MFIPPA amendments · Ontario
The municipal privacy rules take effect January 1, 2027.
Small Ontario institutions will carry three new statutory duties from January 1, 2027: mandatory breach notification, Privacy Impact Assessments, and an express duty to safeguard personal information. With no one in-house to hand this to, Tectonix does the readiness work and the assessments for you.
Is this you?
You are on the hook for the same rules as a big city, without the team.
Privacy sits with the clerk or CAO, informally. It is nobody's actual job.
There is no in-house privacy office and no budget to staff one.
New software, forms, cameras, and vendors keep touching residents' personal information.
You need a plan that fits an institution your size, not an enterprise privacy program.
If that is your municipality or board, none of this means you have done anything wrong. It means you need a finite piece of work done before the deadline, and someone to do it.
What changes
Three duties that did not exist for municipalities before.
Bill 97 extends to MFIPPA institutions the privacy regime provincial ministries have had since 2025. For municipalities and boards, the privacy provisions take effect January 1, 2027.
-
01
Mandatory breach notification
Theft, loss, or unauthorized use or disclosure of personal information must be reported to the affected individual and to the Information and Privacy Commissioner (IPC) where there is a real risk of significant harm.
-
02
Privacy Impact Assessments
Unless the regulations provide otherwise, a written PIA is required before personal information is collected, and an existing assessment must be updated before a significant change to the purpose for which the information is used or disclosed. This is a standing program, every new collection, not a one-time filing.
-
03
Safeguards and record-keeping
An express duty to protect personal information with reasonable administrative, technical, and physical safeguards, plus a duty to keep records of breaches and report breach statistics to the IPC each year.
Primary source: MFIPPA, ss. 28, 30, 30.1 (as amended by 2026, c. 2, Sched. 11, in force January 1, 2027). Plain-language summary: IPC: FIPPA and MFIPPA amendments FAQ. The first annual breach-statistics report covers the 2027 year and is due to the IPC in 2028 (IPC: annual statistical reporting).
General information about pending legislative change, not legal advice.
How Tectonix helps
Two services. Start with the first.
MFIPPA readiness assessment
A fixed-scope diagnostic: where you stand against January 1, 2027, and a prioritized gap list with the order to close it. Defined scope, defined price.
What's included → Service 2 · done for you
PIA and privacy support
Not a template and a training session. Tectonix scopes the assessment, maps the data flows, and delivers the completed PIA for your sign-off, either as a single engagement or as ongoing support with the assessments metered against an annual arrangement.
What's included →The practice
Who you would be working with.
Tectonix Technologies Inc. is a small Canadian corporation, and the Principal Consultant, who holds a CISSP, leads every engagement directly. The person on your scoping call is the person who writes the deliverable.
Their background is PIA and privacy work across multiple public-sector organizations at the municipal and federal levels. The way public institutions actually run is familiar ground, from records and procurement to reporting that has to stand up at a council or board meeting.
Engagements are fixed-scope and quoted in writing, in a form suitable for a purchase requisition. If your purchasing staff need supporting vendor documents, ask on the call and they will be prepared.
How an engagement works
Three steps. Replying costs you nothing.
Scoping call
A 30-minute call to understand your institution and confirm whether there is a gap worth closing. No charge, no obligation. If there isn't, you'll be told so.
Fixed scope & written quote
You get a written statement of exactly what is in scope, what is out, what Tectonix needs from you, and a fixed price. You decide before any work begins.
Deliverable & handover
The gap report or completed PIA, as a clear written document suitable for council sign-off and your records, plus a short handover so your staff can carry it forward.
Start here
Book a scoping call.
The fastest path is a 30-minute call. No charge, no pitch. The goal is to find out whether you have a gap worth closing before January 2027.
Or email directly at booking@tectonix.ca.