What schools can and cannot disclose about students, and how to respond if you find out your child's information was shared improperly.
This page provides legal information, not legal advice. Consult a qualified privacy lawyer or CIPP/C-accredited privacy professional before taking action on access requests, breach response, complaints to a Privacy Commissioner, or Federal Court applications.
Last verified: September 2026
TL;DR
Public schools are covered by provincial privacy laws. They can disclose limited information without consent (e.g., to another school for transfer purposes) but broader disclosure usually requires consent. The school's privacy officer is the first point of contact for an explanation, and a complaint to the provincial commissioner is the next step if the answer is unsatisfactory.
What schools can share
Schools can typically share:
Required transfer information to another school your child is enrolling in.
Attendance or discipline information to authorized decision-makers.
Information required by provincial education statutes.
Information in emergencies where there is a risk of serious harm.
What schools cannot share
Without consent, schools generally cannot share grades, disciplinary records, or personal information with third parties (including ed-tech vendors) beyond what is necessary.
What to do
The usual first step is a written request to the school principal or school board's privacy officer for the legal basis of the disclosure and the scope of what was shared. If the answer is unsatisfactory, a complaint can be made to the provincial access-and-privacy commissioner.