MFIPPA compliance for Ontario
municipal institutions
MFIPPA governs how Ontario municipalities, police services boards, school boards, library boards and other local institutions collect, use, disclose and protect personal information, and how they answer access requests. Assess your MFIPPA obligations in English or French, see your gaps weighted by importance, and get ready for the breach reporting and privacy impact assessment duties that start January 1, 2027. Part of the Professional plan.
Based on your answers, you may need a Privacy Impact Assessment under Law 25 §12.
AI guidance at every step.
As you answer each question, built in AI assistance explains the relevant statutory requirement in plain English, flags your risk level, and suggests remediation steps, so your team learns while they comply.
Request a demoFrom gap to resolved, automatically.
Every identified gap automatically creates a prioritized task with suggested remediation, assigned to the right team member. Track closure rates and demonstrate continuous improvement to your regulator.
Request a demoAdditional features
Request a demoMFIPPA Assessment
Asks about accountability, identifying purposes, limiting collection, limiting use, disclosure and retention, accuracy, individual access, openness and safeguards. Each question cites the section it tests and explains why it matters.
Gaps With Citations
Every gap comes with a recommendation and the MFIPPA section behind it, weighted by importance, with a readiness card on your dashboard and a PDF report.
Access Request Deadlines
Tracks the 45 business day deadline to answer an access request made on or after July 1, 2026, and the decision letter names the route to appeal to the Information and Privacy Commissioner of Ontario (IPC).
Breach Routing for 2027
From January 1, 2027, MFIPPA requires reporting to the IPC and notifying individuals when a breach creates a real risk of significant harm. The breach panel identifies the IPC, the test and the timing for a municipal institution.
English and French
Every question, explanation and recommendation is available in French, following the official French text of the Act (LAIMPVP), and the report is labelled in French too.
The Right Law for Your Body
Tell Valdra you are an Ontario municipal institution and it sets MFIPPA as your home law. A provincial institution gets FIPPA instead.
Frequently asked questions
What is MFIPPA?
MFIPPA is Ontario's Municipal Freedom of Information and Protection of Privacy Act. It gives the public a right of access to records held by municipal institutions and sets rules for how those institutions collect, use, disclose, retain and protect personal information. The Information and Privacy Commissioner of Ontario (IPC) oversees it.
Who has to comply with MFIPPA?
Ontario's municipal institutions, including municipalities, police services boards, school boards, public library boards, boards of health, conservation authorities and other local boards and commissions. Provincial ministries, agencies and other provincial institutions fall under FIPPA instead.
Does MFIPPA require breach reporting?
Not yet. From January 1, 2027, the head of an institution under MFIPPA must report to the IPC, and notify the individual, of any theft, loss or unauthorized use or disclosure of personal information if it is reasonable in the circumstances to believe a real risk of significant harm to an individual would result, as soon as feasible. Until then MFIPPA contains no breach notification duty.
Does MFIPPA require a privacy impact assessment?
From January 1, 2027, an institution must complete a written privacy impact assessment before collecting personal information. Until then there is no such duty under MFIPPA. On Professional, Valdra includes a privacy impact assessment tool you can use to prepare for the duty that starts January 1, 2027.
How long do we have to answer an MFIPPA access request?
For requests made on or after July 1, 2026, an institution must answer within 45 business days after receiving the request. The requester may appeal to the IPC within 30 business days. Valdra tracks the deadline and the decision letter names the appeal route.
What are the penalties under MFIPPA?
MFIPPA offences carry a fine on conviction of up to $5,000. The larger risks for most institutions are IPC orders, complaints and the loss of public trust after a breach.
Is the MFIPPA assessment on the Free plan?
The Free plan includes one complete assessment of your home law, and MFIPPA counts as a home law for an Ontario municipal institution. The Professional plan includes MFIPPA along with the other assessments.
Learn more about Valdra
Get compliant and build trust
Start free, no credit card.
🍁 Canadian data residency · PIPEDA readiness · SOC 2 in progress
