Updated Guidance For Municipal Privacy Legislation Released In Ontario

On August 13, 2026, the Office of the Information and Privacy Commissioner of Ontario (IPC)  released an updated version of its guidelines “Planning for Success: Privacy Impact Assessment Guide for Ontario’s public institutions” (the Guidance). The updated Guidance reflects new statutory requirements under the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) that will come into force on January 1, 2027.

The Guidance is intended for institutions subject to Ontario’s Freedom of Information and Protection of Privacy Act (FIPPA) or MFIPPA and provides a framework for conducting privacy impact assessments (PIAs) in accordance with both laws. The Guidance builds on its November 2025 iteration, which incorporated the PIA requirements under FIPPA that came into force on July 1, 2025.

When compared with the November 2025 version, the Guidance does not substantially change the IPC’s overall suggestions for conducting PIAs. Rather, the key changes reflect new MFIPPA obligations that will apply on January 1, 2027, including, the details for PIAs that will be mandatory for institutions subject to MFIPPA. Among other things, the Guidance addresses: (i) the information that must be included in PIAs; (ii) the requirement to provide PIAs to the IPC upon request; and (iii) the requirement to complete a written PIA before collecting personal information, subject to prescribed exceptions. The Guidance also highlights the similarity between the PIA requirements applicable to institutions under FIPPA and those that will soon apply to institutions under MFIPPA.

The IPC intends for the Guidance to enhance understanding of the rights and obligations under Ontario’s access and privacy laws and advance best practices. Municipal institutions may use the Guidance to better understand and prepare for their new statutory obligations before January 1, 2027.

For more information, see the full Guidance available here.

Summary By: Victoria Di Felice