FIPPA compliance for Ontario
provincial institutions
Ontario's FIPPA governs how provincial ministries, agencies and other provincial institutions handle personal information and answer access requests. Since July 1, 2025 it also requires breach reporting and a written privacy impact assessment before collecting personal information. Assess your FIPPA obligations in English or French and see your gaps weighted by importance. Part of the Professional plan.
Based on your answers, you may need a Privacy Impact Assessment under Law 25 §12.
AI guidance at every step.
As you answer each question, built in AI assistance explains the relevant statutory requirement in plain English, flags your risk level, and suggests remediation steps, so your team learns while they comply.
Request a demoFrom gap to resolved, automatically.
Every identified gap automatically creates a prioritized task with suggested remediation, assigned to the right team member. Track closure rates and demonstrate continuous improvement to your regulator.
Request a demoAdditional features
Request a demoFIPPA Assessment
Asks about accountability, identifying purposes, limiting collection, limiting use, disclosure and retention, accuracy, individual access and safeguards. Each question cites the section it tests and explains why it matters.
Gaps With Citations
Every gap comes with a recommendation and the FIPPA section behind it, weighted by importance, with a readiness card on your dashboard and a PDF report.
Breach Routing
For an Ontario provincial institution the breach panel identifies the Information and Privacy Commissioner of Ontario (IPC), the real risk of significant harm test under section 40.1 and the timing: as soon as feasible after you determine the breach occurred.
Access Request Deadlines
Tracks the 45 business day deadline to answer an access request made on or after July 1, 2026, and the decision letter names the route to appeal to the IPC.
Privacy Impact Assessments
Since July 1, 2025, FIPPA requires a written assessment before you collect personal information. On Professional, Valdra includes a privacy impact assessment tool you can use to prepare.
English and French
Every question, explanation and recommendation is available in French, following the official French text of the Act (LAIPVP), and the report is labelled in French too.
Frequently asked questions
What is Ontario FIPPA?
FIPPA is Ontario's Freedom of Information and Protection of Privacy Act. It gives the public a right of access to records held by provincial institutions and sets rules for how those institutions collect, use, disclose, retain and protect personal information. The Information and Privacy Commissioner of Ontario (IPC) oversees it.
Who has to comply with Ontario FIPPA?
Ontario's provincial institutions, including ministries, many provincial agencies, boards and commissions, and other institutions named in the regulations, such as universities, colleges and hospitals. Municipal institutions fall under MFIPPA instead.
When do we have to report a privacy breach under Ontario FIPPA?
Since July 1, 2025, the head of an institution must report to the IPC, and notify the individual, of any theft, loss or unauthorized use or disclosure of personal information where it is reasonable in the circumstances to believe a real risk of significant harm would result, as soon as feasible after determining that it occurred. The notice tells the individual they may complain to the Commissioner, and the head must keep a record of every breach.
Does Ontario FIPPA require a privacy impact assessment?
Yes. Since July 1, 2025, an institution must complete a written privacy impact assessment before collecting personal information.
How long do we have to answer a FIPPA access request?
For requests made on or after July 1, 2026, an institution must answer within 45 business days after receiving the request. The requester may appeal to the IPC within 30 business days.
What are the penalties under Ontario FIPPA?
FIPPA offences carry a fine on conviction of up to $5,000. IPC orders, complaints and the breach record the Act now requires are the larger practical exposure.
Does Valdra report the breach to the IPC for us?
No. Valdra identifies the regulator, the test and the timing and keeps your breach record. Your institution makes the report. Nothing in Valdra is legal advice.
Learn more about Valdra
Get compliant and build trust
Start free, no credit card.
🍁 Canadian data residency · PIPEDA readiness · SOC 2 in progress
