPA will require all municipal institutions subject to MFIPPA – including municipalities, school boards, police services boards, library boards, local boards – to complete a PIA before collecting any personal information and update it whenever there is a substantial change in the purpose for which personal information is used or disclosed.
This requirement was added by the Ford government’s Bill 97 and will start January 1, 2027. PIAs had previously been encouraged by the IPC as a best practice.
For examples of Privacy Impact Assessments done by Canadian institutions, see the Canadian Privacy Library which hosts 623 PIAs.
Comments
We want to hear from you! Share your opinions below and remember to keep it respectful. Please read our Community Guidelines before participating.