# AccessPoint by Realizer Services Inc. > Full single-file reference (every comparison's facts and FAQ, every jurisdiction pack's deadlines and FAQ, pricing, security): https://www.realizer.io/llms-full.txt > AccessPoint is the Microsoft 365-native operating platform for public-sector access, privacy, and responsible AI. It runs freedom-of-information / ATIP access requests, Privacy Impact Assessments (PIA), Algorithmic Impact Assessments (AIA), privacy breach and incident management, complaints and appeals, and an ISO 31000 privacy risk register — all inside the customer's own Microsoft 365 and Azure tenant. An optional AI Assist (Azure OpenAI deployed in the customer's own subscription) adds document summaries, redaction suggestions, grounded drafting, intake triage, and plain-language reporting — every output is a suggestion a person decides on, and prompts are never stored. No third-party cloud, no cross-border data transfer, no per-user fees. Sold and billed through the Microsoft commercial marketplace. 30-day free trial. Flat annual pricing by organization size (approx. USD $2,990 / $7,990 / $14,990 per year). ## Product - [AccessPoint overview](https://www.realizer.io/product/accesspoint): the full platform — access requests, PIA/AIA assessments, breach and incident response, complaints, risk register — with architecture and FAQ. - [Product tour](https://www.realizer.io/product/tour): an eleven-step screenshot walkthrough — My Day, computed deadlines, records collection, redaction with exemption tagging, video and audio redaction, PIAs, breach triage, risk register, reporting, and the audit ledger. - [Video & audio redaction](https://www.realizer.io/solutions/capabilities/video-audio-redaction): body-worn camera, CCTV, 911 audio, interview recordings, and Teams meetings redacted in the browser with time-based marks (box, blur, pixelate, mute, bleep, voice distortion) that carry the statutory exemption; in-tenant face detection and tracking; transcript-anchored proposals; burned MP4/MP3 release with a hash manifest and a per-span redaction log. Two-minute demo video: https://www.youtube.com/watch?v=Mt37zeNVzN4 - [Supported languages](https://www.realizer.io/product/languages): the interface ships natively in 11 languages (English, French, German, Spanish, Italian, Dutch, Danish, Portuguese, Finnish, Swedish, Polish), all included in every tier, with per-record content translation and correspondence merged in the requestor's language. - [Pricing](https://www.realizer.io/pricing): flat annual tiers, every feature in every tier, billed via the Microsoft marketplace. - [Get AccessPoint / free trial](https://www.realizer.io/get/accesspoint): deploy into your own Microsoft 365 and Azure tenant. - [Book a live demo](https://www.realizer.io/demo): a 30-minute walkthrough configured for your jurisdiction, with recorded demo videos available immediately. - [Security & data sovereignty](https://www.realizer.io/security): what deploys, where data lives, and who can see it. - [Service status](https://www.realizer.io/status): live status of the Realizer services AccessPoint relies on (licence validation, downloads, the SharePoint install page, security advisories, Teams notifications), with incidents and maintenance; the same as JSON at https://www.realizer.io/status.json. - [Procurement pack](https://www.realizer.io/procurement): printable vendor documents for public-sector buyers — a security & architecture overview, pricing summary, Microsoft-marketplace purchasing memo, and pre-answered vendor questionnaire. - [Accessibility statement](https://www.realizer.io/accessibility): WCAG 2.1 AA is the standard the product and site are designed against. - [Accessibility conformance report](https://www.realizer.io/accessibility/conformance-report): self-assessed WCAG 2.1 A/AA results for the AccessPoint application (v2.1.0, including the video and audio media viewer) in the VPAT format — static code review, independent adversarial verification, and runtime browser verification; 40 of 43 applicable criteria Supports, zero Does Not Support. - [Compare](https://www.realizer.io/compare): AccessPoint vs. legacy ATIP/FOI tools (ATIPXpress, GovQA, AMANDA, AccessPro), privacy suites, and manual tracking in Excel/Outlook — including migration effort. - [Migrate to AccessPoint](https://www.realizer.io/migrate): import historical and in-progress requests, assessments, incidents, complaints, requestors, and documents from a validated Excel workbook — statuses, due dates, and files carry over, so there's no cutover — no ETL project, and a one-click business-readable export available any time (no lock-in). ## Comparisons & migration guides Sourced, tool-by-tool comparisons: what each tool does well, where AccessPoint differs, and how to migrate your case history in. - [AccessPoint vs. ATIPXpress](https://www.realizer.io/compare/atipxpress): the Government of Canada's incumbent ATIP request tracker (Casepoint + OPEXUS) — requests in a vendor cloud vs. the whole mandate in your own tenant. - [AccessPoint vs. AccessPro](https://www.realizer.io/compare/accesspro): AccessPro Case Management was declared a GC legacy application effective June 2023 — what replaces it and how to migrate your history. - [AccessPoint vs. AMANDA](https://www.realizer.io/compare/amanda): Granicus's permitting platform has an FOI module — how a module compares to a purpose-built access and privacy system. - [AccessPoint vs. GovQA](https://www.realizer.io/compare/govqa): Granicus Records Request Management for US public records — requests only, vendor cloud. - [AccessPoint vs. JustFOIA](https://www.realizer.io/compare/justfoia): MCCi's US local-government records-request platform (portal, workflow, payments, redaction) hosted in the vendor's Azure Government cloud — vs. requests plus the privacy program in your own tenant. - [AccessPoint vs. ArkCase](https://www.realizer.io/compare/arkcase): Armedia's open-source, FedRAMP Moderate case-management platform with a FOIA solution for US federal queues — vs. requests and privacy inside your own Microsoft 365 tenant. - [Video & audio redaction software compared](https://www.realizer.io/compare/video-redaction): AccessPoint's in-tenant video and audio redaction vs. Veritone Redact, Axon Redaction, Secure Redact and CaseGuard on nine dimensions — where footage is processed, detection, audio, transcript-anchored marks, the exemption cited per span, the audit log, formats, integration, pricing. - [AccessPoint vs. Veritone Redact](https://www.realizer.io/compare/veritone-redact): the vendor-hosted AI redaction engine that JustFOIA and FOIAXpress resell. - [AccessPoint vs. Axon Redaction](https://www.realizer.io/compare/axon-redaction): Redaction Studio and the Redaction Assistant add-on inside Axon Evidence. - [AccessPoint vs. Secure Redact](https://www.realizer.io/compare/secure-redact): Pimloc's per-minute SaaS for CCTV and body-worn footage. - [AccessPoint vs. CaseGuard](https://www.realizer.io/compare/caseguard): an installed, per-user redaction workstation suite. - [AccessPoint vs. Vayle](https://www.realizer.io/compare/vayle): a modern Ontario-municipal FOI SaaS — strong public intake, vendor-hosted; AccessPoint runs the full mandate in your own tenant. - [AccessPoint vs. FOI Assist](https://www.realizer.io/compare/foi-assist): a lightweight Ontario FIPPA/MFIPPA tool for small offices — deadlines and letters vs. an operating platform. - [AccessPoint vs. FOIAXpress](https://www.realizer.io/compare/foiaxpress): the long-standing US federal FOIA system whose vendor (now Casepoint) points customers to a newer product — and how vendor-hosted FedRAMP assurance compares to software deployed inside the agency's own government-cloud boundary. - [AccessPoint vs. NextRequest](https://www.realizer.io/compare/nextrequest): CivicPlus's US local-government public-records platform — strong public request portal (a genuine AccessPoint gap), vendor cloud only. - [AccessPoint vs. Civica iCasework](https://www.realizer.io/compare/icasework): the UK council and NHS information-governance incumbent — vendor cloud vs. your own Microsoft 365 tenant. - [AccessPoint vs. Fivium eCase](https://www.realizer.io/compare/ecase): the UK central-government FOI, correspondence and Parliamentary Questions system. AccessPoint also handles Parliamentary Questions (a configured request type — shipped as the Order Paper type in the Canadian pack); eCase's distinct depth is ministerial and private-office correspondence. - [AccessPoint vs. Workpro](https://www.realizer.io/compare/workpro): the UK FOI/EIR/DPA case manager used by ombudsmen and regulators, and the rare UK option still offered on-premise. - [AccessPoint vs. OneTrust](https://www.realizer.io/compare/onetrust): the enterprise privacy category leader — consent, DSAR automation, and vendor risk in OneTrust's cloud vs. the public body's whole access-and-privacy mandate in your own tenant. ## Solutions by capability One page per job-to-be-done — what good looks like in that category, how AccessPoint delivers it, and buyer FAQs. - [FOI request management software](https://www.realizer.io/solutions/capabilities/foi-request-management): the full request lifecycle — computed statutory deadlines, records collection from Microsoft 365, redaction with exemption tagging, audit ledger. - [ATIP case management software](https://www.realizer.io/solutions/capabilities/atip-case-management): Canadian federal ATIP end to end — and the landing place for offices leaving AccessPro. - [Privacy impact assessment (PIA) software](https://www.realizer.io/solutions/capabilities/privacy-impact-assessments): screeners, questionnaires with section assignment, embedded risk register, regulator-ready summaries; covers Ontario Bill 194 mandatory PIAs. - [AI governance & AIA software](https://www.realizer.io/solutions/capabilities/ai-governance): Algorithmic Impact Assessments, an AI systems register, and responsible-AI oversight (TBS Directive on Automated Decision-Making, Bill 194). - [Privacy breach management software](https://www.realizer.io/solutions/capabilities/privacy-breach-management): real-risk-of-significant-harm assessment driving a live, statute-computed notification checklist. - [Privacy complaint management software](https://www.realizer.io/solutions/capabilities/privacy-complaint-management): commissioner complaints, appeals, and direct complaints with statutory clocks and allegation-level findings. - [Microsoft 365 privacy management](https://www.realizer.io/solutions/capabilities/microsoft-365-privacy-management): the whole program running natively in your own tenant. - [Video & audio redaction software](https://www.realizer.io/solutions/capabilities/video-audio-redaction): time-based severance of recordings with the exemption on every span, in-tenant face detection, transcripts, and a provable release — and what to look for in any tool. - [SharePoint FOI request management](https://www.realizer.io/solutions/capabilities/sharepoint-foi-request-management): build-vs-buy for FOI on SharePoint — run purpose-built on the SharePoint you already have. ## Solutions by organization and role - [Federal government](https://www.realizer.io/solutions/industries/federal-government) · [Provincial & territorial](https://www.realizer.io/solutions/industries/provincial-government) · [US state & local](https://www.realizer.io/solutions/industries/state-government) · [Municipal](https://www.realizer.io/solutions/industries/municipal-government) · [Agencies, boards & commissions](https://www.realizer.io/solutions/industries/agencies-boards-commissions) · [Colleges & universities](https://www.realizer.io/solutions/industries/higher-education) - [Police services & public safety](https://www.realizer.io/solutions/industries/police-public-safety): body-worn camera, CCTV, and 911 audio requests for police services, sheriffs, and 911 centres — what regulators now order a release to look like, and how the request, redaction, and release run in the service's own tenant. - [Privacy & FOI managed service providers](https://www.realizer.io/solutions/industries/managed-service-providers): consultancies running clients' programs on AccessPoint — host every client in the provider's tenant (custom Customer field, client-filtered dashboards and reports, case-matched roles scoped per client, or client contacts added to individual cases as readers and advisors) or work inside a client's own tenant on a licence the client holds. Annual pricing is tiered by organization size, with every feature and unlimited usage in every tier. - [Privacy officers & CPOs](https://www.realizer.io/solutions/roles/privacy-officers) · [FOI & ATIP professionals](https://www.realizer.io/solutions/roles/foi-atip-professionals) · [CIOs & Microsoft 365 leaders](https://www.realizer.io/solutions/roles/cios-m365-leaders) · [Records & information managers](https://www.realizer.io/solutions/roles/records-managers) ## Solutions by jurisdiction Pre-configured "jurisdiction packs" tailor AccessPoint to a jurisdiction's statute, deadlines, fees, exemptions, and oversight body. 136 jurisdictions are covered; the hub lists them all. - [All jurisdictions](https://www.realizer.io/solutions/jurisdictions): the full index of all 136 packs, grouped by Canada, United States, Europe, and Rest of World. - [Solutions hub](https://www.realizer.io/solutions): routes four ways — by capability, by organization, by role, and by jurisdiction. - [Canada — federal ATIP (Access to Information Act / Privacy Act)](https://www.realizer.io/solutions/canada-federal-atip) - [Ontario — FIPPA & Bill 194](https://www.realizer.io/solutions/ontario-fippa) - [British Columbia — FIPPA](https://www.realizer.io/solutions/british-columbia-fippa) - [Alberta — Access to Information Act](https://www.realizer.io/solutions/alberta-atia) - [Québec — Loi sur l'accès](https://www.realizer.io/solutions/quebec-loi-sur-lacces) - [United States — federal FOIA](https://www.realizer.io/solutions/united-states-foia) - [California — Public Records Act](https://www.realizer.io/solutions/california-pra) - [Texas — Public Information Act](https://www.realizer.io/solutions/texas-pia) - [European Union — GDPR](https://www.realizer.io/solutions/eu-gdpr) - [European Union — AI Act, deployer obligations](https://www.realizer.io/solutions/eu-ai-act): the Article 27 fundamental rights impact assessment that public bodies and public-service providers owe before using a high-risk AI system, plus the Article 26/49/50 deployer duties. - [United Kingdom — FOIA](https://www.realizer.io/solutions/united-kingdom-foia) - [Québec — private sector (Law 25)](https://www.realizer.io/solutions/quebec-secteur-prive): mandatory EFVP privacy assessments, the confidentiality-incident register, portability, and automated decision-making. - [California — CCPA/CPRA](https://www.realizer.io/solutions/california-ccpa) · [US multi-state consumer privacy](https://www.realizer.io/solutions/us-state-consumer-privacy) · [Maryland — MODPA](https://www.realizer.io/solutions/maryland-mmdpa) - [Australia — New South Wales (GIPA)](https://www.realizer.io/solutions/australia-new-south-wales) · [Queensland (RTI)](https://www.realizer.io/solutions/australia-queensland) · [Victoria (FOI)](https://www.realizer.io/solutions/australia-victoria) — all eight states and territories ship as their own packs. - [New Zealand — LGOIMA](https://www.realizer.io/solutions/new-zealand-lgoima): council official information requests, and the open-meetings half of the Act. ## Documentation - [Documentation home](https://www.realizer.io/docs/accesspoint): user guide, admin guide, and architecture (114+ pages, available in 11 languages: English, French, German, Spanish, Italian, Dutch, Danish, Portuguese, Finnish, Swedish, and Polish). - [Getting started](https://www.realizer.io/docs/accesspoint/getting-started) - [Architecture](https://www.realizer.io/docs/accesspoint/architecture): tenant-native model, data residency, encryption, RBAC, hash-chained audit ledger. - [Government security controls](https://www.realizer.io/docs/accesspoint/architecture/gc-security-controls): ITSG-33, GC Cloud Guardrails, Canadian data residency. - [Video & audio records](https://www.realizer.io/docs/accesspoint/user-guide/request-media): the media viewer, transcripts and captions, time-based marks and effects, automatic tracking, face and on-screen text detection, redacted preview, release packages, and the media review estimate. - [Data import & export](https://www.realizer.io/docs/accesspoint/admin-guide/data-import-export): the migration workflow — tenant-generated Excel template, per-row validation, document staging in your own storage, and audit provenance. - [Privacy Impact Assessment (institutional)](https://www.realizer.io/docs/accesspoint/architecture/gc-privacy-impact-assessment) ## Guides - [Access & privacy glossary](https://www.realizer.io/resources/glossary): plain-language definitions — deemed refusal, severing, exemption vs. exclusion, SAR/DSAR, PIA vs. DPIA, RROSH, ROPA — with Canada/US/UK/EU differences noted. - [Guides & tools](https://www.realizer.io/resources/guides) - [FOI workflow quick check](https://www.realizer.io/resources/guides/foi-quick-check) - [FOI deadline calculator](https://www.realizer.io/resources/guides/foi-deadline-calculator): enter the date a request arrived and the Act; get the statutory due date with weekends and public holidays handled, the maximum-extension date, and the deemed-refusal rule, for more than 100 FOI, ATIP, public-records and data-protection regimes — each cited to the statute, with a reference table of response deadlines by jurisdiction. - [PIA program readiness check](https://www.realizer.io/resources/guides/pia-readiness-check): an eleven-question self-assessment of a privacy impact assessment program (mandate and trigger, inventory, screener, template coverage of the ten required contents, program-area input, risk register, approval and freeze, re-assessment triggers, regulator readiness, AI and automated decisions, employee-owned devices) with a 0–22 score, three bands, and a ranked list of where to start. - [FOI ROI calculator and business case](https://www.realizer.io/resources/guides/foi-roi): cost to serve a request today; savings from records-in-place workflow, video and audio redaction (four to six review hours per recorded hour today), optional AI Assist, fewer missed deadlines, and built-in reporting; against flat-rate pricing plus Azure in the customer's own tenant; produces an executive summary with payback, three-year net benefit, and break-even share. - [Ontario FOI in transition (Bill 194 / Bill 97)](https://www.realizer.io/resources/guides/ontario-foi) - [Managing Alberta ATIA](https://www.realizer.io/resources/guides/atia) - [Washington Public Records Act: deadlines, penalties, and the