MFIPPA and FIPPA: Privacy Rules for Ontario's Public Sector and Their Vendors
Sell to a city, a library board, or a school board in Ontario and your contract inherits an access-to-information regime most private vendors have never read.
Ontario's public sector runs on two statutes: FIPPA for provincial institutions and MFIPPA for municipal ones, including cities, police services boards, school boards, library boards, and conservation authorities. Both do two jobs at once. They give the public a right of access to records, and they restrict how institutions collect, use, and disclose personal information.
If you are a vendor holding data on behalf of one of these bodies, you are inside that regime by contract even though the statutes bind the institution rather than you. Most vendors discover this at contract negotiation, badly.
What surprises private-sector vendors most?
Three things, consistently.
Access requests can reach your systems. A member of the public can request records held by the institution, and records you hold on the institution's behalf are generally within reach. Your contract will oblige you to help retrieve them, usually inside the institution's statutory response clock rather than yours. If your architecture cannot export a specific person's records without an engineering project, you have a delivery problem you should price before signing.
Collection must be authorised. Public bodies cannot collect personal information simply because it is useful. Collection has to be authorised by statute, used for law enforcement, or necessary to a lawfully authorised activity. A feature that quietly gathers more than the institution needs is not a nice-to-have you can enable by default; it can put the institution offside.
Disclosure rules are narrower than in the private sector. Consent does not open every door. Institutions operate on defined permitted purposes, and a vendor proposing to use the data for product improvement or analytics is often proposing something the institution cannot lawfully agree to, whatever the sales conversation suggested.
| Question | Private sector under PIPEDA | Ontario public body under FIPPA or MFIPPA |
|---|---|---|
| Basis for collection | Consent, with reasonable purposes | Statutory authority or necessity to an authorised activity |
| Public access to records | No general right | General right of access, with exemptions |
| Use for product improvement | Possible with consent | Usually not available |
| Oversight | Privacy Commissioner of Canada | Information and Privacy Commissioner of Ontario |
| Breach handling | Real risk of significant harm test | Institution-led, per its own obligations and IPC guidance |
Where does health information fit?
Separately. Ontario's PHIPA governs personal health information held by health information custodians, and a hospital or a public health unit can be subject to more than one regime at once depending on the record.
The practical consequence for a vendor is that "we are PHIPA-ready" and "we can serve a municipality" are different claims. If you are selling into both, keep the configurations distinct rather than assuming the stricter one covers everything, because access rights and disclosure rules differ in ways that do not nest neatly.
What should you build before bidding?
Four capabilities, and they are all easier to build before a procurement than during one.
Per-record retrieval. The ability to produce all records relating to an identified individual, in a readable export, without custom work. This serves access requests and it serves you.
Configurable retention. Public bodies operate under records retention by-laws and schedules that they do not get to ignore because your product defaults to keeping everything. Let them set the period, and enforce it. A retention schedule that the institution controls is a competitive advantage in this market.
Canadian residency with a straight answer. Not "our provider has a Canadian region", but where the data is, where backups are, and which sub-processors touch it. Municipal procurement asks this early and disqualifies fast.
Audit logs the institution can read themselves. Who accessed what, when, without filing a support ticket. Ontario's IPC has been clear for years that unauditable access is a governance failure, and institutions know it.
What goes in the contract?
Expect the institution's template rather than yours, and expect it to name the statute. Read three clauses closely: the access-request assistance clause and its timeline, the restriction on use of the data for any purpose other than delivering the service, and the disposition-on-termination clause, which in the public sector often requires return in a usable format as well as deletion.
Record what you agreed to somewhere your team will see it. A commitment to help with access requests inside ten days is an operational obligation, not a legal footnote, and it should live in your vendor and contract records rather than in a signed PDF nobody opens again.
For the parallel obligations when you also serve federally regulated or private customers, multi-jurisdiction privacy compliance covers how the provincial private-sector laws divide.
This is general information, not legal advice.
Valdra tracks obligations per customer relationship, so an Ontario public-sector contract carries its own retention, access, and residency commitments rather than inheriting your default private-sector posture.
Frequently asked questions
What are MFIPPA and FIPPA?+
Ontario's two public sector access and privacy statutes. FIPPA covers provincial institutions and MFIPPA covers municipal ones including cities, police services boards, school boards, library boards, and conservation authorities. Both grant public access rights and restrict collection, use, and disclosure.
Do these laws apply to vendors?+
They bind the institution rather than the vendor directly, but vendors holding data on an institution's behalf are pulled into the regime by contract. Expect obligations to assist with access requests, restrictions on using the data for your own purposes, and specific disposition terms on termination.
Can a public body consent to us using their data for product improvement?+
Usually not. Public institutions operate on defined permitted purposes rather than open-ended consent, so a use that would be available with consent in the private sector may be something the institution simply cannot lawfully agree to.
What should a vendor build before bidding on Ontario public sector work?+
Per-record retrieval so a specific individual's records can be exported without custom work, retention the institution can configure and that is actually enforced, a precise answer on data residency including backups and sub-processors, and audit logs the institution can read without asking you.
Does PHIPA cover the same ground?+
No. PHIPA governs personal health information held by health information custodians, and an institution can be subject to more than one regime depending on the record. Being ready for one does not make you ready for the other, so keep the configurations distinct.
AI governance and privacy compliance, simplified.
Valdra helps Canadian companies govern AI and meet PIPEDA and Law 25, with records stored in Canada.
Try Valdra
