Laws that apply in Ontario
A mix of federal and provincial laws shape your privacy rights in Ontario:
- PIPEDA covers most private-sector businesses (stores, banks, insurance, employers in federal works).
- FIPPA covers provincial ministries, agencies, colleges, universities, and most provincial institutions.
- MFIPPA covers municipalities, police services, school boards, and local public bodies.
- PHIPA covers health information custodians such as hospitals, clinics, physicians, and pharmacies.
- The Child, Youth and Family Services Act (Part X) adds privacy rules for children's aid societies and other service providers.
- Since July 1, 2025, FIPPA institutions must complete written privacy impact assessments before collecting personal information (s.38(3)) and report breaches that create a real risk of significant harm to the IPC (s.40.1); the MFIPPA breach-reporting duty (s.30.1) starts January 1, 2027.
Access and correction (FIPPA/MFIPPA)
Anyone can request access to records held by provincial and municipal institutions. For FIPPA requests made on or after July 1, 2026 the response time is 45 business days (s.26); MFIPPA moves to the same 45-business-day period for requests made on or after January 1, 2027, and is 30 days until then. Extensions are allowed for complex requests.
A person can also ask that inaccurate personal information be corrected. If the institution refuses, the person can require that a statement of disagreement be attached to the file (FIPPA s.47(2), MFIPPA s.36(2)).
Health privacy (PHIPA)
PHIPA gives you rights to access and correct your own health records and requires custodians to obtain consent (express or implied) before collecting, using, or disclosing your personal health information.
Since October 1, 2017, health information custodians must report certain privacy breaches to the IPC (PHIPA s.12(3)); since January 1, 2024 the IPC can also impose administrative penalties under PHIPA.
Where complaints go
Most privacy complaints in Ontario go to the Information and Privacy Commissioner of Ontario (IPC), including complaints under Part X of the CYFSA about children's aid societies. Complaints about a federally regulated business or purely private-sector activity go to the OPC.