five-day rule](https://www.realizer.io/resources/guides/washington-pra) - [Texas Public Information Act: the 10-business-day clock and AG rulings](https://www.realizer.io/resources/guides/texas-pia) - [UK FOI time limits: Section 10, extensions, and ICO backlog enforcement](https://www.realizer.io/resources/guides/uk-foi) - [Michigan FOIA: Five Business Days, Fees, Deposits & Appeals](https://www.realizer.io/resources/guides/michigan-foia): Michigan FOIA after 2014 PA 563: the five-business-day response, one ten-day extension, itemized fees and deposits, the public summary, appeals and fines. - [EU Access to Documents: Regulation 1049/2001 in Practice](https://www.realizer.io/resources/guides/eu-access-to-documents): Regulation (EC) No 1049/2001 in practice: the 15-working-day clock and how the institutions count it, confirmatory applications, Article 4 exceptions and review. - [Pennsylvania Right-to-Know Law: Deadlines & OOR Appeals](https://www.realizer.io/resources/guides/pennsylvania-rtkl): Pennsylvania's Right-to-Know Law: the five-business-day response, deemed denial, the 30-day extension, OOR appeals, the fee schedule, and civil penalties. - [Florida Public Records Act: Reasonable Time, Fees, Penalties](https://www.realizer.io/resources/guides/florida-public-records): Chapter 119 in practice: the limited-reasonable-time standard, custodian duties, cited denials, special service charges, the 2017 fee notice, and penalties. - [Illinois FOIA: The Five-Day Clock, PAC Review & Penalties](https://www.realizer.io/resources/guides/illinois-foia): Illinois FOIA in practice: the five-business-day clock and extension, commercial, recurrent and voluminous requests, PAC review, fees, training, and penalties. - [New York FOIL: Five Business Days, Appeals & Fees](https://www.realizer.io/resources/guides/new-york-foil): New York FOIL: the five-business-day response, the 20-business-day rule, constructive denial, 30-day appeals, 25-cent copies, and Article 78 attorney fees. - [California Public Records Act: The 10-Day Rule Explained](https://www.realizer.io/resources/guides/california-pra): The CPRA after recodification: the 10-day determination, the 14-day extension, prompt production, direct-cost fees, written denials, and writ-of-mandate attorney-fee exposure. - [The FOI backlog recovery playbook](https://www.realizer.io/resources/guides/foi-backlog-recovery) - [Business days vs. calendar days: statutory deadline math by jurisdiction](https://www.realizer.io/resources/guides/deadline-math) - [What counts as a real risk of significant harm (RROSH)?](https://www.realizer.io/resources/guides/rrosh) - [FOI annual report statistics: what regulators actually want](https://www.realizer.io/resources/guides/foi-annual-stats) - [Redacting body-worn camera and 911 audio for FOI: what regulators now expect](https://www.realizer.io/resources/guides/body-worn-camera-redaction): the Ontario IPC orders on obscuring and voice distortion, the BC OIPC "capacity is not an excuse" guidance, the OAIC schedule rule, 5 U.S.C. § 552(b) "at the place in the record", measured effort of four to six hours per hour of footage, fee rules by regime, and a release checklist. - [Are Teams meeting recordings records?](https://www.realizer.io/resources/guides/teams-meeting-recordings-foi): statutory definitions of "record" across Canada, Ontario, the UK, and the US; where Microsoft stores recordings and transcripts and who holds them; the auto-expiration trap and retention labels; and how to capture, review, and redact a recording. - [What should a reasonable FOI search include?](https://www.realizer.io/resources/guides/reasonable-foi-search): the reasonable-search standard in Canada (federal Information Commissioner, Ontario IPC, BC, Alberta, Saskatchewan), the UK (balance of probabilities, Bromley), the US (Weisberg, Oglesby) and Australia (s. 24A, OAIC Guidelines); offences for destroying records to defeat access; a checklist for scoping the request, choosing custodians including former staff and personal accounts, searching Outlook and Exchange, Teams chats and channels (including private and shared channels), SharePoint and OneDrive, Copilot, Viva Engage, Planner, Forms and Loop, and sources outside Microsoft 365; Purview eDiscovery gaps; what the search record should show; and a summary that lists the unticked items in each part with guidance and links for closing each gap. - [Ontario's mandatory PIAs: FIPPA s. 38(3) and MFIPPA in 2027](https://www.realizer.io/resources/guides/ontario-pia): since July 1, 2025 the head of a FIPPA institution must ensure a written privacy impact assessment exists before collecting personal information, with ten prescribed contents (purpose and necessity, legal authority, types and uses, sources, position titles with access, limits, retention, safeguards and risks to individuals, prevention and mitigation steps, prescribed extras), updated before a significant change of purpose and produced to the IPC on request; identical duties reach MFIPPA municipalities on January 1, 2027 with breach reporting and Commissioner review; each element mapped to AccessPoint. - [Nova Scotia privacy assessments under the new FOIPOP Act](https://www.realizer.io/resources/guides/nova-scotia-privacy-assessments): from April 1, 2027 every public body including municipalities must conduct a privacy assessment before undertaking or substantially changing any activity that collects, uses or discloses personal information (s. 53), maintain a privacy policy and public complaint procedures (s. 52), and notify breaches where significant harm is reasonably possible (s. 78); contents are left to regulation; how to build the program now and how AccessPoint runs it. - [Alberta POPA Privacy Impact Assessments](https://www.realizer.io/resources/guides/alberta-popa-pia): Alberta's Protection of Privacy Act (in force June 11, 2025) requires PIAs under s. 26 and s. 7 of the Ministerial Regulation for new or substantially changed practices, programs, projects or services involving personal information; submission to the Commissioner when any of five factors applies (highly sensitive information, a significant share of the population served, data matching, a common or integrated program, innovative technology); the OIPC POPA PIA template and completion guide; privacy management program and Privacy Officer; collection notices must disclose automated-system use; HIA s. 64 for custodians. - [BC FOIPPA Privacy Impact Assessments](https://www.realizer.io/resources/guides/bc-pia): British Columbia's FOIPPA s. 69(5) and (5.3) require every ministry and public body to conduct PIAs per the minister's directions (effective November 26, 2021): on any new initiative and before a significant change, including moving sensitive information outside Canada; ministries submit during development for the minister's review; common or integrated programs are notified to the Commissioner; s. 36.2 privacy management program; s. 36.3 breach notification to individuals and the Commissioner on a significant-harm test. - [Federal PIAs: The 2024 Standard](https://www.realizer.io/resources/guides/federal-pia): The Treasury Board Directive on Privacy Impact Assessment (2010) was rescinded October 9, 2024; the requirement now sits in the Directive on Privacy Practices, Appendix C Standard on Privacy Impact Assessment (effective the same day, grace to October 10, 2025 for two subsections): PIAs for new or substantially modified programs using personal information for an administrative purpose, approved PIAs provided to TBS and the OPC, summaries published, decisions documented, PIBs aligned; Appendix B breach procedures (March 1, 2024); the Directive on Automated Decision-Making requires an AIA before production, existing systems compliant by June 24, 2026. - [Algorithmic Impact Assessments](https://www.realizer.io/resources/guides/algorithmic-impact-assessments): Algorithmic impact assessments for Canadian public bodies: the federal Directive on Automated Decision-Making (AIA before production, four impact levels scored by the TBS tool, existing systems compliant by June 24, 2026), Ontario's EDSTA ss. 5-8 awaiting AI regulations plus the IPC and OHRC six principles of January 2026, Alberta's automated-system collection notice, Quebec s. 65.2 automated-decision disclosure and s. 63.5 PIAs, EU AI Act Article 27 fundamental rights impact assessment for public-sector deployers, the UK's mandatory Algorithmic Transparency Recording Standard; the sections of a defensible AIA and how AccessPoint's AI systems register, compliance profile and assessment engine run it. - [Smart Glasses at Work: When a Personal Device Needs a PIA](https://www.realizer.io/resources/guides/byod-privacy-impact-assessment): employee-owned AI smart glasses (Ray-Ban Meta and the wider category) and other personal devices used for work — why procurement-based intake never triggers an assessment; what the law actually triggers on (federal Standard on PIA substantial modifications "including through ... new or modified information technology", Ontario FIPPA s. 38(3) before collecting and MFIPPA s. 28(3) from January 1, 2027, BC s. 69(5.3) directions, Alberta POPA s. 26 and the innovative-technology submission factor, GDPR Article 35 and WP248, the ICO's "smart technologies (including wearables)", and the contrasting US E-Government Act s. 208); records on personal devices under the institution's control (2011 SCC 25, Ontario IPC, City of San Jose); regulators on smart glasses (2013 Google Glass letter, OPC 2014, DPC/Garante 2021, CNIL, Hamburg DPA LED testing, G7 2026, NZ Privacy Commissioner); body-worn camera guidance as the analogy; a five-question screen, what BYOD and acceptable use policies should say, and how to keep a BYOD assessment from going stale. - [Privacy Impact Assessments: A Program for Any Jurisdiction](https://www.realizer.io/resources/guides/privacy-impact-assessments): How to run a privacy impact assessment program that holds up under any regime: the mandate, the inventory, the screener, the template, delegation, risks, approval, re-assessment, the regulator, and AI. - [Regulation 2018/1725: DPIAs and EDPS Prior Consultation](https://www.realizer.io/resources/guides/eu-institutions-dpia): Article 39 DPIAs and Article 40 EDPS prior consultation for EU institutions: the EDPS threshold list, the eight-week clock, Article 31 records, breach rules and the DPO. - [UK DPIAs: UK GDPR Article 35, DPA 2018 s. 64 and the ICO](https://www.realizer.io/resources/guides/uk-dpia): UK GDPR Articles 35 and 36 as retained, DPA 2018 section 64 for law enforcement, the ICO's high-risk list and screening checklist, and what the 2025 Act changed. - [GDPR DPIAs: Articles 35 and 36 for Public Bodies](https://www.realizer.io/resources/guides/gdpr-dpia): When GDPR Article 35 requires a DPIA, what it must contain, the Article 36 eight-week consultation clock, the WP248 criteria and how AccessPoint runs each step. - [AccessPoint public roadmap](https://www.realizer.io/resources/guides/accesspoint-roadmap) ## Company - [About Realizer Services Inc.](https://www.realizer.io/about): founded 2019, based in Nova Scotia, Canada. Realizer Services builds AccessPoint. --- # Full reference (generated from the site's own content) ## Pricing (USD, flat annual rate by organization size) - Under 500 employees: $2,990/year - 500–2,000 employees: $7,990/year - Over 2,000 employees: $14,990/year - Every feature in every tier; no per-user fees; no module fees. Monthly plans available on the Microsoft Marketplace listing. - Billed through the Microsoft commercial marketplace on the customer's existing Microsoft invoice. Private offers and Cloud Solution Provider purchase routes available. - Azure infrastructure runs in the customer's own subscription, paid to Microsoft directly (typically ~$175/month), with no vendor markup. - 30-day free trial, first month free, no credit card. Current pricing: https://www.realizer.io/pricing ## Security & data sovereignty - AccessPoint installs entirely inside the customer's own Microsoft 365 tenant and Azure subscription; data never leaves the customer's environment and the vendor has no runtime access. - No subprocessors handle customer data; the product initiates no cross-border transfers; region is chosen by the customer at deployment. - Microsoft Entra ID authentication only (customer MFA and Conditional Access apply); server-side RBAC plus a PII firewall; TLS 1.3; Entra-only database auth; Defender for SQL on by default; SHA-256-verified deployment artifacts. - Append-only, hash-chained audit ledger across all modules, exportable as court-ready evidence. - Standards alignment: ITSG-33 mapping, GC Cloud Guardrails, GDPR Article 30 (built-in ROPA), ISO 31000 risk register. SOC 2/ISO 27001 vendor-hosting certifications don't apply because the vendor hosts no customer data. - Details: https://www.realizer.io/security and https://www.realizer.io/procurement ## Comparisons (full detail) ### AccessPoint vs. AccessPro (Granicus (formerly Privasoft, then CSDC Systems / Calytera)) URL: https://www.realizer.io/compare/accesspro — facts last reviewed 2026-09-03 Verdict: AccessPro is an on-premises ATIP request tracker from the mid-2000s that the Treasury Board of Canada Secretariat declared a legacy application effective June 2023 — institutions still running it are actively migrating off. If you're choosing its successor, the real question isn't which request tracker to buy next: it's whether your next system should also carry the privacy side of your mandate (PIAs, AIAs, breaches, complaints, risk) and whether your data should live in a vendor's cloud or your own Microsoft 365 tenant. AccessPoint is built on the second answer to both. AccessPro fact sheet: - Product: AccessPro Case Management (APCM) + AccessPro Redaction - Vendor lineage: Privasoft (Ottawa) → CSDC Systems (2011) → Calytera (2019) → Granicus (2020) - Deployment: On-premises client-server - Market: Canadian federal and municipal ATIP/FOI offices - Status: Declared a GC legacy application effective June 2023; institutions migrating off, some still processing on it mid-transition Side by side: - Scope — AccessPro: ATIP/FOI request processing and redaction | AccessPoint: Access requests plus PIAs, AIAs, breach response, complaints, and a privacy risk register — one platform - Where your data lives — AccessPro: On-premises servers you maintain | AccessPoint: Your own Microsoft 365 and Azure tenant — cloud, but still yours - Product status — AccessPro: Legacy application (GC designation effective June 2023) | AccessPoint: Actively developed, with a public roadmap - Records collection — AccessPro: Documents imported into a separate system | AccessPoint: Pulled straight from SharePoint, OneDrive, Outlook, and Teams - Redaction — AccessPro: AccessPro Redaction desktop companion | AccessPoint: Browser-native redaction studio with statutory exemption tagging and AI-proposed redactions - Video & audio redaction — AccessPro: Not offered — recordings are opaque attachments redacted outside the tool | AccessPoint: Native: box, blur, pixelate, mute, bleep, and voice distortion on body-worn, CCTV, 911 audio, and Teams recordings, with the exemption on every span, in-tenant face detection and tracking, transcript-anchored proposals, and a burned release with a hash manifest and a time-based redaction log — no per-seat add-on - Jurisdiction rules — AccessPro: Configured per deployment | AccessPoint: 136 jurisdiction packs — deadlines, exemptions, calendars, letters, report templates - Audit trail — AccessPro: Application logging | AccessPoint: Hash-chained, append-only ledger with court-ready case audit exports - Pricing — AccessPro: Licensed per deployment; quotes | AccessPoint: Flat annual, published on the site, no per-user fees Where AccessPro fits (honest concessions): - You're mid-migration on a TBS-coordinated replacement path and the successor has already been procured for your institution. - Your office needs to keep processing on APCM through the transition — it still works, and an orderly migration beats a rushed one. - Your requirements genuinely stop at access requests and your IT strategy accepts running or hosting a separate case system. Q: Is AccessPro end of life? A: For the Government of Canada, effectively yes: the Treasury Board of Canada Secretariat notified departments in late 2021 that AccessPro Case Management would become a legacy application effective June 2023, and departmental ATIP annual reports since then describe active migrations to successor systems. Some institutions are still processing on it mid-transition, but it is a system to migrate from, not to. Q: What replaces AccessPro? A: The TBS-coordinated federal replacement effort has seen institutions procure ATIPXpress, a cloud ATIP request tracker. But a replacement decision is also a scope decision: if your office runs PIAs, breach responses, complaints, and privacy risk alongside access requests, AccessPoint replaces AccessPro and the spreadsheets around it — in your own Microsoft 365 tenant rather than a vendor's cloud. Q: Can we import our AccessPro history into AccessPoint? A: Yes. Any AccessPro report that reaches Excel can be mapped into AccessPoint's tenant-generated import template — historical requests keep their old case numbers as legacy references, requestor contacts import alongside them, and legacy documents stage through your own Azure storage with optional hash verification. Imported records arrive inert: no notifications, no recomputed deadlines, full audit provenance. Q: How is AccessPoint different from AccessPro? A: Three structural differences. Scope: AccessPro processes access requests; AccessPoint runs access requests plus privacy and algorithmic impact assessments, breach notification, complaints, and a privacy risk register on one shared audit ledger. Architecture: AccessPro is on-premises client-server software; AccessPoint is Microsoft 365-native and deploys into your own tenant, collecting records straight from SharePoint, Outlook, and Teams. And continuity: AccessPro's retirement forced a migration on its customers — AccessPoint's one-click export means you're structurally never locked in. Q: We're still on AccessPro mid-migration. How long can we take? A: That's between your institution and its support arrangements — several federal ATIP annual reports show offices still processing on APCM while their successor deployment completes. The practical advice: whatever destination you choose, do a rehearsal import of a year of history early. It converts migration from a scary unknown into a checklist, and AccessPoint's validation workbook is built to make that rehearsal a one-afternoon exercise. ### AccessPoint vs. ATIPXpress (Casepoint + OPEXUS (formerly AINS)) URL: https://www.realizer.io/compare/atipxpress — facts last reviewed 2026-09-03 Verdict: ATIPXpress (with FOIAXpress, its long-established US federal sibling) is a dedicated cloud ATIP request-processing system, and it's the successor many Government of Canada institutions procured when AccessPro was declared legacy. It does request tracking well. The structural differences are scope and residency: ATIPXpress manages access requests in the vendor's cloud, while AccessPoint runs the whole access-and-privacy mandate — requests, PIAs, AIAs, breaches, complaints, risk — inside your own Microsoft 365 and Azure tenant, with flat published pricing instead of a quote. ATIPXpress fact sheet: - Product: ATIPXpress — the Canadian ATIP configuration of the AINS eCASE platform; FOIAXpress is its US federal sibling - Vendor lineage: AINS → OPEXUS (Jan 2023) → merged with Casepoint, majority investment by Thoma Bravo (Jan 2025); the OPEXUS brand is being retired - Canadian channel: Delivered in Canada through the reseller iPSS Inc. - Deployment: Vendor-hosted cloud SaaS - Market: US federal FOIA; Canadian federal ATIP — the procured successor to AccessPro at several institutions - Status: Actively sold (marketed via casepoint.com) Side by side: - Scope — ATIPXpress: ATIP/FOI request processing and redaction | AccessPoint: Access requests plus PIAs, AIAs, breach response, complaints, and a privacy risk register - Where your data lives — ATIPXpress: Vendor's cloud | AccessPoint: Your own Microsoft 365 and Azure tenant — no third-party cloud - Records collection — ATIPXpress: Documents uploaded into the vendor system | AccessPoint: Pulled straight from SharePoint, OneDrive, Outlook, and Teams — plus Teams chats, OneNote, and Copilot history - Video & audio redaction — ATIPXpress: OPEXUS documents a separately licensed Veritone Redact integration for its FOIAXpress product; the round-trip returns the redacted file and an audit log, with redaction codes burned into the video and listed in Veritone's own report | AccessPoint: Native: box, blur, pixelate, mute, bleep, and voice distortion on body-worn, CCTV, 911 audio, and Teams recordings, with the exemption on every span, in-tenant face detection and tracking, transcript-anchored proposals, and a burned release with a hash manifest and a time-based redaction log — no per-seat add-on - Vendor stability picture — ATIPXpress: Two ownership changes since 2023 (OPEXUS rebrand; Casepoint merger under Thoma Bravo) | AccessPoint: Independent Canadian vendor with a public roadmap; your exit is a one-click export either way - Jurisdiction rules — ATIPXpress: Configured for ATIP; per-implementation setup | AccessPoint: 136 jurisdiction packs — federal, provincial, US, EU, UK, and more - AI — ATIPXpress: Vendor-cloud AI capabilities | AccessPoint: Optional AI Assist on Azure OpenAI inside your own tenant's subscription — prompts never stored, nothing trains outside models - Security review — ATIPXpress: Full vendor-cloud assessment (data residency, subprocessors, egress) | AccessPoint: Shorter — nothing is vendor-hosted; your existing M365/Azure controls govern it - Pricing — ATIPXpress: Per-seat / call for quote | AccessPoint: Flat annual, published on the site, no per-user fees Where ATIPXpress fits (honest concessions): - Your institution has already procured it through the TBS-coordinated AccessPro replacement and the deployment is underway — switching mid-stream rarely pays. - Your mandate genuinely stops at request processing, and your security posture accepts vendor-cloud residency for records under review. - You're a US federal agency deep in the FOIAXpress ecosystem where its 25-year FOIA specialization and installed base carry real weight. Q: How is AccessPoint different from ATIPXpress? A: Two structural differences. Scope: ATIPXpress is a dedicated access-request processing system; AccessPoint runs access requests plus privacy impact assessments, algorithmic impact assessments, breach notification, complaints, and a privacy risk register on one platform. Residency: ATIPXpress hosts your case data in the vendor's cloud; AccessPoint deploys into your own Microsoft 365 and Azure tenant, so the records under review never leave your control. AccessPoint also publishes flat annual pricing rather than quoting per seat. Q: Who owns ATIPXpress now? A: ATIPXpress was built by AINS, which rebranded as OPEXUS in January 2023. In January 2025, OPEXUS announced a merger with Casepoint backed by a majority investment from private-equity firm Thoma Bravo; the combined company currently operates as Casepoint + OPEXUS, and ATIPXpress is marketed from Casepoint's website. Q: Our institution is replacing AccessPro. Isn't ATIPXpress the standard path? A: It's the incumbent path for several federal institutions via the TBS-coordinated replacement, and if your deployment is already underway, finishing it may be the right call. If you're still deciding, it's worth asking the wider question: a replacement cycle is the one moment you can consolidate the whole mandate — requests, assessments, breaches, complaints, risk — instead of replacing one request tracker with another and leaving the rest of the office in Word and Excel. Q: Can we import from ATIPXpress into AccessPoint? A: Yes. Any report you can export to Excel maps into AccessPoint's tenant-generated import template — cases keep their old numbers as legacy references, requestors import alongside, and documents stage through your own Azure storage with optional hash verification. Validation runs before anything imports, and re-runs are always safe. Q: Does 'in your own tenant' actually make the security review shorter? A: Usually, yes — because the questions that consume vendor-cloud assessments largely disappear. There's no vendor data residency to evaluate, no subprocessor list, and no cross-border transfer of case records: AccessPoint's backend deploys from a Bicep template into your own tenant's Azure subscription, authenticates through your Entra ID, and is governed by the Defender, Sentinel, and Purview tooling you already run. Our security page documents exactly what deploys and what the publisher can see — which is: your data, never. ### AccessPoint vs. FOIAXpress (Casepoint (formerly OPEXUS, formerly AINS)) URL: https://www.realizer.io/compare/foiaxpress — facts last reviewed 2026-09-03 Verdict: FOIAXpress is a mature, capable FOIA case management system with deep US federal roots — and its position has shifted markedly. Its vendor rebranded from AINS to OPEXUS, merged into Casepoint in January 2025, and now runs the FOIAXpress page as a "Customer Resources" page that invites customers to move to Casepoint FOIA, a separate next-generation product. No end-of-life has been announced and it remains in live production. The architectural difference worth understanding: FOIAXpress is a hosted service you consume, so its assurance comes from the vendor's FedRAMP authorization. AccessPoint is software you deploy into your own cloud environment — including a sovereign or government cloud — so it inherits your environment's authorization and is assessed inside your own boundary, alongside the whole access-and-privacy mandate rather than requests alone. FOIAXpress fact sheet: - Product: FOIAXpress, built on the AINS eCASE case management platform - Vendor lineage: AINS (1988) → OPEXUS (Jan 2023, Gemspring) → merged with Casepoint under Thoma Bravo majority (Jan 2025) - Deployment: Vendor-hosted cloud - Market: US federal FOIA offices; a state & local edition was promoted in 2024 - Authorizations: FedRAMP Moderate via the "AINS dba OPEXUS – eCase" listing (authorized 2014); StateRAMP Moderate for eCASE (2023) - Status: In live production, no announced sunset — but the vendor's page now directs customers toward Casepoint FOIA Side by side: - Scope — FOIAXpress: FOIA request processing and redaction | AccessPoint: Access requests plus PIAs, AIAs, breach response, complaints, and a privacy risk register - Where your data lives — FOIAXpress: Vendor-hosted cloud | AccessPoint: Your own Microsoft 365 and Azure tenant — no vendor-side copy of your records - Records collection — FOIAXpress: Documents uploaded into the vendor system | AccessPoint: Pulled straight from SharePoint, OneDrive, Outlook, and Teams — plus Teams chats, OneNote, and Copilot history - Video & audio redaction — FOIAXpress: Veritone Redact integration, separately licensed; the round-trip returns the redacted file and an audit log, with redaction codes burned into the video and listed in Veritone's own report rather than the request file's redaction record | AccessPoint: Native: box, blur, pixelate, mute, bleep, and voice distortion on body-worn, CCTV, 911 audio, and Teams recordings, with the exemption on every span, in-tenant face detection and tracking, transcript-anchored proposals, and a burned release with a hash manifest and a time-based redaction log — no per-seat add-on - How assurance works — FOIAXpress: A hosted service carrying its own FedRAMP authorization — Moderate via the eCASE listing, with Casepoint's platform adding FedRAMP High and DoD impact levels | AccessPoint: Not a hosted service: deploys into your own cloud environment, including sovereign and government clouds, and is assessed within your own authorization boundary - Product trajectory — FOIAXpress: Vendor is directing customers toward Casepoint FOIA, a separate product | AccessPoint: Actively developed on a published public roadmap - Jurisdiction rules — FOIAXpress: US FOIA and Privacy Act | AccessPoint: 136 jurisdiction packs — US federal and 63 US packs in total, plus Canada, the EU, and the UK - Pricing — FOIAXpress: Quoted; sold through federal reseller channels | AccessPoint: Flat annual, published on the site, no per-user fees - Migrating your history — FOIAXpress: A live federal solicitation asks vendors to preserve FOIA metadata, workflow structures, and audit histories on migration | AccessPoint: Guided Excel import with per-row validation, document staging, and legacy case numbers preserved Where FOIAXpress fits (honest concessions): - You want assurance to arrive as a vendor's finished FedRAMP package rather than something your own security team assesses. That is a legitimate preference, and Casepoint's authorizations are exactly that — a shorter path if your agency has no appetite to bring a new system inside its own boundary. - Your office's needs stop at FOIA request processing, your deployment is stable, and the vendor's support commitment is enough while you watch how Casepoint FOIA matures. - You are mid-contract with sunk configuration work and no forcing event. Nothing has been end-of-lifed, so there is no need to move in a hurry. Q: Is FOIAXpress being discontinued? A: No end-of-life has been publicly announced, and FOIAXpress remains in live production generating agency FOIA logs. What has changed is its position: after AINS became OPEXUS and OPEXUS merged into Casepoint in January 2025, the OPEXUS website now redirects to Casepoint, the FOIAXpress page has become a "Customer Resources" page, and Casepoint invites FOIAXpress customers to learn about Casepoint FOIA — a separate next-generation product whose May 2026 launch announcement does not mention FOIAXpress. Read that as a signal worth planning around, not as a shutdown notice. Q: What is replacing FOIAXpress? A: The vendor's own answer is Casepoint FOIA, its next-generation FOIA product with AI assistance and native eDiscovery, backed by FedRAMP High and DoD impact-level authorizations. If your agency wants assurance delivered as a finished vendor package, that is the shorter path. The alternative worth weighing is architectural: AccessPoint deploys into your own cloud — including a government cloud — so the records under FOIA review never leave a boundary you control, and the same platform carries the privacy assessments, breaches, and complaints your office also runs, at a published flat rate. Q: Is AccessPoint FedRAMP authorized? A: AccessPoint isn't a hosted cloud service, so there is no vendor environment for FedRAMP to authorize — and that changes the question rather than ending it. FedRAMP authorizes a service you consume from a provider; AccessPoint is software you deploy into your own cloud, so it runs inside a boundary your agency already authorizes. For a federal agency that means your own government-cloud tenancy, whose platform authorizations you already inherit from Microsoft, with AccessPoint assessed as part of your system under your normal authorization process. Deployment artifacts are published outside AppSource with a scripted installer specifically so sovereign and government clouds are supported, purchasing adapts the same way — a private offer targeted to your tenant, or through your existing cloud solution provider — and even the optional AI features have a government-cloud path, since Microsoft offers Azure OpenAI in Azure Government's US Gov regions under the FedRAMP High authorization for Azure Government and DISA's DoD Impact Level 4 and 5 provisional authorization. It is a different assessment path, not a missing one — and it is worth a conversation early so your security team knows what they are assessing. Q: Did FOIAXpress really serve 85% of federal agencies? A: That figure was vendor marketing, and it was never consistent: OPEXUS materials variously claimed 78%, 80%, and "more than 85%" of federal agencies, with no citation to a study or survey in any of them. The claim no longer appears on Casepoint's current product pages. FOIAXpress was unquestionably one of the most widely deployed federal FOIA systems — that much is well supported — but we would not repeat a specific percentage, and neither should a procurement document. Q: How is FOIAXpress different from ATIPXpress? A: They are two products on one engine. Both are built on AINS's eCASE platform, but they are sold as distinct products through distinct channels: FOIAXpress serves US federal FOIA offices, while ATIPXpress is configured for Canadian ATIP — the Access to Information Act, the Privacy Act, and provincial regimes — and is delivered in Canada through a separate reseller. If you are the Canadian office, our ATIPXpress comparison is the relevant one. Q: Can we import our FOIAXpress history into AccessPoint? A: Yes. Any report that reaches Excel can be mapped into AccessPoint's tenant-generated import template, with per-row validation before anything imports and your original FOIA case numbers preserved as searchable legacy references. Documents stage through your own tenant's Azure storage with optional hash verification, and because status, due dates, and documents all carry over, in-progress requests continue without a cutover window. ### AccessPoint vs. GovQA (Granicus) URL: https://www.realizer.io/compare/govqa — facts last reviewed 2026-09-03 Verdict: GovQA, acquired by Granicus in 2021 and now sold as Records Request Management within the Granicus Operations Cloud, is an established US state-and-local platform for handling public-records request volume in the vendor's cloud. If your need is a public request portal and queue management, it's a credible incumbent. AccessPoint's difference is architectural and scoped: your records never leave your own Microsoft 365 tenant, collection happens where documents already live, and the same platform runs privacy impact assessments, breach notification, complaints, and risk — with flat published pricing. GovQA fact sheet: - Product: Records Request Management (GovQA), part of Granicus Operations Cloud; Legal Suite edition available - Vendor lineage: GovQA (Illinois) → acquired by Granicus, August 2021 - Deployment: Vendor-hosted cloud SaaS - Market: US state and local government public-records offices (~800 government customers at acquisition) - Status: Actively sold Side by side: - Scope — GovQA: Public-records request management | AccessPoint: Records requests plus PIAs, AIAs, breach response, complaints, and a privacy risk register - Where your data lives — GovQA: Vendor's cloud | AccessPoint: Your own Microsoft 365 and Azure tenant - Records collection — GovQA: Documents uploaded into the vendor system | AccessPoint: Pulled straight from SharePoint, OneDrive, Outlook, and Teams - Jurisdiction rules — GovQA: US public-records focus; configured per implementation | AccessPoint: 136 jurisdiction packs — US states, Canadian federal/provincial, EU, UK, and more - Redaction — GovQA: Within the vendor platform | AccessPoint: Browser-native studio with statutory exemption tagging, fall-backs, and AI-proposed redactions - Video & audio redaction — GovQA: Veritone Redact integration (partnership announced October 2020), separately licensed; the round-trip returns the redacted file and an audit log, with redaction codes burned into the video and listed in Veritone's own report rather than the request file's redaction record | AccessPoint: Native: box, blur, pixelate, mute, bleep, and voice distortion on body-worn, CCTV, 911 audio, and Teams recordings, with the exemption on every span, in-tenant face detection and tracking, transcript-anchored proposals, and a burned release with a hash manifest and a time-based redaction log — no per-seat add-on - Audit trail — GovQA: Application logging | AccessPoint: Hash-chained, append-only ledger with court-ready case audit exports - Pricing — GovQA: Enterprise SaaS; quotes | AccessPoint: Flat annual, published on the site, no per-user fees Where GovQA fits (honest concessions): - You're a high-volume US records office whose primary need is a public-facing portal with payment collection and queue deflection, and vendor-cloud residency is acceptable to your security team. - Your organization is already standardized on the Granicus Operations Cloud and wants requests handled inside that suite. - Records requests are your only mandate — no PIAs, breach program, or complaints handling to consolidate. Q: What is GovQA called now? A: Granicus, which acquired GovQA in August 2021, now sells it as "Records Request Management (GovQA)" within its Operations Cloud, alongside a "Records Request Management Legal Suite (GovQA Legal)" edition. Most practitioners still call it GovQA. Q: How is AccessPoint different from GovQA? A: GovQA manages public-records requests in the vendor's cloud. AccessPoint manages records requests plus the privacy side of the same office — privacy impact assessments, breach notification, complaints, and a risk register — and it runs natively inside your own Microsoft 365 tenant, collecting responsive records straight from SharePoint, Outlook, and Teams rather than having staff upload them into a portal. Pricing is flat and published rather than quoted. Q: Does AccessPoint have a public request portal like GovQA? A: A requestor self-service portal — public intake with jurisdiction-aware forms, secure status tracking, and direct