Bill 97 and the Municipal Privacy Clock

Updated September 25, 2026: every legal and factual statement in this article was re-checked against the primary source and corrected where needed.

Ontario municipalities have a new compliance clock running, and it's worth understanding exactly what it's counting down to. Bill 97, the Plan to Protect Ontario Act (Budget Measures), 2026, received Royal Assent on April 24, 2026, and it brings the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) into closer alignment with the privacy regime provincial institutions have already been living under. For municipal clerks, CAOs, and freedom-of-information coordinators, the practical question isn't whether this applies to your institution — it's what to have in place before the substantive obligations land.

What's changing, and when

Bill 97's amendments to MFIPPA (Schedule 11 of the Act) come into force in two stages, not one flat date. The access-side changes — the standard response time for access requests moving from 30 calendar days to 45 business days, other statutory timelines shifting to business days, and new authority to propose staged access plans in the circumstances the Act sets out — took effect July 1, 2026, along with the repeal of the old personal information bank requirements. The new privacy duties — the ones that change how your institution handles personal information day to day — take effect January 1, 2027. That's the date that matters most for privacy planning, and it's the one this piece is built around.

As of that date, municipal institutions will be required to:

• Ensure a written Privacy Impact Assessment (PIA) is prepared before collecting personal information (unless the regulations provide otherwise), and update it before making any significant change to the purpose for which that information is used or disclosed;
• Report a theft, loss, or unauthorized use or disclosure of personal information to the Information and Privacy Commissioner of Ontario (IPC), and notify the affected individual, where it is reasonable to believe there is a real risk of significant harm (or other prescribed circumstances exist), and keep a record of every breach reported to the IPC;
• Meet an express statutory duty to take steps that are reasonable in the circumstances to protect personal information against theft, loss, and unauthorized use or disclosure, and to protect the records that hold it against unauthorized copying, modification, or disposal; and
• Operate under the IPC's express new authority to review an institution's information-handling practices in specified circumstances.

What the provincial rules under Bill 194 already tell us

Municipalities aren't the first to go through this. Provincial institutions under FIPPA have been operating under a nearly identical framework since July 1, 2025, introduced through Schedule 2 of Bill 194 (the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024). The parallels are close enough that the provincial rollout is a genuinely useful preview rather than a loose analogy.

Two things stand out from that framework. First, the PIA requirement isn't a form to fill out after the fact — it has to be completed before personal information is collected, which means institutions need a repeatable process, not a one-off template pulled out when a new program launches. Second, the breach reporting obligation runs on a specific threshold: a "real risk of significant harm" (RROSH) assessment. Institutions have to be able to run that assessment consistently, document it, keep a record of every breach they report to the IPC, and count those breaches — by type and by number of individuals affected — in the annual statistical report the IPC requires by March 31 each year. That is an operational capability, not a one-time policy update, and it gets tested the first time a real incident lands.

A realistic readiness sequence

With the January 1, 2027 in-force date now only months away, a practical readiness sequence looks something like this:

1. Inventory what personal information you collect and why — you can't assess what you haven't mapped, and this is the slowest step to do properly.
2. Draft (or adapt) a PIA template and assign ownership — someone specific needs to be accountable for triggering a PIA before a new collection activity starts, not just when a project happens to remember.
3. Build a breach response protocol with a documented RROSH assessment method — decide now, calmly, how you'll assess "real risk of significant harm" before you're doing it under pressure during an actual incident.
4. Review current safeguards against the new express statutory duty — administrative, technical, and physical controls all need to be reasonable in the circumstances, and "reasonable" is now a standard you'll be measured against, not just aspirational language.
5. Train the staff who touch personal information day to day — clerks and front-line staff, not just the FOI coordinator, need to recognize what triggers a PIA or a breach report.
6. Confirm your records-retention and reporting mechanics — you'll need a system for keeping breach records and rolling them into annual statistical reporting to the IPC. The first municipal breach statistics report covers calendar 2027 and is due March 31, 2028.

None of this needs to happen in Q4 2026 all at once. It's the kind of work that goes far more smoothly spread across the months leading up to January.

Mosaic builds exactly this kind of privacy capability — PIA frameworks, breach protocols, and MFIPPA/FIPPA readiness — through an expert-led, proprietary, standardized methodology built for institutions that need this done properly, not just on paper.

A free resource: Privacy in Big Government

For institutions that want a broader grounding in how public-sector privacy obligations are evolving across Ontario, our Privacy in Big Government guide walks through the practical shape of this modernization in plain language — worth a look before your next council or committee briefing on the topic.