Introduction
On April 24, 2026, Bill 97, the Plan to Protect Ontario Act (Budget Measures), 2026, received Royal Assent. Schedules 7 and 11 amend the Freedom of Information and Protection of Privacy Act (“FIPPA”) and the Municipal Freedom of Information and Protection of Privacy Act (“MFIPPA”), respectively.
This article summarizes the key changes and outlines compliance steps. The amendments take effect on a staggered basis. Most of the access to information amendments under both statutes come into force on July 1, 2026, while key MFIPPA privacy provisions come into force on January 1, 2027.
Access-to-Information Changes (Both Statutes)
Business Days
- Institutions now have more time to respond to access requests: the basic response period under both FIPPA and MFIPPA increases from 30 calendar days to 45 business days. Various other provisions are also amended to require that certain time limits be calculated using business days instead of calendar days (e.g. 15 business days for forwarding requests to third-party where disclosure may affect a third party’s interests, and 30 business days for appealing a decision to the Commissioner).
- Transition rules generally preserve the prior calendar-day regime for requests or notices already in progress when the relevant amendments come into force.
Staged Access Plans
- Institutions may now propose staged access plans for large or complex requests where the search or preparation would unreasonably interfere with operations, the request scope is overly broad, or the requester has submitted multiple interfering requests. Requesters have 30 business days to accept, propose amendments, modify the scope of their request, or appeal where permitted; a request may be deemed abandoned if the requester does not respond and does not appeal the decision to the Commissioner.
- The statutory clock pauses while a plan is proposed. The initial decision to establish a plan (and an amendment made to such plan) may be appealed to the Commissioner.
- These amendments formalize a phased approach many institutions already use for large or complex requests. They also provide institutions with a clearer basis to prioritize workstreams and use staged processing where a request would otherwise interfere with operations.
Second Extensions
- Institutions may now extend the time limit to respond to an access request one additional time where the requester consents, the number of responsive records significantly exceeds the initial estimate, or unforeseeable circumstances arise (e.g., unavailability of knowledgeable staff or need for additional consultations) that were not reasonably foreseeable when the first extension was granted.
- This provides important flexibility where the initial timeline, particularly for large and complex requests, proves unrealistic as processing unfolds. It recognizes that institutions may identify significantly more responsive records than first expected or need additional consultations that were not reasonably foreseeable when the first extension was taken.
Fee Estimates
- Bill 97 adds three express fee-estimate requirements: institutions must issue estimates over $25 before the response deadline expires, advise requesters of the right to request a fee waiver, and pause the response clock until the fee is paid or waived.
- These amendments provide greater clarity and predictability than the previous regime, which did not establish a standardized framework for the timing of fee estimates or for the effect of fee estimates and fee waiver requests on the response timeline.
Definition of Record
- The definition of “record” now expressly includes data in any form and records made, recorded, transmitted, or stored digitally, reinforcing that electronic data may be responsive to access requests.
Cybersecurity Exclusions (Both Statutes)
- Both FIPPA and MFIPPA now exclude certain cybersecurity-sensitive records prepared or collected under the Enhancing Digital Security and Trust Act, 2024, including:
- cybersecurity assessments or evaluations and such summaries,
- names of software applications purchased or acquired by school boards,
- names of employees designated as primary point of contact for ensuring cybersecurity within the public sector entity, and
- records whose disclosure could reasonably be expected to compromise cybersecurity.
The practical effect is to keep these records outside the access regime where disclosure could create security risk.
Key FIPPA-Specific Changes
Ministerial Records Exclusion
- New subsections 65(18) to (21) specifically exclude from FIPPA records that are in the custody or control of a minister or minister’s office, parliamentary assistant, or parliamentary assistant’s office, unless the records are in the custody of the institution. The exclusion is deemed retroactive to January 1, 1988 and narrows the scope of the right of access available under FIPPA. These amendments have raised significant criticism, including from the Information and Privacy Commissioner (IPC) on the basis that they reduce transparency and undermine accountability.
Online Account Access Disclosure
- FIPPA now permits certain disclosures of personal information to employees moving between Ontario ministries, or on temporary assignment from another ministry, to allow continued access to an online account associated with the employee’s email address, subject to any applicable ministerial guidelines.
Data Integration
- For FIPPA institutions involved in data integration, Bill 97 shifts data-standards authority to the Chief Digital and Data Officer, ends mandatory Commissioner reviews of multi-sector data integration units, and requires an annual report to the Commissioner. The Commissioner retains discretionary review authority.
MFIPPA Privacy Changes (January 1, 2027)
At a high level, the amendments align MFIPPA more closely with FIPPA’s privacy-governance framework by including requirements such as privacy impact assessments, breach-reporting, and Commissioner-review obligations for municipal institutions.
Privacy Impact Assessments (PIA)
- Institutions must prepare a written PIA before collecting personal information (unless regulations provide otherwise). PIAs must be updated before any significant change to the purpose for which personal information is used or disclosed. The Commissioner may request access to any PIA.
- To prepare, institutions should develop a PIA process and template that tracks Bill 97’s required content, and should incorporate any prescribed requirements and IPC guidance.
Privacy Safeguards
- MFIPPA contains expanded obligations for institutions to take steps that are “reasonable in the circumstances” to protect personal information.
- In practice, institutions should be prepared to document why their safeguards are reasonable in light of the personal information they hold and the risks associated with it.
Breach Reporting and Notification
- A mandatory privacy breach reporting obligation requires institutions to notify the Commissioner where there is “real risk of significant harm” (RROSH) to an individual, or where prescribed circumstances exist. Unless prohibited by law, affected individuals must also be notified.
- Institutions should create a breach response protocol, if they do not already have one, or update their existing protocol to incorporate the criteria under the law for reporting breaches.
Commissioner Review of Information Practices
- There are expanded powers of the Commissioner, allowing them to review an institution’s information practices and make binding orders.
- Institutions should ensure privacy compliance roles are clear and that safeguards, PIAs, incidents, and retention or disposal practices are properly documented.
Other MFIPPA Changes
- A new whistleblowing provision permits confidential notification to the Commissioner of suspected contraventions. The offence provisions are expanded to include unauthorized collection and use, not only unauthorized disclosure.
- Annual reporting by institutions is expanded to include the number of breaches recorded under the new breach record-keeping requirement.
Key Dates
- January 1, 1988: FIPPA ministerial records exclusion deemed in force.
- July 1, 2026: Most access-request processing reforms come into force (business days, 45-business-day response period, staged access plans, second extensions, fee estimate reforms).
- September 15, 2026: FIPPA data integration amendments and online account access disclosure amendment come into force.
- January 1, 2027: Key MFIPPA privacy provisions come into force (PIAs, breach reporting, safeguards, Commissioner reviews, whistleblowing, annual reporting, and expanded offences).
Conclusion
Bill 97 brings significant changes to Ontario’s access-to-information and privacy framework. In light of the changes described above, both FIPPA and MFIPPA institutions should update their FOI policy and procedures for alignment. The most significant impact will be on MFIPPA institutions. The new provisions represent a substantial shift in how municipal institutions must manage personal information. Given that the key provisions do not come into force until January 1, 2027, MFIPPA institutions should begin evaluating and updating their privacy practices to meet the new obligations.
We are currently helping our public sector clients with their compliance efforts. If you have any questions about Bill 97 or need assistance with compliance, please contact us.
The information and comments herein are for the general information of the reader and are not intended as advice or opinion to be relied upon in relation to any particular circumstances. For particular application of the law to specific situations, the reader should seek professional advice.