delivery of released packages through Microsoft Entra External ID — is on AccessPoint's public roadmap. Today, intake is handled by your team, including a New-from-email flow that turns an intake-mailbox message into a fully formed request in one step. If a public portal is your single highest requirement right now, check the roadmap page for current status. Q: We're a US office — does AccessPoint cover our state's public-records law? A: AccessPoint ships jurisdiction packs for the federal FOIA and every US state, the District of Columbia, and the populated territories — 57 US public-records packs among 136 in total — each preloading response deadlines, exemption catalogues, business-day calendars, and letter templates for that statute. The solutions section lists every covered jurisdiction. Q: Can we import our GovQA history into AccessPoint? A: Yes. Export your request history to Excel, map it into AccessPoint's tenant-generated import template, and validate before anything imports. Old request numbers persist as legacy references, requester contacts import alongside their requests, and documents stage through your own Azure storage with optional hash verification. Imported records arrive historical — no notifications, no recomputed deadlines, full audit provenance. ### AccessPoint vs. NextRequest (CivicPlus) URL: https://www.realizer.io/compare/nextrequest — facts last reviewed 2026-09-03 Verdict: NextRequest earns its position. It is the largest US state-and-local public-records platform by footprint, with a public-facing request portal and published request logs that are a real transparency asset, RapidReview batch redaction, and a mature managed-SaaS operation now backed by CivicPlus. If a public front door is your single highest requirement, NextRequest is the stronger product today — AccessPoint's requestor self-service portal is on the roadmap, not shipped. The comparison is architectural and scoped: NextRequest is vendor cloud only, so responsive records are uploaded into CivicPlus's AWS environment to be processed, and its scope is public-records requests. AccessPoint keeps records inside your own Microsoft 365 and Azure tenant, collects them where they already live, and runs requests plus assessments, breach response, complaints, and risk — at flat published prices. NextRequest fact sheet: - Product: NextRequest — public-records request management, with RapidReview batch redaction, a Risk module, a public request portal, and published request logs - Vendor lineage: NextRequest → merged with ArchiveSocial and Monsido to form Optimere → Optimere acquired by CivicPlus; still branded and sold as NextRequest - Deployment: Vendor-hosted cloud only, on AWS — no on-premises and no customer-tenant option - Scale (vendor-cited): CivicPlus cites 70,000+ active users, roughly 1 million requests a year, and 300,000+ documents redacted annually - Market: US local government, schools, special districts, state agencies, and public safety - Status: Actively sold and developed under CivicPlus Side by side: - Scope — NextRequest: Public-records request management | AccessPoint: Records requests plus PIAs, AIAs, breach response with a statutory notification calculator, complaints, and an ISO 31000 privacy risk register - Where your data lives — NextRequest: CivicPlus's AWS cloud — vendor-hosted only, no tenant-resident option | AccessPoint: Your own Microsoft 365 and Azure tenant - Records collection — NextRequest: Responsive records exported from your systems and uploaded into the platform | AccessPoint: Pulled straight from SharePoint, OneDrive, Outlook, and Teams — plus a New-from-email flow that turns an intake-mailbox message into a fully-formed request in one step - Public request portal — NextRequest: A genuine strength — public-facing request portal with published request and disclosure logs | AccessPoint: Not yet. Intake runs through your team today; a requestor self-service portal is on the public roadmap - Redaction — NextRequest: RapidReview batch redaction, plus a Risk module using pattern matching and machine learning | AccessPoint: Browser-native studio with statutory exemption tagging, fall-backs, live patterns, and optional AI-proposed redactions into human review - Video & audio redaction — NextRequest: Not offered — RapidReview is document-only | AccessPoint: Native: box, blur, pixelate, mute, bleep, and voice distortion on body-worn, CCTV, 911 audio, and Teams recordings, with the exemption on every span, in-tenant face detection and tracking, transcript-anchored proposals, and a burned release with a hash manifest and a time-based redaction log — no per-seat add-on - Security & audit posture — NextRequest: AWS-hosted; the vendor cites ISO 27001, FISMA, and SOC certifications for its cloud | AccessPoint: Runs under the certifications and controls your agency already holds — Entra ID, your own security stack, no vendor runtime access — with a hash-chained, append-only audit ledger and court-ready case audit exports - Jurisdiction coverage — NextRequest: US state and local public-records focus, configured per implementation | AccessPoint: 136 jurisdiction packs — 63 of them US, including federal FOIA and the Privacy Act, plus Canadian, EU, and UK statutes - Pricing — NextRequest: Quoted | AccessPoint: Flat annual, published on the site, no per-user fees Where NextRequest fits (honest concessions): - The public front door is your top requirement. NextRequest's public-facing request portal and published request logs are a real advantage AccessPoint does not match today — AccessPoint's requestor self-service portal is on the public roadmap, not shipped. If letting requesters submit and track their own requests is non-negotiable this budget cycle, that is a straightforward reason to choose NextRequest. - You want a fully-managed SaaS with no Azure footprint at all. AccessPoint deploys App Service, Azure SQL, and storage into your own tenant's subscription — a one-click template, but still a real infrastructure commitment. If your agency has no Azure presence and no appetite to acquire one, a vendor-hosted product is the simpler fit. - You are already standardized on CivicPlus. If your website, agendas, and citizen engagement already run on that suite, keeping records requests inside it carries genuine procurement, support, and training value. Q: Who owns NextRequest now? A: CivicPlus. NextRequest merged with ArchiveSocial and Monsido to form Optimere, and CivicPlus subsequently acquired Optimere — a business reported at roughly 6,000 customers and about $30 million in annual recurring revenue at the time. NextRequest kept its own name, product page, and marketing throughout, and is still actively sold and developed as NextRequest under CivicPlus. Q: How is AccessPoint different from NextRequest? A: Two differences, both structural. Architecture: NextRequest is vendor cloud only, so responsive records are exported from your systems and uploaded into CivicPlus's AWS environment to be reviewed there. AccessPoint is tenant-resident — the database, documents, and audit history live in your own Microsoft 365 and Azure tenant, and records are collected straight from SharePoint, OneDrive, Outlook, and Teams rather than re-uploaded. Scope: NextRequest covers public-records requests. AccessPoint covers requests plus privacy impact assessments, algorithmic impact assessments, breach response with a statutory notification calculator, complaints, and an ISO 31000 privacy risk register, all on one hash-chained audit ledger. That architecture also reframes the certification question: the ISO 27001, FISMA, and SOC certifications CivicPlus cites describe the security of the vendor's cloud, while AccessPoint runs under the Microsoft platform attestations and the agency controls you already hold, with authentication through your existing Entra ID and no publisher runtime access to your environment. Pricing is flat and published rather than quoted. Q: Does AccessPoint have a public request portal like NextRequest's? A: No, and that is an honest current gap rather than something to spin. NextRequest's public-facing request portal with published request logs is a real strength AccessPoint does not match today. A requestor self-service portal — jurisdiction-aware public intake forms, secure status tracking, and delivery of released packages through Microsoft Entra External ID — is on AccessPoint's public roadmap, not shipped. What exists today is team-side intake, including a New-from-email flow that turns a message in your intake mailbox into a fully-formed request in one step, with the email attached as its first document. If a public portal is your highest requirement right now, check the roadmap page for current status before you decide. Q: We are a US agency — does AccessPoint know our state's public-records law? A: Yes — every US state, the District of Columbia, and the populated territories now have their own pack: federal FOIA and the Privacy Act, plus California, Texas, New York, Florida, Washington, Illinois, Pennsylvania and the rest, 57 US public-records packs among 136 in total. Each preloads the deadlines, exemption catalogue, fee rules, business-day calendars, and letter templates for that statute: California's 10-day determination with the 14-day unusual-circumstances extension, Texas prompt production with the 10-business-day Attorney General referral, New York FOIL's 5-business-day acknowledgement, Washington's 5-business-day response duty, Florida's reasonable-time standard. The solutions section lists every covered jurisdiction. Q: Can we import our NextRequest history into AccessPoint? A: Yes. Export your request history to Excel, map it into AccessPoint's tenant-generated import template, and read the per-row validation report before anything commits. Old request numbers persist as legacy references, requester contacts import alongside their requests, and documents stage through the migration-staging container in your own tenant's Azure storage with optional MD5 hash verification. Imported records arrive with status, due dates, and documents intact, so in-progress cases continue with no cutover — no notifications fire, nothing recomputes, and every record carries an Imported audit-trail entry. ### AccessPoint vs. JustFOIA (MCCi (MCC Innovations)) URL: https://www.realizer.io/compare/justfoia — facts last reviewed 2026-09-04 Verdict: JustFOIA is a credible choice for a US city, county, school district or police department that wants a complete records-request desk without owning any infrastructure: a public portal with published records, department routing with a pausable clock, a payment portal wired to mainstream card gateways, in-app redaction, and hosting in Microsoft Azure Government backed by SOC 2 Type II, CJIS-ready and TX-RAMP attestations. If that list is your whole requirement, JustFOIA does it well, and its public portal is ahead of AccessPoint's today. The differences are structural. JustFOIA is a vendor-hosted service into which responsive records are exported and uploaded, its scope stops at the request, and video redaction is a separately licensed hand-off to Veritone. AccessPoint keeps records inside your own Microsoft 365 and Azure tenant, collects them where they already live, redacts video and audio natively, and runs requests plus assessments, breach response, complaints and risk — at flat published prices. JustFOIA fact sheet: - Product: JustFOIA — public-records request management with a public portal, workflow automation, PST email extraction, in-app redaction, a payment portal and reporting - Vendor lineage: Built by MCCi (Tallahassee, Florida) from 2012; first customer City of Naples, FL, July 2014; split into a dedicated company under the MCCi umbrella in 2020 - Deployment: Vendor-hosted SaaS in Microsoft Azure Government (US-only data centres); no on-premises or customer-tenant option is described in its published documentation - Scale (vendor-cited): 500+ client agencies in 45 states, 27,000+ users, 2.1 million records requests processed, 98% client renewal - Market: US local government, law enforcement, K-12 and higher education, and elections offices; request types include records, lien, building, subpoena, interagency and EMS - Status: Actively sold and developed; Veritone Redact integration for video and audio announced August 2026 Side by side: - Scope — JustFOIA: Public-records request management (plus lien, building, subpoena, interagency and EMS request forms) | AccessPoint: Records requests plus PIAs, AIAs, breach response with a notification calculator, complaints and appeals, and an ISO 31000-aligned privacy risk register - Where your data lives — JustFOIA: MCCi's tenancy in Microsoft Azure Government — vendor-hosted, US-only data centres | AccessPoint: Your own Microsoft 365 and Azure tenant — the database, documents and audit history sit in your subscription - Records collection — JustFOIA: Documents uploaded into the platform; email arrives as PST files exported by IT, then extracted and de-duplicated in-app; Laserfiche repositories searchable through the integration | AccessPoint: Pulled straight from SharePoint, OneDrive, Outlook, calendars, Teams chats and meeting recordings, OneNote and Copilot interaction history — plus a New-from-email flow that turns an intake-mailbox message into a request in one step - Jurisdiction rules — JustFOIA: US public-records focus; task due dates, pause rules, exemption reasons and correspondence configured per customer | AccessPoint: 136 jurisdiction packs — 57 US public-records packs covering federal FOIA, every state, DC and the populated territories, plus Canadian, UK, EU and other statutes — each preloading deadlines, exemptions, fee schedules and letter templates - Redaction — JustFOIA: In-app redaction with AI-enhanced detection (text search, pattern matching, proximity search), pre-written or custom redaction reasons, and a redaction audit log; Adobe Acrobat Pro and Laserfiche redaction also offered | AccessPoint: Browser-native studio with statutory exemption tagging and fall-backs, request-scoped find-and-redact patterns, tenant detection rules, and optional AI-proposed redactions that always land in human review - Video & audio redaction — JustFOIA: Veritone Redact integration (announced 4 August 2026): right-click send from a request, cloud to cloud; the redacted file and Veritone's audit trail return to the request; both products must be licensed separately | AccessPoint: Native: box, blur and pixelate for the picture; mute, bleep and voice distortion for the sound; in-tenant face detection and tracking; transcript-anchored proposals; the exemption recorded on every span, with a time-based redaction log and an ML-use disclosure in the release — no separate licence - Audit trail — JustFOIA: Redaction audit log and request history; application logging otherwise | AccessPoint: Hash-chained, append-only audit ledger with server-side integrity verification, plus court-ready case audit exports (audit log CSV, manifest, AI-involvement disclosure) - Pricing — JustFOIA: Not published — quote via web form; purchase orders and purchasing cooperatives accepted | AccessPoint: Flat annual pricing by organization size, published on the site; installed from Microsoft AppSource Where JustFOIA fits (honest concessions): - The public front door is your top requirement. JustFOIA's portal — online submission, self-service status tracking, previously published records searchable by tag, security keys for anonymous requesters and download links for releases — is a real advantage AccessPoint does not match today. AccessPoint's requestor self-service portal is on the public roadmap, not shipped; if letting requesters submit and track their own requests is non-negotiable this budget cycle, that is a straightforward reason to choose JustFOIA. - You need to take card payments from requesters through a checkout. JustFOIA's payment portal is wired to Authorize.net, PayPal, Global Payments, Worldpay and North, notifies requesters of estimated cost, and can release records automatically on payment. AccessPoint's fee panel assesses, itemizes, waives and records payments inside the request; if an integrated requester-facing checkout is essential, JustFOIA has that built today. - You want a fully managed service with no Azure footprint of your own. JustFOIA runs entirely in MCCi's Azure Government tenancy. AccessPoint deploys App Service, Azure SQL and Blob Storage into your own subscription — a template deployment, but still infrastructure your team owns. If your agency has no Azure presence and no appetite to acquire one, a vendor-hosted product is the simpler fit. - You are a Laserfiche shop. MCCi is a major Laserfiche solution provider, and JustFOIA's integration retrieves repository documents into a request and archives closed requests back into Laserfiche under a retention schedule. If Laserfiche is your system of record, that round trip carries genuine procurement, support and training value. Q: Who makes JustFOIA, and where is it hosted? A: JustFOIA is an MCCi (MCC Innovations) brand from Tallahassee, Florida. MCCi built it from 2012, launched it with the City of Naples, Florida in July 2014, and split it into a dedicated company under the MCCi umbrella in 2020. It is a vendor-hosted service running in Microsoft Azure Government — physically isolated, US-only data centres — with a SOC 2 Type II report, a CJIS Ready designation and TX-RAMP certification. No on-premises or customer-tenant deployment is described in its published documentation. Q: How is AccessPoint different from JustFOIA? A: Three differences, all structural. Architecture: JustFOIA runs in MCCi's Azure Government tenancy, so responsive records are exported from your systems — email as PST files — and uploaded to be reviewed there. AccessPoint is tenant-resident: the database, documents and audit history live in your own Microsoft 365 and Azure tenant, and records are collected straight from SharePoint, OneDrive, Outlook and Teams rather than re-uploaded. Scope: JustFOIA covers public-records requests; AccessPoint covers requests plus privacy impact and algorithmic impact assessments, breach response with a notification calculator, complaints and appeals, and an ISO 31000-aligned privacy risk register on one hash-chained audit ledger. Media: JustFOIA hands video and audio to Veritone Redact under a separate licence and gets the file and Veritone's audit trail back; AccessPoint redacts video and audio natively with the exemption recorded on every span. Pricing is flat and published rather than quoted. Q: Does AccessPoint have a public portal and online payments like JustFOIA? A: Not the portal, and that is an honest current gap rather than something to spin. JustFOIA's public portal — submission, status tracking, published