GC Privacy Impact Assessment

This page is a public summary of the Privacy Impact Assessment (PIA) prepared by the software publisher (Realizer Services Inc.) for AccessPoint, aligned with the Treasury Board of Canada Secretariat (TBS) Directive on Privacy Impact Assessment. It documents the personal information holdings, information flows, privacy risks, and safeguards built into the product.

The publisher's PIA covers the technical and architectural sections and is intended to help Canadian federal institutions complete their own PIA. The deploying institution completes the institutional details (institutional overview, retention schedules, information sharing agreements, and sign-off) and submits the completed PIA to TBS and the Office of the Privacy Commissioner (OPC). The full PIA is available to customers on request — see the closing note.

For the full technical architecture, see the Technical Architecture page. For ITSG-33 security control mapping, see the GC Security Controls Reference page.

Purpose and Scope

AccessPoint is an access-to-information and privacy management platform that helps government institutions administer access and privacy programs in compliance with the Access to Information Act (ATIA), the Privacy Act, and equivalent provincial/international regimes. Its primary function is subject access / access-to-information request management — the full lifecycle from intake through assignment, document collection, review, redaction, and response packaging.

Beyond request handling, AccessPoint also supports the surrounding privacy program: Privacy Impact Assessments (PIA/AIA/Security assessments), privacy incident and breach management (including breach-notification workflows), complaints and appeals, a privacy risk register and commitments register, and records of processing (ROPA). These modules process additional categories of personal information and are covered by the same safeguards, roles, audit ledger, and data-residency guarantees as the request-management core.

Business process: intake (an SAO creates the request) → assignment (custodians receive sanitized instructions without requestor PII) → document collection → review and redaction → response packaging → closure (the retention clock begins).

Individuals affected: requestors; institution employees (SAOs, Administrators) whose actions are recorded in the audit trail; custodians and contributors (who do not have access to requestor PII); third parties whose PI may appear in documents under review; data subjects described at the category level in ROPA and assessments; individuals affected by a privacy incident; complainants and complaint parties; and consultation contacts.

Legal authority: collection and use rest primarily on the ATIA (ss.4, 6, 9, 19) and the Privacy Act (ss.4, 5, 7, 8(2)(m), and the individual's right of access).

Personal Information Inventory

Personal Information Collected and Processed

Personal Information NOT Collected

AccessPoint does not collect or process: Social Insurance Numbers; financial information (bank accounts, credit cards); health or medical records as structured data (they may appear in documents under review); biometric data; criminal record information; location data; or cookies/tracking identifiers.

Note: IP addresses and user agent strings are captured only in limited contexts (attestation signing and document access logging) for forensic audit purposes, as listed above. General browsing behavior and device fingerprinting are not collected.

Sensitive Personal Information in Documents

Documents collected during the ATIA process may contain any category of personal information, including sensitive PI about third parties. AccessPoint does not analyze or index document content — it stores, previews, and facilitates redaction. Classification and exemption of PI within documents is performed by trained SAOs using the built-in review tools.

Microsoft 365 record capture (opt-in, feature-toggle-gated): a custodian can capture their own Microsoft 365 records — Outlook email, Outlook calendar, OneNote, Teams chats, Microsoft Lists, or Copilot interaction history — as a responsive record. Capture always uses the signed-in user's own delegated identity and is scoped to that user's own data (Copilot retrieval is app-only, as no delegated Graph permission exists, but is always scoped server-side to the signed-in user's own Entra object ID — never tenant-wide). Captured content is rendered to a PDF and enters the normal review/redaction workflow. Calendar capture excludes items marked Private/Personal/Confidential by default.

Personal Information Flow Analysis

The notification path illustrates the "no requestor PI to the publisher" control:

Event (e.g., assignment created)
        │
        ▼
  API Notification Dispatch Service
        │
        ├── PII Filter: strips requestor PI for Custodian/Contributor templates
        │
        ├──► Email: Graph Mail.Send → Institution's shared mailbox → Recipient
        │    (via managed identity or institution's app registration)
        │
        └──► Teams: API → Realizer Platform API → Graph TeamsActivity.Send → Recipient
             (sends: user ID, activity type, actor name, request number, preview text — NO requestor PI)

Privacy Risk Assessment

Risk Area Scores

Per the TBS standardized framework:

Overall risk level: Moderate — standard for an administrative program processing PI of external individuals, mitigated by strong technical controls (encryption, RBAC, PII filtering, data sovereignty).

Technical and Administrative Safeguards

Authentication and Access Control

Encryption

Network Security

Monitoring and Audit

Administrative Safeguards

Administrators assign roles via Settings; role changes take effect immediately. An Application Access Policy restricts Mail.Send to the designated shared mailbox only. Configuration changes are applied via versioned configuration packs with install audit logging. Staff training, acceptable-use policy, and breach-response procedures are specified by the institution.

Third-Party Services and Data Sharing

Key point: No requestor PI, document content, or request details are transmitted to Realizer Services or any external party. All document processing (conversion, redaction) occurs within the institution's own App Service.

Applicable Personal Information Banks

Institutions should confirm applicable PIBs and whether new PIBs are required for their specific deployment.

Availability of the Full PIA

The full Privacy Impact Assessment — including the complete personal information inventory, detailed collection/use/disclosure/retention/accuracy analysis, legal authorities, and data flow diagrams — is available to customers and prospective customers on request. Deploying institutions use it as the technical and architectural basis for their own PIA, completing the institutional overview, retention schedules, information sharing agreements, and sign-off before submitting to TBS and the Office of the Privacy Commissioner.