FIPPA and MFIPPA: what vendors to Ontario public bodies need to know

Ontario has two public-sector access and privacy statutes. The Freedom of Information and Protection of Privacy Act (FIPPA) covers provincial institutions: ministries and many provincial agencies, boards and commissions, as well as other bodies designated by regulation. The Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) covers municipal institutions such as municipalities, police services boards, public library boards, school boards and many local boards and commissions. Health information custodians within these bodies may also be governed by PHIPA for health records.

Both are overseen by the Information and Privacy Commissioner of Ontario (IPC). The distinction matters to vendors because the new obligations took effect on different dates for each.

The institution remains responsible for personal information in its custody or under its control, even when a vendor hosts or processes it. Records you hold on its behalf, such as data in a hosted case-management system, CRM, payment platform or backup, will usually be treated as under the institution's control. That has three consequences for you: the institution must be able to retrieve those records to answer access requests, the institution must be able to investigate and report breaches involving them, and you may only use the information for the purposes the institution allows.

The IPC has published guidance for public sector organizations on privacy and access considerations when contracting with third parties, and institutions increasingly follow it.

• Ownership and control: the institution owns the records; you hold them as a service provider only.
• Use limits: no use for your own purposes, analytics or product training without written authorization.
• Security requirements: specific controls or standards, often aligned with provincial cyber security expectations under the Enhancing Digital Security and Trust Act.
• Breach notice: notify the institution promptly, often within a fixed number of hours, with defined content.
• Cooperation: support the institution's investigation, assessment and reporting, including access to logs.
• Access-request support: retrieve records within deadlines.
• Data location: restrictions or approval requirements for storage and access outside Ontario or Canada.
• Sub-contractors: prior approval and flow-down of the same terms.
• Return and destruction: at the end of the contract, with certification.
• Audit rights and privacy impact assessment cooperation.

Following Bill 194 and later amendments, institutions must assess privacy breaches against the real risk of significant harm (RROSH) threshold, report qualifying breaches to the IPC, notify affected individuals as soon as feasible, and submit an annual report of privacy breaches. According to the IPC, these obligations took effect for FIPPA institutions on July 1, 2025, and take effect for MFIPPA institutions on January 1, 2027, with the first municipal annual report due in 2028.

The IPC says the RROSH assessment considers the sensitivity of the information, the probability of misuse, and whether the individual can take steps to reduce or mitigate harm, among other factors. An institution can only make that assessment quickly if its vendor can tell it, quickly and accurately, what happened. Practically, that means your logging, forensic readiness and incident communications have to be good enough to support someone else's legal decision.

Anyone can request access to records held by or for an institution. If records you host are responsive, the institution will need you to find and export them, with metadata intact, in time to meet its deadline. From July 1, 2026, the general response time for both FIPPA and MFIPPA requests changed from 30 calendar days to 45 business days, with new rules on extensions and staged access plans, according to the IPC. Make sure your platform can search and export by person, date range and keyword, and that your support team knows access-request work is time-critical.

Also expect privacy impact assessment questions. FIPPA institutions have been required to conduct a PIA before collecting personal information since July 1, 2025, and MFIPPA institutions from January 1, 2027. Vendors who can supply clear data-flow diagrams, security documentation and data-location details make those assessments faster.

1. 01

   Know your client's statute

   FIPPA or MFIPPA, and the in-force dates that apply to them.

2. 02

   Map the data

   What personal information you hold for each institution, where it is stored and who can access it.

3. 03

   Tighten incident notice

   Set your internal escalation so you can notify the client well inside the contract window, with the facts it needs.

4. 04

   Keep the evidence

   Retain logs long enough to show what was and wasn't accessed.

5. 05

   Be export-ready

   Test search and export for access requests and investigations.

6. 06

   Prepare a PIA pack

   Data flows, security controls, sub-processors and data location, ready to share.

7. 07

   Flow terms down

   Make sure your own sub-contractors are bound to the same obligations.