records searchable by tag, and download links — is a real strength AccessPoint does not match today. A requestor self-service portal is on AccessPoint's public roadmap, not shipped; what exists now is team-side intake, including a New-from-email flow that turns an intake-mailbox message into a fully formed request with the email attached as its first document. On fees, AccessPoint's Response & fees tab assesses, itemizes, waives, records payment against and finalizes fees per jurisdiction fee schedule, and can suggest a fee-pending clock pause; JustFOIA additionally takes card payments through integrated gateways. If either the portal or an integrated checkout is your highest requirement right now, check the roadmap page before you decide. Q: Is AccessPoint a JustFOIA alternative for an agency already on Microsoft 365? A: That is exactly the case it is built for. If your records already live in SharePoint, OneDrive, Outlook and Teams, AccessPoint lets you search and attach them from inside the request instead of exporting and uploading them into a portal, authenticates through your existing Microsoft Entra ID, deploys into your own Azure subscription from Microsoft AppSource, and keeps every record, redaction and audit entry inside your tenant under the controls you already hold. If your agency is a Laserfiche shop with no Azure footprint, or a public portal with card payments is the deciding requirement, JustFOIA is the more natural fit today. Q: Can we import our JustFOIA history into AccessPoint? A: Yes. Export your request history from JustFOIA's reporting to Excel, map it into AccessPoint's tenant-generated import template, and read the per-row validation report before anything commits. Old request numbers persist as legacy references, requester contacts import alongside their requests, and documents — including any archived to Laserfiche — stage through the migration-staging container in your own Azure storage with optional MD5 hash verification. Imported records arrive historical: no notifications fire, nothing recomputes, and every record carries an Imported audit-trail entry. ### AccessPoint vs. ArkCase (ArkCase, LLC / Armedia) URL: https://www.realizer.io/compare/arkcase — facts last reviewed 2026-09-04 Verdict: ArkCase FOIA is a serious option for a US federal agency — or a state office with a federal-style process — that wants a configurable case-management platform with a public portal and reading room, intake-to-release queues, native redaction with exemption codes, and the DOJ/OIP annual and quarterly FOIA reports generated in-product, on an offering with a FedRAMP Moderate authorization and an LGPL open-source core you can inspect and self-host. Its trade-offs are the flip side of that flexibility: the free edition ships without the redaction viewer, Enterprise is priced per named user with cloud compliance requirements as an extra, and the Java, Alfresco, Solr and Pentaho stack is either a vendor cloud or a substantial platform to run yourself. AccessPoint is narrower in deployment choice and broader in scope: it runs only inside your own Microsoft 365 and Azure tenant, collects records where they already live, redacts video and audio natively, and carries privacy assessments, breach response, complaints and risk on the same audit ledger — at flat published prices. ArkCase fact sheet: - Product: ArkCase FOIA — FOIA and public-records solution on the ArkCase case-management platform; Community (open source) and Enterprise (Gold and Platinum) editions - Vendor lineage: Armedia LLC (Vienna, Virginia, founded 2002) grew ArkCase out of FBI case-management work; the brand is now ArkCase, LLC, with Armedia as implementer - Deployment: Vendor cloud with a FedRAMP Moderate ATO (October 2024, sponsored by the Postal Regulatory Commission), AWS GovCloud and other enclaves, or self-hosted on your own physical or virtual servers - Open source: Community Edition on GitHub under LGPL-3.0 — Java, Spring, Tomcat, Solr, ActiveMQ, MySQL, Alfresco, Pentaho; the annotation and redaction viewer is Enterprise-only - Pricing (published): Open Source free; Enterprise Gold US$60 per named user per month (cloud), compliance hosting requirements such as SOC or CJIS at additional cost; Enterprise Platinum by quote; government discounts offered - Market: US federal agencies and state governments with federal-style FOIA processes; named public-records customers include the Washington State Legislature, DC OCFO, Tennessee's Office of General Counsel and Montana's Department of Administration Side by side: - Scope — ArkCase: FOIA and public-records requests and appeals on a general case-management platform that also sells legal, complaint, correspondence and docket solutions | AccessPoint: Records requests plus PIAs, AIAs, breach response with a notification calculator, complaints and appeals, and an ISO 31000-aligned privacy risk register — one product, one audit ledger - Where your data lives — ArkCase: ArkCase's cloud (FedRAMP Moderate), an AWS GovCloud or other enclave, or your own data centre if you run the stack yourself | AccessPoint: Your own Microsoft 365 and Azure tenant — there is no vendor-hosted option - Records collection — ArkCase: Capture from web, phone, email, fax and walk-in intake; a PST extractor for mailbox exports; native connectors to more than 40 ECM repositories including Alfresco, Documentum and SharePoint | AccessPoint: Pulled straight from SharePoint, OneDrive, Outlook, calendars, Teams chats and meeting recordings, OneNote and Copilot interaction history — plus a New-from-email flow that turns an intake-mailbox message into a request in one step - Jurisdiction rules — ArkCase: US federal FOIA orientation — DOJ/OIP annual and quarterly reports with NIEM-XML output generated in-product; state processes configured per implementation | AccessPoint: 136 jurisdiction packs — 57 US public-records packs covering federal FOIA, every state, DC and the populated territories, plus Canadian, UK, EU and other statutes — with deadlines, exemptions, fee schedules and letters preloaded; the statistics module lists US FOIA and Washington JLARC among the annual-reporting regimes it covers - Redaction — ArkCase: Native annotation-overlay redaction burned into a new version at release, exemption codes, bulk redaction and regex-driven automatic redaction — Enterprise edition only; the Community edition is viewer-only | AccessPoint: Browser-native studio with statutory exemption tagging and fall-backs, request-scoped find-and-redact patterns, tenant detection rules, and optional AI-proposed redactions that always land in human review — every feature in every tier - Video & audio redaction — ArkCase: Listed as automated video and audio redaction on the FOIA solution page; the engine, licensing, and how an exemption code attaches to a time span are not described in its published documentation | AccessPoint: Native: box, blur and pixelate for the picture; mute, bleep and voice distortion for the sound; in-tenant face detection and tracking; transcript-anchored proposals; the exemption recorded on every span, with a time-based redaction log and an ML-use disclosure in the release — no separate licence - Audit trail — ArkCase: Per-user and per-request activity monitoring and application audit logging | AccessPoint: Hash-chained, append-only audit ledger with server-side integrity verification, plus court-ready case audit exports (audit log CSV, manifest, AI-involvement disclosure) - Pricing — ArkCase: Open Source free; Enterprise Gold US$60 per named user per month in the cloud, compliance hosting extra; Platinum by quote | AccessPoint: Flat annual pricing by organization size, published on the site, no per-user metering; installed from Microsoft AppSource Where ArkCase fits (honest concessions): - You are a US federal agency that files DOJ/OIP annual and quarterly FOIA reports. ArkCase generates them in-product, including NIEM-XML output and the quarterly ten-oldest pending requests, appeals and consultations report added in release 25.09.04. AccessPoint's statistics module covers US FOIA annual reporting among many regimes, but check its output against your OIP submission format before deciding — ArkCase was built around that filing. - You need a FedRAMP-authorized offering, a classified enclave, or code you can read and host yourself. ArkCase has a FedRAMP Moderate ATO, is described as deployable into AWS GovCloud, NIPR, SIPR and JWICS, and publishes its Community Edition under LGPL-3.0 on GitHub. AccessPoint runs only inside your Microsoft 365 and Azure tenant; if your authority to operate depends on FedRAMP paperwork or an air-gapped network rather than Microsoft's platform attestations, ArkCase fits and AccessPoint does not. - You already run Alfresco, Documentum or another enterprise content repository, or review productions in Relativity. ArkCase natively connects to more than 40 ECM repositories and has shipped a Relativity pairing for public-information work, so a records program anchored in those systems keeps its centre of gravity. - The public portal and reading room are your top requirement. ArkCase's self-service portal — submit, check status, cancel — and its reading room for released records are shipped today, while AccessPoint's requestor self-service portal is on the public roadmap. If letting requesters file and track their own requests is non-negotiable this budget cycle, that is a straightforward reason to choose ArkCase. Q: Is ArkCase really open source, and what is in the free edition? A: Yes — the ArkCase Community Edition is on GitHub under the LGPL-3.0 licence, on a Java, Spring and Tomcat stack with Solr, ActiveMQ, MySQL, Alfresco and Pentaho. The vendor's own comparison lists the free edition as viewer-only with online support only; annotation and redaction, online co-editing, the full Pentaho analytics suite, AI integrations such as transcription, and high-availability clustering are Enterprise features. Enterprise Gold is published at US$60 per named user per month in the cloud, with compliance hosting requirements such as SOC or CJIS as an additional cost and special pricing for government; Platinum is by quote. Q: How is AccessPoint different from ArkCase FOIA? A: Shape and scope. ArkCase is a general case-management platform configured for FOIA — flexible, open at the core, FedRAMP Moderate-authorized, and strong on US federal reporting — that you either have hosted or run yourself, and into which responsive records are uploaded or connected through repository integrations. AccessPoint is a purpose-built access and privacy product that installs from Microsoft AppSource into the Microsoft 365 tenant you already run: records are collected straight from SharePoint, OneDrive, Outlook and Teams; the database, documents and hash-chained audit ledger stay in your own Azure subscription; document, video and audio redaction are native and included; and privacy impact and algorithmic impact assessments, breach response, complaints and a risk register run alongside requests. Pricing is flat and annual by organization size rather than per named user. Q: Does AccessPoint produce US FOIA reports and have a public portal like ArkCase? A: Partly, and honestly. AccessPoint's statistics module turns request, privacy and complaint data into the figures an office needs for management oversight and annual reporting, and lists US FOIA and Washington JLARC among the regimes it covers — but ArkCase's DOJ/OIP reporting, with NIEM-XML output and the quarterly ten-oldest report, is built specifically around the federal filing, so a federal agency should check AccessPoint's output against its OIP submission before deciding. On the portal, ArkCase's self-service portal and reading room are shipped today; AccessPoint's requestor self-service portal is on the public roadmap, and intake currently runs through your team, including a New-from-email flow that turns an intake-mailbox message into a fully formed request. Q: Is AccessPoint an ArkCase alternative for a state or local agency? A: For an agency that runs Microsoft 365, usually yes — and the fit improves the further you are from the federal filing calendar. AccessPoint ships a jurisdiction pack for federal FOIA, every state, DC and the populated territories, preloading each statute's deadlines, exemptions, fee schedules and letter templates, and it adds the privacy work the same office increasingly owns. Where ArkCase remains the better answer: you need FedRAMP-authorized hosting or a classified enclave, you want to self-host open-source code, your records live in Alfresco or Documentum, or a shipped public portal and reading room is the deciding requirement. Q: Can we import our ArkCase history into AccessPoint? A: Yes. Export your request history from ArkCase — the search-results export, a Pentaho report, or the database itself if you self-host — to Excel, map it into AccessPoint's tenant-generated import template, and read the per-row validation report before anything commits. Old request numbers persist as legacy references, requester contacts import alongside their requests, and documents exported from the connected repository stage through the migration-staging container in your own Azure storage with optional MD5 hash verification. Imported records arrive historical: no notifications fire, nothing recomputes, and every record carries an Imported audit-trail entry. ### AccessPoint vs. AMANDA (Granicus (formerly CSDC Systems / Calytera)) URL: https://www.realizer.io/compare/amanda — facts last reviewed 2026-09-03 Verdict: AMANDA (now sold by Granicus as Permitting, Compliance & Licensing) is a broad government case-management platform whose FOI capability arrived as one module in 2019, decades into the product's life. It's a reasonable answer when FOI is a side-workload on a platform you already run for permitting. It's the wrong shape when access and privacy is the mandate: AccessPoint is purpose-built for that work — statutory deadline math, exemption-tagged redaction, PIAs, breach response, complaints, and a court-ready audit ledger — and it runs inside your own Microsoft 365 tenant rather than as another enterprise platform to operate. AMANDA fact sheet: - Product: AMANDA — sold by Granicus as "Permitting, Compliance & Licensing"; FOI/ATIP is one module - Vendor lineage: CSDC Systems (~1989) → Calytera (2019) → Granicus (2020) - FOI module: Launched June 2019; intake, document management, review/redaction, legislated reports - Deployment: Vendor-hosted cloud or on-site installation - Market: State, provincial, and municipal regulatory agencies — primarily permitting and licensing - Status: Actively sold Side by side: - What it's built for — AMANDA: Permitting, licensing, and compliance — FOI is one module of ~50 functions | AccessPoint: Purpose-built for public-sector access, privacy, and responsible AI - Privacy program (PIA, AIA, breach, complaints, risk) — AMANDA: Not the product's focus | AccessPoint: Integrated — same platform, same audit ledger - Where your data lives — AMANDA: Vendor-hosted cloud or your own servers | AccessPoint: Your own Microsoft 365 and Azure tenant - Records collection — AMANDA: Documents brought into the platform | AccessPoint: Pulled straight from SharePoint, OneDrive, Outlook, and Teams - Statutory deadline engine — AMANDA: Configured per implementation | AccessPoint: Computed from jurisdiction packs — business-day calendars, holds, extensions, deemed refusal - Redaction — AMANDA: Review and redaction within the FOI module | AccessPoint: Browser-native studio with statutory exemption tagging, fall-backs, and AI-proposed redactions - Video & audio redaction — AMANDA: Media are opaque attachments; no video or audio redaction in the FOI module | AccessPoint: Native: box, blur, pixelate, mute, bleep, and voice distortion on body-worn, CCTV, 911 audio, and Teams recordings, with the exemption on every span, in-tenant face detection and tracking, transcript-anchored proposals, and a burned release with a hash manifest and a time-based redaction log — no per-seat add-on - Implementation shape — AMANDA: Enterprise platform implementation, typically with configuration services | AccessPoint: Deploys into your existing tenant in an afternoon; jurisdiction pack seeds the rules - Pricing — AMANDA: Enterprise licensing; quotes | AccessPoint: Flat annual, published on the site, no per-user fees Where AMANDA fits (honest concessions): - Your organization already runs AMANDA for permitting and licensing, the FOI workload is small, and one-vendor consolidation genuinely outweighs purpose-built capability. - FOI intake is handled by the same back-office team that lives in AMANDA all day, and your privacy program is managed elsewhere. - You need deep permitting/licensing case management first and FOI second — that's the problem AMANDA was actually built to solve. Q: Does AMANDA handle FOI requests? A: Yes — Granicus's AMANDA platform includes an Access to Information and Privacy (ATIP) / Freedom of Information (FOI) module, launched in 2019, covering request intake, document management, review and redaction, and legislated reporting. The comparison question isn't whether it can log a request; it's whether a module on a permitting platform matches a system purpose-built for statutory access and privacy work. Q: We already run AMANDA for permitting. Why would we buy a separate FOI system? A: For the same reason your finance team doesn't run payroll in the permitting system: the hard parts are domain-specific. Statutory business-day deadline math, exemption-tagged redaction that survives a commissioner's review, PII firewalls between custodians and requestor identity, privacy impact assessments, and breach-notification calculators are deep, legislated capabilities. AccessPoint adds no new infrastructure — it runs in the Microsoft 365 tenant you already have — so the integration cost of 'separate' is far smaller than it used to be. Q: Is AccessPoint harder to stand up than an AMANDA module? A: It's usually far easier. Enabling new AMANDA capability is typically an enterprise implementation with configuration services. AccessPoint deploys from a Bicep template into your own tenant's Azure subscription and installs into SharePoint from AppSource — often within an afternoon — and a jurisdiction pack seeds your statute's deadlines, exemptions, and letters. Q: Can we migrate FOI history out of AMANDA into AccessPoint? A: Yes. Export your cases to Excel from AMANDA's reporting, map them into AccessPoint's tenant-generated import template, and validate before anything imports. Old case numbers persist as legacy references, documents stage through your own Azure storage with optional hash verification, and imported records arrive with no notifications, no recomputed deadlines, and full audit