GC Privacy Impact Assessment

This page is a public summary of the Privacy Impact Assessment (PIA) prepared by the software publisher (Realizer Services Inc.) for AccessPoint, aligned with the Treasury Board of Canada Secretariat (TBS) Directive on Privacy Impact Assessment. It documents the personal information holdings, information flows, privacy risks, and safeguards built into the product.

The publisher's PIA covers the technical and architectural sections and is intended to help Canadian federal institutions complete their own PIA. The deploying institution completes the institutional details (institutional overview, retention schedules, information sharing agreements, and sign-off) and submits the completed PIA to TBS and the Office of the Privacy Commissioner (OPC). The full PIA is available to customers on request — see the closing note.

For the full technical architecture, see the Technical Architecture page. For ITSG-33 security control mapping, see the GC Security Controls Reference page.

Purpose and Scope

AccessPoint is an access-to-information and privacy management platform that helps government institutions administer access and privacy programs in compliance with the Access to Information Act (ATIA), the Privacy Act, and equivalent provincial/international regimes. Its primary function is subject access / access-to-information request management — the full lifecycle from intake through assignment, document collection, review, redaction, and response packaging.

Beyond request handling, AccessPoint also supports the surrounding privacy program: Privacy Impact Assessments (PIA/AIA/Security assessments), privacy incident and breach management (including breach-notification workflows), complaints and appeals, a privacy risk register and commitments register, and records of processing (ROPA). These modules process additional categories of personal information and are covered by the same safeguards, roles, audit ledger, and data-residency guarantees as the request-management core.

Business process: intake (an SAO creates the request) → assignment (custodians receive sanitized instructions without requestor PII) → document collection → review and redaction → response packaging → closure (the retention clock begins).

Individuals affected: requestors; institution employees (SAOs, Administrators) whose actions are recorded in the audit trail; custodians and contributors (who do not have access to requestor PII); third parties whose PI may appear in documents under review; data subjects described at the category level in ROPA and assessments; individuals affected by a privacy incident; complainants and complaint parties; and consultation contacts.

Legal authority: collection and use rest primarily on the ATIA (ss.4, 6, 9, 19) and the Privacy Act (ss.4, 5, 7, 8(2)(m), and the individual's right of access).

Personal Information Inventory

Personal Information Collected and Processed

Personal Information NOT Collected

AccessPoint does not collect or process: Social Insurance Numbers; financial information (bank accounts, credit cards); health or medical records as structured data (they may appear in documents under review); biometric data; criminal record information; location data; or cookies/tracking identifiers.

Note: IP addresses and user agent strings are captured only in limited contexts (attestation signing and document access logging) for forensic audit purposes, as listed above. General browsing behavior and device fingerprinting are not collected.

Sensitive Personal Information in Documents

Documents collected during the ATIA process may contain any category of personal information, including sensitive PI about third parties. AccessPoint stores, previews, and facilitates redaction of documents, and — to support the review tools — extracts each document's plain text into the database (with optional OCR of image-only scans via an in-subscription Azure AI Document Intelligence resource). That extracted text powers content search (optionally indexed into the institution's own Azure AI Search resource), duplicate detection, pattern/rule-based redaction suggestions, and (when the optional AI Assist component is deployed) machine-generated suggestions and summaries. All of this processing occurs within the institution's own Azure subscription, and every machine-produced redaction or suggestion is a proposal: classification and exemption of PI within documents is decided by trained SAOs using the built-in review tools.

Microsoft 365 record capture (opt-in, feature-toggle-gated): a custodian can capture their own Microsoft 365 records — Outlook email, Outlook calendar, OneNote, Teams chats, Microsoft Lists, or Copilot interaction history — as a responsive record. Capture always uses the signed-in user's own delegated identity and is scoped to that user's own data (Copilot retrieval is app-only, as no delegated Graph permission exists, but is always scoped server-side to the signed-in user's own Entra object ID — never tenant-wide). Captured content is rendered to a PDF and enters the normal review/redaction workflow. Calendar capture excludes items marked Private/Personal/Confidential by default.

Personal Information Flow Analysis

The notification path illustrates the "no requestor PI to the publisher" control:

Event (e.g., assignment created)
        │
        ▼
  API Notification Dispatch Service
        │
        ├── PII Filter: strips requestor PI for Custodian/Contributor templates
        │
        ├──► Email: Graph Mail.Send → Institution's shared mailbox → Recipient
        │    (via managed identity or institution's app registration)
        │
        └──► Teams: API → Realizer Platform API → Graph TeamsActivity.Send → Recipient
             (sends: user ID, activity type, actor name, request number, preview text — NO requestor PI)

Privacy Risk Assessment

Risk Area Scores

Per the TBS standardized framework:

Overall risk level: Moderate — standard for an administrative program processing PI of external individuals, mitigated by strong technical controls (encryption, RBAC, PII filtering, data sovereignty).

Technical and Administrative Safeguards

Authentication and Access Control

Encryption

Network Security

Monitoring and Audit

Administrative Safeguards

Administrators assign roles via Settings; role changes take effect immediately. An Application Access Policy restricts Mail.Send to the designated shared mailbox only. Configuration changes are applied via versioned jurisdiction packs with install audit logging. Staff training, acceptable-use policy, and breach-response procedures are specified by the institution.

Third-Party Services and Data Sharing

Optional Azure AI services. The three AI resources above are not publisher services: each deploys into the institution's own subscription and region, authenticates with the App Service managed identity only (API-key access disabled), and sends nothing to Realizer Services. Every AI output is a suggestion, an editable draft, or a read-only answer — staff decide; per-feature tenant toggles and a monthly token budget (which hard-stops all AI processing) provide governance; Microsoft does not train models on the data; and AccessPoint stores only call metadata, never prompt or response bodies. Where Azure OpenAI inference is processed depends on the deployment type chosen at deploy time (global or EU/US data zone) — institutions should confirm the choice against their residency requirements. Case audit exports for a request include an AI-involvement disclosure (metadata only), and the same information is visible on each record's Activity feed.

Key point: No requestor PI, document content, or request details are transmitted to Realizer Services or any external party. All document conversion and redaction processing occurs within the institution's own App Service, and the optional search, OCR, and AI processing occurs within the institution's own Azure subscription.

Applicable Personal Information Banks

Institutions should confirm applicable PIBs and whether new PIBs are required for their specific deployment.

Availability of the Full PIA

The full Privacy Impact Assessment — including the complete personal information inventory, detailed collection/use/disclosure/retention/accuracy analysis, legal authorities, and data flow diagrams — is available to customers and prospective customers on request. Deploying institutions use it as the technical and architectural basis for their own PIA, completing the institutional overview, retention schedules, information sharing agreements, and sign-off before submitting to TBS and the Office of the Privacy Commissioner.