Privacy Impact Assessments Become Mandatory in Ontario on January 1, 2027: How to Get Ready

Privacy Impact Assessments Become Mandatory in Ontario on January 1, 2027: How to Get Ready

PIAs are expressly mandatory for all institutions subject to Ontario’s Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) as of January 1, 2027. Institutions must complete a written PIA before collecting personal information to evaluate privacy and security risks and outline prevention and mitigation steps, unless a regulatory exception applies. Provincial institutions under FIPPA have had the same duty since July 1, 2025. For municipalities, police services and other local institutions, the deadline is now weeks away.

What does Ontario’s PIA requirement say?

Bill 97, the Plan to Protect Ontario Act (Budget Measures), 2026, amended MFIPPA to make PIAs mandatory (sections 28(3) to (6)). The new PIA requirements apply to both recorded and unrecorded personal information. PIAs must be done in writing, and contain, at minimum, the mandatory information set out in FIPPA and MFIPPA, which includes:

• The purpose for collecting, using or disclosing personal information and an explanation of why the personal information is necessary to achieve that purpose
• The legal authority that the institution is relying on to collect, use or disclose the personal information
• The types of personal information to be collected and, for each type, how it is intended to be used or disclosed
• The sources of the personal information to be collected
• The position titles of the institution’s officers, employees, consultants or agents who will have access to the personal information
• Any limitations or restrictions imposed on the collection, use or disclosure of the personal information
• The period of time that the personal information will be retained by the institution
• An explanation of the administrative, technical and physical safeguards that would be used to protect the personal information and a summary of any risks to individuals in the event of a theft, loss or unauthorized use or disclosure of the personal information
• The steps to be taken by the institution to prevent or reduce the likelihood of a theft, loss or unauthorized use or disclosure of personal information, and to mitigate risks to individuals in the event of such a privacy breach

The steps set out in the PIA to prevent and mitigate risks must generally be implemented before collecting personal information. Prior to making any significant change to the purpose for which the personal information is used or disclosed, institutions must update their PIAs and implement any additional steps necessary to prevent and mitigate risks, subject to prescribed exceptions. Institutions are required to provide the Information and Privacy Commissioner of Ontario with PIAs upon request.

When should a PIA be done?

Under section 28(3) of MFIPPA, there is a general requirement to conduct PIAs before collecting personal information. Under section 28(5) of MFIPPA, PIAs must also be updated before making any significant change to the purpose for which personal information is used or disclosed.

Institutions should also conduct or update PIAs whenever there are new or changed personal information practices that have the potential to increase adverse impacts on individuals’ privacy: for example, changes to technology platforms that house or process personal information, changes to the purposes to which the personal information will be put, or changes to retention periods for personal information.

Institutions also need to define who will review and approve the PIA (separately from who conducted it), who will be responsible for implementing recommendations to address identified privacy risks, and who will be responsible for updating the PIA on an as-needed basis. That last set of questions is where many institutions will struggle, because a PIA is only as useful as the follow-through behind it.

Why is a one-time PIA not enough?

A PIA captures a project at a moment in time. Technology and vendors keep changing.

A new report from the Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic (CIPPIC), Beyond the Initial Agreement: How Privacy Drift Affects Modern Third-Party Contracting (October 2026), calls this “privacy drift.” Cloud and AI vendors revise terms, add features, expand what they collect about how a service is used, and change subprocessors after the institution has finished its review. A platform that looked acceptable in January may operate under different conditions by July. A strong PIA program therefore needs ongoing ownership and tracking, not a document that is filed and forgotten.

How does Vayle PIA help institutions prepare?

Vayle PIA is built to run an institution’s entire PIA program, not just individual assessments. It can support federal, provincial and municipal institutions, in Ontario and in other provinces, and gives privacy teams one place to complete, monitor and maintain their PIAs:

• Program-wide visibility. Every PIA, its status, its identified risks and its outstanding actions sit in a single dashboard, so privacy leads can see where the program stands at any time and demonstrate due diligence when asked.
• Guided PIAs. Structured steps help teams capture personal information types, data flows and safeguards without starting from a blank page.
• AI risk assessments. The same guided workflow supports assessments of AI tools and AI-enabled features, so institutions can document purpose, data inputs, human oversight and risk mitigation for AI systems in the same program as their PIAs, ahead of the accountability frameworks developing under Ontario’s Enhancing Digital Security and Trust Act, 2024.
• Consistent data. Controlled dropdowns keep personal information types and classifications standardized, so assessments are comparable across the program and easier to review.
• Team collaboration. PIA project team members, including business, IT, security, legal and privacy staff, work in the same assessment with defined roles for who conducts, reviews and approves each PIA.
• Risk tracking and follow-through. Identified risks are tracked in one place, with mitigation tasks assigned to named owners and monitored to completion, so recommendations do not stall after the report is signed off.
• Vendor tracking (coming soon). Third-party and subprocessor relationships will be managed alongside the PIAs they affect, with vendors periodically asked to confirm whether anything has changed, so assessments stay current as vendor arrangements evolve.

Together, these capabilities turn the PIA from a one-time form into a managed, living program that stays current as projects, people and vendors change.

Frequently asked questions

Get ready before January 1

Public sector institutions across Canada are integrating Vayle PIA into their privacy programs. To see how Vayle PIA can support your PIA process, book a demo at Vayle.

About Vayle

Based in Toronto, Canada, Vayle delivers modern Freedom of Information (FOI), Privacy Impact Assessment (PIA), online forms ( FormLink), and secure ID verification workflow solutions (Vayle ID) purpose-built for government and public sector organizations. By modernizing and automating information access and privacy programs, Vayle helps organizations strengthen compliance, improve operational efficiency, and enhance public trust.