provenance. Q: What happened with Nova Scotia's AMANDA-based FOI portal? A: Nova Scotia launched a province-wide FOI case-management solution built on AMANDA 7 in 2016. In 2018, its public FOI portal suffered a widely reported breach that exposed roughly 7,000 documents and kept the portal offline for 152 days; a 2016 Auditor General report had earlier flagged configuration gaps against provincial IT security standards. That's dated history under a prior owner (CSDC), and today's product is Granicus's responsibility — but it's a fair reminder to ask any FOI vendor exactly where your data lives and who has hardened it. AccessPoint's answer is structural: everything stays in your own Microsoft 365 and Azure tenant, governed by your own security stack. ### AccessPoint vs. Vayle (Vayle Inc.) URL: https://www.realizer.io/compare/vayle — facts last reviewed 2026-09-11 Verdict: Vayle is a strong Canadian option, and we're glad to say so. It's a Toronto company serving public-sector customers across Canada, with a mature FOI platform, an official AMO partnership, a public-facing online form with integrated payment processing and ID verification, a PIA module, and SOC 2 Type II assurance. It hosts in Canada in its own cloud, with ThinkOn named as its sovereign hosting partner, or its on-premises installation can run on your own servers or in your Azure tenant. Choose Vayle if you need that public front door on day one, with a choice of where it's hosted. Choose AccessPoint for two reasons you can check before you call: it runs as hosted services in your own Azure tenant that integrate with your Microsoft 365 environment — requests, records, redaction, and reporting in the SharePoint, Outlook, and Teams your team already uses — and the price is flat, one annual fee by organization size, published on the site, with every feature included and no per-user fees. Vayle fact sheet: - Product: Vayle FOI (launched as FOI Nexus), public-facing forms & payments, Vayle ID (Interac Verified), and Vayle PIA - Vendor: Vayle Inc., Toronto — entered the FOI market in 2021 by acquiring certain assets from Nordat - Deployment: Cloud-hosted in Canada on Vayle's network, with ThinkOn named as its sovereign hosting partner; or an on-premises installation, on your own servers or deployed to your Azure tenant - Assurance: SOC 2 Type II - Market: Public-sector customers across Canada — municipalities, police services, school boards, and provincial bodies; AMO partner since 2023 - Advisors: David Goodis and Tricia Ralph of INQ Law are advisors to the company - Status: Actively developed and sold Side by side: - Microsoft 365 integration — Vayle: Standalone platform — documents brought into its document management | AccessPoint: Hosted services in your own Azure tenant, integrated with Microsoft 365 — records pulled straight from SharePoint, OneDrive, Outlook, and Teams, and the work happens in the tools your team already uses - Pricing — Vayle: Quoted; AMO member incentives | AccessPoint: Flat annual by organization size, published on the site — from $2,990 a year, every feature included, no per-user fees, no quote needed - Where your data lives — Vayle: Vayle's Canadian cloud (all FOI data hosted in Canada), or its on-premises installation on your own servers or in your Azure tenant; SOC 2 Type II assurance | AccessPoint: Your own Microsoft 365 and Azure tenant, in the region you already run — nothing hosted by the vendor - Public intake — Vayle: Public-facing online form, integrated payment processing, and ID verification | AccessPoint: Email-based intake only today (New-from-email); no public portal yet - Statutory reporting — Vayle: Automates the annual statistical report submitted to the IPC | AccessPoint: Generates the IPC report from jurisdiction-pack templates, plus Report Studio dashboards - Legislative alignment — Vayle: Advisors to the company include David Goodis and Tricia Ralph of INQ Law, whose practices concentrate on access to information and privacy | AccessPoint: Jurisdiction packs built from public information about each Act — a starting point your own legal counsel validates - Redaction — Vayle: Integrated redaction tool within the platform | AccessPoint: Browser-native studio with statutory exemption tagging, fall-backs, and AI-proposed redactions - Video & audio redaction — Vayle: No video or audio redaction described in its published documentation | AccessPoint: Native: box, blur, pixelate, mute, bleep, and voice distortion on body-worn, CCTV, 911 audio, and Teams recordings, with the exemption on every span, in-tenant face detection and tracking, transcript-anchored proposals, and a burned release with a hash manifest and a time-based redaction log — no per-seat add-on - Jurisdiction coverage — Vayle: Ontario FIPPA/MFIPPA, Alberta ATIA/POPA, BC FOIPPA, and Saskatchewan LA FOIP | AccessPoint: 136 jurisdiction packs — Canadian federal/provincial, US, EU, UK, and more - Scope — Vayle: FOI/ATIP case management, public intake & payments, ID verification, appeals, PIA workflow | AccessPoint: Access requests, plus PIAs, breach response, complaints, and a privacy risk register on the same platform when you need them Where Vayle fits (honest concessions): - Your security policy calls for a specific hosting arrangement — Vayle's Canadian cloud, or an on-premises installation on your own servers or in your Azure tenant — and you want a vendor with SOC 2 Type II assurance that can offer either. - A public front door is your top priority today — an online request form, integrated payment processing, verified requester identity — and, if you're an AMO member, the partnership and member incentives matter to you. - Your program is FOI plus PIAs under the Ontario, Alberta, BC, or Saskatchewan statutes Vayle supports, and you want a vendor deeply specialized in exactly that. Q: How does AccessPoint compare to Vayle? A: Both are modern Canadian products, so this is an architecture-and-buying decision rather than a legacy rescue. Vayle is a separate platform — hosted in Canada on Vayle's network, or installed on-premises on your own servers or in your Azure tenant, with SOC 2 Type II assurance — that offers a public-facing online form with integrated payment processing and ID verification, and adds a PIA module. AccessPoint is hosted services in your own Azure tenant that integrate with your Microsoft 365 environment, so requests, records, redaction, and reporting happen in SharePoint, Teams, and Outlook — and it's priced flat: one annual fee by organization size, published on the site, every feature included, no per-user fees, no quote required. Q: How does the pricing compare? A: Vayle prices by quote — its site doesn't publish rates, and AMO members are offered incentives through the partnership — so plan on a sales conversation to learn the number. AccessPoint's pricing is flat and public: one annual fee by organization size — $2,990 a year for organizations under 500 employees, $7,990 for 500 to 2,000, and $14,990 over 2,000 — with every feature and module included, no per-user fees, and no separate charges for redaction, PIAs, or jurisdiction packs. It's billed through the Microsoft marketplace, and the only other cost is the Azure consumption in your own tenant. You can put it in a budget submission before you've spoken to anyone at Realizer. Q: Does Vayle offer on-premises or Canadian sovereign hosting? A: Yes. Vayle FOI is built in Canada and is offered as cloud hosting on Vayle's own network or as an on-premises installation, and the on-premises installation can be deployed to your own Azure tenant; Vayle names ThinkOn, a Canadian sovereign cloud provider, as its hosting partner and holds SOC 2 Type II assurance. AccessPoint is different in kind: it is a set of hosted services that run in your own Azure tenant and integrate with your Microsoft 365 environment, in the Azure region you already use, so residency, identity, and security controls are the ones your organization already runs. Both can run in your Azure, but Vayle's is a separate platform installed there, into which records are brought; AccessPoint works on the records where they already live in SharePoint, OneDrive, and Outlook, so they never leave the tenant they started in. Q: Does either vendor provide advisory or staffing help? A: Both are software companies first. Vayle's current solutions are software — FOI case management, digital forms and payments, ID verification, and PIA workflow — so if you need advisory help, ask Vayle directly what it can arrange through its partners. AccessPoint is software plus onboarding and migration services — we work alongside whichever counsel or consultants you already trust rather than replacing them. Many offices find that jurisdiction packs, deadline automation, AI-assisted drafting and redaction, and My Day work queues let their existing team absorb the volume that made outside help tempting. Q: How does each product stay aligned with the legislation? A: Differently, and it's worth understanding both. Vayle lists access and privacy lawyers from INQ Law among its advisors — worth asking how that shows up in the product's configuration. AccessPoint's jurisdiction packs are built from public information about each Act — deadlines, exemptions, fee rules, and reporting — and are versioned so you can see what changed; they are a starting point, and we expect your own legal counsel to validate them for your institution. If having lawyers of that calibre advising the vendor matters to you, that's a point for Vayle. With either product your own counsel remains the authority for your institution, and AccessPoint is built so they can read, validate, and adjust the pack themselves. Q: We're an AMO member municipality — should that decide it? A: The AMO partnership is a genuine benefit — an established vendor relationship, member incentives, and a company that runs education events with AMO on changes like Bill 97. It's a fair reason to shortlist Vayle. The questions worth asking every vendor on the shortlist, us included: where do the records under review physically live, who can access them, what happens to your data if you leave, and what does it cost before you ask? AccessPoint's answers: your tenant, only you, one-click export, and the price on the pricing page. Q: Does AccessPoint have online request forms and fee payment like Vayle? A: Not yet — that's an honest current difference, and Vayle's front door is very good. Vayle offers a public-facing online form, integrated payment processing, and ID verification; AccessPoint's intake is email-based today, with a New-from-email flow that turns an intake-mailbox message into a fully formed request in one step. A requestor self-service portal with jurisdiction-aware intake forms, secure status tracking, and Entra External ID verification is on AccessPoint's public roadmap. Q: Can we migrate between Vayle and AccessPoint later if we choose wrong? A: Data portability is the honest answer to switching anxiety. AccessPoint imports any caseload that reaches Excel — with validation, legacy reference numbers, and document staging through your own storage — and its one-click business-readable export means leaving AccessPoint is equally clean. Ask every vendor you evaluate for the equivalent answer in writing. ### AccessPoint vs. FOI Assist (FOI Assist Corporation (Justin Petrillo), London, Ontario) URL: https://www.realizer.io/compare/foi-assist — facts last reviewed 2026-09-10 Verdict: FOI Assist is a well-regarded, lightweight SaaS for Ontario FIPPA/MFIPPA institutions — deadline tracking, guided workflows, compliant letters, online intake, and a one-click IPC annual statistical report — hosted on Amazon Web Services in Canada and built by Justin Petrillo, an Ontario lawyer who ran the Toronto 2015 Games' FOI program. For a small office that mainly needs the paperwork layer handled, it's an honest, affordable answer, and the lawyer-practitioner behind it, with his free knowledge base and seminars, is a real part of the value. AccessPoint plays a different game: it runs inside your own Microsoft 365, collecting records from SharePoint and Outlook, redacting in the browser, and reporting from the same case data, with flat pricing published on the site — and privacy assessments, breach response, and complaints on the same platform when you need them. FOI Assist fact sheet: - Product: FOI Assist — browser-based subscription software, plus a free public FOI knowledge base and seminar series - Vendor: FOI Assist Corporation (founder Justin Petrillo), London, Ontario; released February 2021 - Founder: Ontario lawyer with 15+ years' experience; ran the Toronto 2015 Games FOI program; former senior counsel at Canada Life; former software developer at NVIDIA and Microsoft - Deployment: Cloud-hosted on Amazon Web Services in Canada (Canada Central region); browser-based with SSO login, nothing to install - Market: Ontario FIPPA/MFIPPA institutions — municipalities, police, school boards, universities, hospitals - Status: Actively developed and sold Side by side: - Where your data lives — FOI Assist: FOI Assist's cloud on Amazon Web Services in Canada — Canadian data residency | AccessPoint: Your own Microsoft 365 and Azure tenant - Microsoft 365 integration — FOI Assist: Standalone tool — records collection and redaction handled outside it | AccessPoint: Native to Microsoft 365 — records pulled straight from SharePoint, OneDrive, Outlook, and Teams, and the work happens in the tools your team already uses - Pricing — FOI Assist: Annual subscription, quoted | AccessPoint: Flat annual by organization size, published on the site, no per-user fees - Public intake — FOI Assist: Online request intake | AccessPoint: Email-based intake only today (New-from-email); no public portal yet - Statutory reporting — FOI Assist: Automates the annual statistical report submitted to the IPC | AccessPoint: Generates the IPC report from jurisdiction-pack templates, plus Report Studio dashboards - Legislative alignment — FOI Assist: Built by a lawyer who has run an Ontario FOI program; workflows track FIPPA/MFIPPA closely | AccessPoint: Jurisdiction packs built from public information about each Act — a starting point your own legal counsel validates - Practitioner guidance — FOI Assist: Free knowledge base, seminar series, flowcharts, reference cards, and a PIA Exchange, from a lawyer who has run an FOI program | AccessPoint: Product docs, practitioner guides, and free tools on this site; onboarding and migration services; your own counsel or advisors run the program - Redaction — FOI Assist: Handled outside the tool | AccessPoint: Browser-native studio with statutory exemption tagging, fall-backs, and AI-proposed redactions - Video & audio redaction — FOI Assist: No video or audio redaction described in its published documentation | AccessPoint: Native: box, blur, pixelate, mute, bleep, and voice distortion on body-worn, CCTV, 911 audio, and Teams recordings, with the exemption on every span, in-tenant face detection and tracking, transcript-anchored proposals, and a burned release with a hash manifest and a time-based redaction log — no per-seat add-on - Jurisdiction coverage — FOI Assist: Ontario (FIPPA/MFIPPA) | AccessPoint: 136 jurisdiction packs — Ontario included, plus federal ATIP, other provinces, US, EU, UK - Best-fit office size — FOI Assist: Small offices and solo coordinators | AccessPoint: Small teams through multi-department programs — flat pricing, no per-user fees - Scope — FOI Assist: Deadlines, guided workflows, compliant letters, online intake, and IPC statistics for Ontario FOI | AccessPoint: Access requests, plus PIAs, breach response, complaints, and a privacy risk register on the same platform when you need them Where FOI Assist fits (honest concessions): - You're a small Ontario institution — perhaps a solo coordinator — whose pain is deadlines, letters, and the IPC annual statistics, and records volumes are low enough to handle outside the tool. - Budget is the binding constraint and a lightweight subscription covers your genuine needs. - You value having a lawyer-practitioner behind the tool — someone who has run an FOI program and writes the guidance many Ontario coordinators already read. - You value the practitioner-built Ontario specificity — the workflows track FIPPA/MFIPPA closely, and the free knowledge base alone is worth knowing about. Q: How is AccessPoint different from FOI Assist? A: FOI Assist focuses on the administrative layer of Ontario FOI — deadlines, guided workflows, compliant letters, online intake, and the IPC annual statistical report — in a lightweight subscription hosted in Canada. AccessPoint runs inside your own Microsoft 365: records are collected from SharePoint and Outlook, redacted in the browser with exemption tagging, and reported from the same case data, with flat pricing published on the site and no per-user fees. Small Ontario offices legitimately choose FOI Assist; offices where document volume, privacy obligations, or multi-statute scope have become the job tend to need a platform. Q: Is FOI Assist only for Ontario? A: Yes — it's built specifically for Ontario institutions under FIPPA and MFIPPA, which is part of its appeal for that market. AccessPoint ships an Ontario jurisdiction pack with the same statutory specificity (deadlines, exemptions, fee rules, IPC reporting), plus 135 other packs covering federal ATIP, the other provinces, US FOIA and state laws, EU GDPR, and UK FOI — relevant if you're a shared service, a multi-jurisdiction organization, or simply want room to grow. Q: Where is FOI Assist's data hosted? A: In Canada. FOI Assist's privacy policy says the platform is hosted on Amazon Web Services infrastructure in Canada, including the Canada (Central) region, with client data intended to remain in Canadian AWS data centres. So residency isn't the dividing line here. The difference is whose environment it is: FOI Assist's cloud, or your own Microsoft 365 and Azure tenant, where AccessPoint runs under your existing identity and security controls and alongside the records themselves. Q: FOI Assist is built by a lawyer. Does that matter? A: It's a genuine strength. Justin Petrillo has practised law for more than fifteen years, ran the Toronto 2015 Games' FOI program, and publishes a free knowledge base and seminar series that many Ontario coordinators rely on. If part of what you want from a vendor is that kind of practitioner judgment, ask him how far it extends beyond the software. AccessPoint is built by a software company: our jurisdiction packs are built from public information about each Act and are a starting point we expect your own legal counsel to validate, our guides document the reasoning, and we work alongside whichever counsel or consultants you already trust rather than replacing them. Q: We mainly struggle with deadlines and letters. Isn't a lighter tool enough? A: It might be — an honest vendor says so. If your volumes are low and records review is manageable by hand, a deadline-and-letters tool solves your actual problem. The threshold to watch: when document collection, redaction, Bill 194 PIAs, or breach response start consuming your week, those are platform problems, and solving them piecemeal (a redaction tool here, a spreadsheet risk register there) costs more than one system that runs it all. Q: Does AccessPoint produce the IPC annual statistical report like FOI Assist does? A: Yes. FOI Assist automates the annual statistical report submitted to the IPC from the file data already in the system; AccessPoint generates the same report from the Ontario jurisdiction pack's templates, using the case data you process day to day, alongside operational dashboards and Report Studio for everything the statute doesn't ask but your leadership does. Q: Can we start with FOI Assist and move to AccessPoint later? A: Yes, and the path is clean: export your request history to Excel, map it into AccessPoint's tenant-generated import template, validate per row before anything imports, and keep your original file numbers as legacy references. Imported records arrive historical with full audit provenance. Portability works in both directions — AccessPoint's one-click export means you're never locked in here either. ### AccessPoint vs. iCasework (Civica (iCasework, founded 1998, acquired October 2018)) URL: https://www.realizer.io/compare/icasework — facts last reviewed 2026-09-03 Verdict: iCasework is a serious, actively sold product and very plausibly the most widely deployed information-governance case system in UK local government: FOI, EIR, subject access, data incidents, complaints and member enquiries in one place, delivered as on-demand SaaS and bought through G-Cloud. The decision against AccessPoint is not old versus new — it is architecture and scope. iCasework holds your casework, and the documents under review, in Civica's cloud, and covers a wide spread of council case types. AccessPoint runs inside your own Microsoft 365 and Azure tenant, searches the records where they already live, and carries the privacy side of the mandate — DPIAs, breach response with a live notification calculator, an Article 30 record of processing and a risk register — on the same audit ledger as the requests. iCasework fact sheet: - Product: Civica Case Management, powered by iCasework — marketed as Civica Information Governance - Vendor lineage: iCasework founded 1998; acquired by Civica in October 2018 - Deployment: On-demand SaaS in the vendor's cloud; listed on G-Cloud - Case types: FOI, EIR, DPA / UK GDPR personal information requests, data incidents, public record requests, law-enforcement disclosure, complaints, member and councillor enquiries, safeguarding and social care - Scale (vendor's figures): Civica cites 200+ customers worldwide, 6 million+ cases processed a year, and 25+ years in the market - Status: Actively developed and sold; publicly identifiable adopters include the London Borough of Barnet (April 2022) and Liverpool City Council Side by side: - Where your data lives — iCasework: Civica's cloud, delivered as on-demand SaaS | AccessPoint: Your own Microsoft 365 and Azure tenant — no third-party cloud and no vendor access to your records - Records collection — iCasework: Documents brought into the platform | AccessPoint: Searched and pulled straight from SharePoint, OneDrive, Outlook and Teams, where council records already sit - Breadth of case types — iCasework: Wider — safeguarding, social care, member and councillor enquiries alongside information governance | AccessPoint: Focused on the access and privacy mandate; complaints and appeals mean information-rights challenges, not social care casework - Privacy programme — iCasework: Data incidents handled as another case type | AccessPoint: Breach response with a live notification calculator, DPIAs and AIAs, an Article 30 record of processing, and an ISO 31000 risk register - Statutory configuration — iCasework: Configured per customer during implementation | AccessPoint: 136 jurisdiction packs — the FOIA section 10 twenty-working-day clock, the EIR regulation 7 extension to 40, the UK GDPR one-month subject access clock, exemptions and correspondence templates preloaded, with fee schedules already quoted in £ and the fiscal year set to your convention - Redaction — iCasework: Within the platform | AccessPoint: Browser-native redaction studio with primary and fall-back exemption tagging, find-and-redact across a set, and optional AI-proposed redactions a person approves - Video & audio redaction — iCasework: No video or audio redaction described in its published documentation | AccessPoint: Native: box, blur, pixelate, mute, bleep, and voice distortion on body-worn, CCTV, 911 audio, and Teams recordings, with the exemption on every span, in-tenant face detection and tracking, transcript-anchored proposals, and a burned release with a hash manifest and a time-based redaction log — no per-seat add-on - Audit trail — iCasework: Application audit logging | AccessPoint: Append-only, hash-chained ledger across every module, with court-ready case audit exports - Pricing — iCasework: Quoted, with pricing documents published per G-Cloud service | AccessPoint: Flat annual USD $2,990 / $7,990 / $14,990 by organisation size, no per-user fees, billed through the Microsoft commercial marketplace Where iCasework fits (honest concessions): - Your council wants one system for information governance and everything beside it — complaints, member and councillor enquiries, safeguarding, social care. That breadth is genuinely wider than AccessPoint, which stops at the access and privacy mandate. - Vendor-hosted SaaS suits your assurance posture and you would rather not deploy or bill Azure resources in your own tenant's subscription. AccessPoint deliberately requires that you do. - You already run other Civica systems and value a single supplier relationship, a familiar procurement route through G-Cloud, and a long list of UK council references you can call. Q: Who owns iCasework? A: Civica. iCasework was founded in 1998 as an independent case-management specialist and was acquired by Civica in October 2018, reported at the time as a move to bolster Civica's GDPR and information-governance capability. It is sold today as Civica Case Management, powered by iCasework, within the Civica Information Governance line. Q: Is iCasework really used by 95% of UK local authorities? A: No — that figure is a Civica-wide claim covering the company's entire product portfolio across housing, revenues, social care, education and more, and the related police-force figure works the same way. Neither is an iCasework or FOI-specific adoption number. Civica's own published figures for the case-management product are more than 200 customers worldwide and over 6 million cases processed a year. iCasework is still very plausibly the most widely deployed information-governance case system in UK local government; just ask any vendor, including us, for reference counts for the actual product you are buying. Q: How is AccessPoint different from iCasework? A: Three structural differences. Architecture: iCasework is on-demand SaaS in Civica's cloud, while AccessPoint deploys into your own Microsoft 365 and Azure tenant and searches SharePoint, OneDrive, Outlook and Teams directly rather than having documents uploaded to a vendor. Scope: both handle FOI, EIR and subject access together, but AccessPoint also runs DPIAs and algorithmic impact assessments, breach response with a live statutory notification checklist, an Article 30 record of processing, and an ISO 31000 risk register on the same hash-chained audit ledger. Commercials: AccessPoint's pricing is flat, annual and published, with no per-user fees. In the other direction, iCasework covers council case types AccessPoint does not touch — safeguarding, social care and member enquiries. Q: Will new case management software fix our FOI compliance? A: Not on its own, and it would be dishonest to claim otherwise. mySociety's independent research into UK local-government FOI found no correlation between having a case-management system and better performance against the statutory deadline — process, staffing and how quickly service areas return records matter at least as much. What software can do is remove the failure modes you control: computing the twenty-working-day date on the UK bank-holiday calendar, reminding owners before a case ages, making the public-interest test a recorded step rather than an email, and showing a manager the whole queue on one screen. Buy it for that, and fix the process alongside it. Q: Can we migrate our iCasework history into AccessPoint? A: Yes. Any iCasework report that reaches Excel can be mapped into AccessPoint's tenant-generated import template — historical and in-progress cases keep their old references as legacy references, requestor contacts import alongside them, and case documents stage through your own tenant's Azure storage with optional hash verification. Because imported records arrive with their status, due dates and documents intact, cases that are still running simply continue: no cutover, no notification storm, nothing recomputed, and an Imported entry on every record's audit trail. ### AccessPoint vs. eCase (Fivium Ltd, London) URL: https://www.realizer.io/compare/ecase — facts last reviewed 2026-09-03 Verdict: eCase owns UK central government. The Home Office, DWP, the Ministry of Defence, the Cabinet Office, HMRC, DEFRA and HM Treasury are named customers, and Fivium cites more than 50 public sector organisations in total. Its scope is genuinely broader than ours in one direction: eCase runs ministerial and private-office correspondence alongside FOI, EIR and subject access, and that depth is its own. If the ministerial correspondence machine is the heart of your case load, eCase is built for that and this comparison should end there. Parliamentary Questions, often assumed to be the same dividing line, are not — AccessPoint handles PQs as a purpose-configured request type with their own clocks and reporting, shipped as the Order Paper type in the Canadian pack and configurable for a UK department. Where AccessPoint differs is architecture and the privacy half of the mandate: it runs inside your own Microsoft 365 and Azure tenant rather than the vendor's cloud, collects records from where they already live, and carries DPIAs, breach response, complaints and a risk register on the same audit ledger as the requests. eCase fact sheet: - Product: eCase — case management for FOI, EIR, subject access, complaints, correspondence, ministerial correspondence and Parliamentary Questions - Vendor: Fivium Ltd, London (fivium.co.uk); product site ecase.co.uk - Deployment: Cloud SaaS, UK-hosted; listed on G-Cloud - Named customers: Home Office, DWP, Ministry of Defence, Cabinet Office, HMRC, DEFRA, HM Treasury; North Lincolnshire Council, Hampshire County Council, Herefordshire; police forces - Scale (vendor's figure): Fivium cites 50+ public sector organisations using eCase - Outcome claims (vendor's figures): Fivium claims an average saving of 52 minutes per case, case logging 3x faster at DWP, 70,000 hours a year saved at the MOD, and 63.25% less time per data protection request at North Lincolnshire Side by side: - Parliamentary Questions — eCase: Purpose-built workflows and a core strength of the product | AccessPoint: Handled as a configured request type with its own clocks and reporting — shipped as the Order Paper type in the Canadian pack, configurable for a UK PQ process - Ministerial & private-office correspondence — eCase: A first-class workflow built around private-office practice — the product's own depth | AccessPoint: Not our focus. If this dominates your case load, eCase is built for it and AccessPoint is not - Where your data lives — eCase: Fivium's UK-hosted cloud | AccessPoint: Your own Microsoft 365 and Azure tenant — no third-party cloud and no vendor access to your records - Records collection — eCase: Documents brought into the platform | AccessPoint: Searched and pulled straight from SharePoint, OneDrive, Outlook and Teams, with an intake mailbox message becoming a request in one step - Privacy programme — eCase: FOI, EIR, subject access, complaints and correspondence casework | AccessPoint: The same request types plus DPIAs and algorithmic impact assessments, breach response with a live notification calculator, an Article 30 record of processing, and an ISO 31000 risk register - AI assistance — eCase: Efficiency positioned through workflow and time-saving case studies | AccessPoint: Optional AI Assist running on Azure OpenAI in your own tenant's subscription — intake triage, grounded drafting that flags anything unverifiable rather than inventing it, and proposed redactions, all decided by a person - Redaction — eCase: Within the platform | AccessPoint: Browser-native redaction studio with primary and fall-back exemption tagging, find-and-redact across a set, and reusable redactions from earlier requests on the same document - Video & audio redaction — eCase: No video or audio redaction described in its published documentation | AccessPoint: Native: box, blur, pixelate, mute, bleep, and voice distortion on body-worn, CCTV, 911 audio, and Teams recordings, with the exemption on every span, in-tenant face detection and tracking, transcript-anchored proposals, and a burned release with a hash manifest and a time-based redaction log — no per-seat add-on - Statutory configuration — eCase: Configured per customer during implementation | AccessPoint: 136 jurisdiction packs — the FOIA section 10 twenty-working-day clock, the section 12 cost limit, the EIR regulation 7 extension to 40, and the UK GDPR one calendar-month subject access clock, preloaded - Pricing — eCase: Quoted, with pricing documents published per G-Cloud service | AccessPoint: Flat annual USD $2,990 / $7,990 / $14,990 by organisation size, no per-user fees, billed through the Microsoft commercial marketplace Where eCase fits (honest concessions): - Your case load is dominated by ministerial and private-office correspondence rather than information rights. That is eCase's core and its depth there is genuine — the clearest reason on this page to choose the other product. - You want the vendor with the deepest Whitehall footprint. When the Home Office, DWP, the MOD, the Cabinet Office and HMRC all run the same system, peer practice, shared templates and G-Cloud procurement all point the same way, and that has real value. - Vendor-hosted UK cloud suits your assurance posture and you would rather not deploy or bill Azure resources in your own tenant's subscription. AccessPoint deliberately requires that you do. Q: What is eCase and who uses it? A: eCase is case-management software from Fivium Ltd of London, used across UK central government for FOI and EIR requests, subject access and data protection requests, complaints, correspondence, ministerial correspondence and Parliamentary Questions. Named customers include the Home Office, DWP, the Ministry of Defence, the Cabinet Office, HMRC, DEFRA and HM Treasury, along with councils such as North Lincolnshire, Hampshire County Council and Herefordshire and a number of police forces; Fivium cites more than 50 public sector organisations in total. It is delivered as UK-hosted cloud software and listed on G-Cloud. Q: Does AccessPoint handle Parliamentary Questions and ministerial correspondence? A: Parliamentary Questions, yes — as a purpose-configured request type with its own intake, clocks and reporting, the same engine that runs access requests. The Canadian jurisdiction pack ships this as the Order Paper question type, and the equivalent can be configured for a UK department's PQ process. Ministerial and private-office correspondence is the honest distinction: eCase carries that as a first-class workflow built around how private offices actually work, and that depth is its own. So the fair summary is that PQs are covered on both sides, and if your case load is dominated by ministerial correspondence rather than information rights, eCase is built for that and we are not going to claim otherwise. Q: How does AccessPoint compare to eCase? A: Two structural differences, plus one honest concession. Architecture: eCase is vendor-hosted UK cloud, while AccessPoint deploys into your own Microsoft 365 and Azure tenant and searches SharePoint, OneDrive, Outlook and Teams directly rather than having documents uploaded to a vendor. Scope on the privacy side: AccessPoint adds DPIAs, algorithmic impact assessments, breach response with a live statutory notification checklist, an Article 30 record of processing and an ISO 31000 risk register on the same hash-chained audit ledger. The concession: eCase's scope is broader on the correspondence side, and its ministerial and private-office correspondence workflows are its own. Parliamentary Questions, often assumed to be the dividing line, are covered on both sides — AccessPoint runs them as a configured request type with their own clocks and reporting. Q: Are Fivium's time-saving figures reliable? A: They are vendor case-study figures — an average of 52 minutes saved per case, case logging three times faster at DWP, 70,000 hours a year at the MOD, 63.25% less time per data protection request at North Lincolnshire — and they should be read as the vendor's own claims, ours included when we make them. The wider evidence counsels humility: mySociety's independent research into UK local-government FOI found no correlation between having a case-management system and better performance against the statutory deadline. Software removes the failure modes you control — the clock, the reminders, the handoffs, the search — but process and staffing decide the rest. Ask any vendor how a figure was measured, over what period, and against what baseline. Q: Can we migrate our eCase history into AccessPoint? A: Yes, and it can be a partial migration if you are keeping eCase for the private-office workflows. Any eCase report that reaches Excel maps into AccessPoint's tenant-generated import template — historical and in-progress cases keep their old references as legacy references, requestor contacts import alongside them, and case documents stage through your own tenant's Azure storage with optional hash verification. Imported records arrive with their status, due dates and documents intact, so open cases continue with no cutover, no notifications and nothing recomputed, each carrying an Imported entry in the audit trail. ### AccessPoint vs. Workpro (Computer Application Services Ltd (CAS), Edinburgh) URL: https://www.realizer.io/compare/workpro — facts last reviewed 2026-09-03 Verdict: Workpro is a well-built, credible product from a long-established Scottish software house, and its reference list is unusual: the Office of the Scottish Information Commissioner, the Local Government and Social Care Ombudsman, the Public Services Ombudsman for Wales and other oversight bodies run their casework on it. It is also one of very few UK FOI products still available on-premise as well as SaaS, which is often the reason it makes a shortlist. The comparison comes down to what control means and how far the platform reaches. Workpro's answer to control is a deployment choice — their data centre or your servers. AccessPoint's answer is tenant residency: it deploys into the Microsoft 365 and Azure environment you already run, collects records from where they live, and carries DPIAs, breach response, complaints and a privacy risk register alongside the requests. Workpro fact sheet: - Product: Workpro Requests – FOI, EIR and DPA case management software - Vendor: Computer Application Services Ltd (CAS), Edinburgh — writing software since 1969, employee-owned since 2014 - Deployment: SaaS from UK data centres described as ISO 27001 certified, or on-premise on your own infrastructure - Case types: FOI, EIR, and DPA / UK GDPR subject access requests — subject access bundled with FOI - Named customers: Office of the Scottish Information Commissioner, Local Government and Social Care Ombudsman, Public Services Ombudsman for Wales, Scottish Legal Complaints Commission, Housing Ombudsman Services, Patient Ombudsman (Ontario) - Procurement: Listed on G-Cloud, the Crown Commercial Service framework most UK public bodies buy through Side by side: - Where your data lives — Workpro: Your choice — CAS-hosted SaaS in UK data centres, or on-premise on servers you run and maintain | AccessPoint: Your own Microsoft 365 and Azure tenant — cloud you already govern, with no servers to provision, patch or back up - Records collection — Workpro: Documents brought into the case system | AccessPoint: Searched and pulled straight from SharePoint, OneDrive, Outlook and Teams, with an intake mailbox message becoming a request in one step - Video & audio redaction — Workpro: No video or audio redaction described in its published documentation | AccessPoint: Native: box, blur, pixelate, mute, bleep, and voice distortion on body-worn, CCTV, 911 audio, and Teams recordings, with the exemption on every span, in-tenant face detection and tracking, transcript-anchored proposals, and a burned release with a hash manifest and a time-based redaction log — no per-seat add-on - Scope — Workpro: FOI, EIR and DPA subject access request handling in one system | AccessPoint: The same three, plus DPIAs and algorithmic impact assessments, breach response with a live notification calculator, complaints and appeals, and an ISO 31000 privacy risk register - Regulator-side casework — Workpro: Deep experience with oversight bodies — several UK commissioners and ombudsmen run their casework on it | AccessPoint: Built for the authority side: requests, assessments, breaches, and the complaints and appeals an authority answers - Scotland — Workpro: An Edinburgh vendor with a long Scottish track record; the Scottish Information Commissioner's own office is a customer | AccessPoint: UK jurisdiction packs cover UK FOIA, EIR and the UK GDPR — Scotland runs under the separate FOISA 2002 regime, so ask us about current pack coverage before you assume it fits - Statutory configuration — Workpro: Configured per customer during implementation | AccessPoint: 136 jurisdiction packs — the FOIA section 10 twenty-working-day clock, the EIR regulation 7 extension to 40, the UK GDPR one calendar-month subject access clock, exemptions and letters preloaded - Audit trail — Workpro: Application audit logging | AccessPoint: Append-only, hash-chained ledger across every module, with court-ready case audit exports - Pricing — Workpro: Quoted, with pricing documents published per G-Cloud service | AccessPoint: Flat annual USD $2,990 / $7,990 / $14,990 by organisation size, no per-user fees, billed through the Microsoft commercial marketplace Where Workpro fits (honest concessions): - You genuinely require an on-premise deployment on infrastructure you own. Workpro is one of very few UK information-rights products that still offers it, and AccessPoint has no on-premise edition — it deploys into your Microsoft 365 and Azure tenant instead. - You are a Scottish public authority working to FOISA 2002 and the Scottish Information Commissioner. CAS is an Edinburgh company with a long Scottish record and the Commissioner's own office as a customer; AccessPoint's UK packs are built around UK FOIA, so talk to us about current FOISA coverage rather than assuming it. - You are an ombudsman, commissioner or complaints-handling body rather than a public authority answering requests. That is Workpro's home ground, and its reference list is your peer group. Q: What is Workpro and who makes it? A: Workpro is case-management software from Computer Application Services Ltd (CAS), an Edinburgh company writing software since 1969 and employee-owned since 2014. Its information-rights service is listed on G-Cloud as Workpro Requests – FOI, EIR and DPA case management software, handling freedom of information, environmental information and data protection subject access requests in one system. Q: Who uses Workpro? A: Its published customers are notable because so many of them are oversight bodies: the Office of the Scottish Information Commissioner, the Local Government and Social Care Ombudsman for England, the Public Services Ombudsman for Wales, the Scottish Legal Complaints Commission, Housing Ombudsman Services, and Patient Ombudsman in Ontario. If the regulator who would review your casework runs the same system, that is a fair point in the product's favour and worth weighing honestly. Q: Workpro can be installed on-premise. Can AccessPoint? A: No, and that is a genuine difference rather than something to talk around. AccessPoint has no on-premise edition. What it has instead is tenant residency: it deploys into your own Microsoft 365 and Azure tenant from a one-click Bicep or ARM template, so requests, documents, assessments and audit history stay inside the environment your organisation already secures with Entra ID, Defender, Purview and Sentinel, and the publisher has no runtime access to it. If your requirement is specifically physical servers in your own building, Workpro's on-premise option is one of the few remaining in this market and AccessPoint will not meet it. Q: Does AccessPoint cover Scotland and FOISA? A: AccessPoint's UK jurisdiction packs are built around the Freedom of Information Act 2000, the Environmental Information Regulations 2004 and the UK GDPR with the Data Protection Act 2018. Scotland runs under a separate statute, the Freedom of Information (Scotland) Act 2002, with its own regulator, so please check current pack coverage for Scotland with us rather than assuming either way — we would rather tell you plainly than sell you a fit that is not there. Scottish authorities also handle EIR and UK GDPR subject access, which the UK packs do cover. Q: Can we migrate our Workpro history into AccessPoint? A: Yes. Any Workpro report that reaches Excel maps into AccessPoint's tenant-generated import template — historical and in-progress cases keep their old references as legacy references, requestor contacts import alongside them, and case documents stage through your own tenant's Azure storage with optional hash verification. Imported records arrive with their status, due dates and documents intact, so open cases continue with no cutover, no notifications and nothing recomputed, each carrying an Imported entry in the audit trail. ### AccessPoint vs. OneTrust (OneTrust, LLC (founded 2016, Atlanta)) URL: https://www.realizer.io/compare/onetrust — facts last reviewed 2026-09-03 Verdict: OneTrust is the category leader in privacy software and earned it: consent and preference management at web scale, automated consumer privacy-rights (DSAR) fulfilment, third-party risk, and now AI governance, with more than 14,000 mostly commercial customers and the top IDC market-share ranking. If that is the program you run, it's the safe choice — and AccessPoint doesn't pretend to replace it. AccessPoint is built for a different desk: the public body's access-and-privacy office, where requests carry business-day clocks and deemed-refusal consequences, records are severed under exemption codes, and the year ends in a statutory annual report — all of it running inside your own Microsoft 365 tenant, with flat published pricing instead of a per-module quote. OneTrust fact sheet: - Product: OneTrust platform — Consent & Preferences, Privacy Automation (incl. DSR automation and DataGuidance), Third-Party Management, Tech Risk & Compliance, Data Use Governance, AI Governance - Vendor lineage: OneTrust, LLC — founded 2016 in Atlanta by Kabir Barday; $1B+ raised, valued at $4.5 billion (July 2023) - Deployment: Vendor-hosted cloud SaaS in OneTrust's environments; regional hosting options, including EU data-residency environments - Market: Commercial enterprises worldwide — OneTrust cites 14,000+ customers; IDC ranked it #1 in data-privacy software market share (2023, fourth consecutive year) - Certifications (per OneTrust's Trust Center): ISO/IEC 27001, 27701, 27017, ISO 9001, SOC 2 Type II, PCI DSS, HITRUST, TISAX, TX-RAMP - Status: Actively developed and sold; the category leader in enterprise privacy software. A 2021 FOIA/public-records offering no longer appears in the current product lineup Side by side: - Built for — OneTrust: Commercial enterprise privacy, risk, and AI-governance programs | AccessPoint: The public-sector access-and-privacy office — FOI/ATIP requests plus the privacy program around them - Access / FOI requests — OneTrust: Not in the current product line — a 2021 government records offering is no longer marketed | AccessPoint: Full statutory lifecycle: business-day clocks, extensions and holds, automatic deemed-refusal recording, custodian collection with attestations, disclosure packages - Privacy rights / DSAR — OneTrust: Deep — automated intake, identity verification, personal-data discovery, and secure response at consumer scale | AccessPoint: Handled as statutory access and correction request types under your public-sector statute — sized for an office's caseload, not millions of consumer requests - Assessments — OneTrust: PIA/DPIA automation with templated assessments, data mapping, and ROPA | AccessPoint: PIA and AIA engine with screeners, section delegation to experts, an embedded risk register, Article 30 ROPA, and regulator-ready exports - Where your data lives — OneTrust: OneTrust's cloud (regional hosting options) | AccessPoint: Your own Microsoft 365 and Azure tenant — no third-party cloud, no vendor access - Statutory configuration — OneTrust: Generic workflows configured per program, backed by the DataGuidance regulatory library | AccessPoint: 136 jurisdiction packs preloading deadlines, exemption catalogues, fee schedules, business-day calendars, letters, and annual-report templates - Redaction — OneTrust: Automated redaction aimed at personal data in DSAR responses | AccessPoint: Browser-native severing studio with primary and fall-back statutory exemption tags, find-and-redact, and an exemption manifest in the disclosure package - Video & audio redaction — OneTrust: Document-focused DSAR redaction; no video or audio redaction described in its published documentation | AccessPoint: Native: box, blur, pixelate, mute, bleep, and voice distortion on body-worn, CCTV, 911 audio, and Teams recordings, with the exemption on every span, in-tenant face detection and tracking, transcript-anchored proposals, and a burned release with a hash manifest and a time-based redaction log — no per-seat add-on - Pricing — OneTrust: Custom quote, per module; no published pricing | AccessPoint: Flat annual USD $2,990 / $7,990 / $14,990 by organization size, published on the site, no per-user or per-module fees Where OneTrust fits (honest concessions): - You're a commercial enterprise running consent banners, preference management, and consumer privacy-rights requests at scale — thousands or millions of data subjects across web and mobile properties. That is exactly what OneTrust was built for, and nothing in AccessPoint competes with it. - Your privacy program is enterprise GRC: hundreds of vendors to assess, data mapping across a sprawling estate, tech-risk and compliance automation, and an AI inventory to govern — with the budget and team an enterprise platform assumes. - Your organization already licenses OneTrust enterprise-wide and your only rights workload is consumer DSARs under CCPA-style laws — you don't process statutory FOI/ATIP requests as a public body. Q: Does OneTrust handle FOI, ATIP, or public-records requests? A: Not in its current product lineup. OneTrust announced a Government Records Request Automation offering for US FOIA, the Privacy Act, and state public-records requests in July 2021, but the products OneTrust markets today are consent and preferences, privacy automation (including consumer data-subject-request automation and the DataGuidance library), third-party management, tech risk and compliance, data use governance, and AI governance. Its request automation is built for consumer privacy rights — identity verification, data discovery, deletion — not statutory FOI processing: there are no deemed-refusal clocks, no severing with exemption tagging and public-interest tests, no fee estimates, and no statutory annual reporting. If a vendor pitches a privacy suite for your FOI desk, ask to see those four things demonstrated. Q: How is AccessPoint different from OneTrust? A: Three structural differences. Scope: OneTrust is built for commercial privacy compliance — consent, consumer DSARs, vendor risk — while AccessPoint is built for public-sector statutory work: FOI/ATIP request processing end to end, plus PIAs, algorithmic impact assessments, breach response with a live notification calculator, complaints, and an ISO 31000 risk register on one hash-chained audit ledger. Architecture: OneTrust hosts your data in its own cloud environments; AccessPoint deploys into your own Microsoft 365 and Azure tenant and collects records straight from SharePoint, Outlook, and Teams. Commercials: OneTrust is quoted per module with no published pricing; AccessPoint is flat annual, published on the site, with no per-user fees. Q: Isn't a DSAR the same thing as an FOI request? A: They overlap at intake and diverge everywhere else. A DSAR is an individual asking for their own personal data — the work is identity verification, finding that person's data, and redacting other people's. An FOI request is anyone asking for any record a public body holds — the work is scoping, custodian searches, severing under statutory exemptions with public-interest balancing, third-party consultations, fees, and a response clock whose expiry is a deemed refusal you can be taken to a commissioner over. AccessPoint handles subject access and correction as request types under your public-sector statute, on the same clocks, exemptions, and audit ledger as FOI — which is how an access-and-privacy office actually runs them. Q: Can we run OneTrust and AccessPoint together? A: Yes, and for larger public bodies that's often the right answer rather than a compromise. Keep OneTrust for what it leads in — website consent and preference management, enterprise vendor risk, corporate compliance automation — and run the access-and-privacy office on AccessPoint: FOI/ATIP requests, PIAs and AIAs, breach response, complaints, and the risk register, inside your own tenant. The boundary is clean because the caseloads barely overlap; the one seam to decide is where subject-access requests land, and for public bodies that's usually AccessPoint, where the statutory clocks and exemptions live. Q: What does OneTrust do that AccessPoint doesn't? A: A fair amount, and it's worth being plain about. AccessPoint has no consent or cookie-banner management, no preference center, and no marketing-consent syncing — if you need those, OneTrust is the category leader. OneTrust's third-party risk management operates at an enterprise scale AccessPoint doesn't attempt; AccessPoint's vendor register tracks your processors' DPA status, review cadence, and risk level, but it is a register, not a due-diligence exchange. OneTrust also fields polished self-service intake portals for privacy-rights requests, and AccessPoint's public requester portal is still on the roadmap — today, intake runs through your team, including a New-from-email flow that turns an intake-mailbox message into a formed request in one step. ### AccessPoint vs. Veritone Redact (Veritone, Inc.) URL: https://www.realizer.io/compare/veritone-redact — facts last reviewed 2026-09-04 Verdict: Veritone Redact is a mature, vendor-hosted AI redaction application for audio, video and image evidence, used by a large base of US public-safety agencies and resold as an integration by FOI request platforms such as JustFOIA and OPEXUS FOIAXpress. If your office already licenses one of those platforms and is content to send footage out to Veritone's cloud for processing, it is a credible way to add automated head and plate masking. AccessPoint's difference is where the work happens and what survives it: the recording never leaves your tenant, every mark carries the exemption it relies on, and the burned release, its hash manifest and a time-based redaction log stay in the same request file as the paper records — with no separate seat licence. Veritone Redact fact sheet: - Product: Veritone Redact — AI redaction for audio, video, image and (since July 2026) document files, plus an optional Redaction Managed Service - Vendor: Veritone, Inc. - Form factor: Vendor-hosted web application, part of Veritone's public-sector suite; also embedded in FOI request platforms as an integration - Processing location: Veritone's cloud; its public-sector materials describe CJIS-compliant cloud hosting. A specific region, government-cloud option or customer-tenant deployment is not described in its published documentation - Pricing model: Not described in its published documentation; sold directly and through FOI platform integrations - Notable customers and integrations: More than 300 government agencies (vendor claim); California Highway Patrol (multi-year contract, June 2026); US Department of Veterans Affairs (representative customer in OPEXUS materials); integrations with MCCi JustFOIA (August 2026) and OPEXUS FOIAXpress Side by side: - Where the footage is processed — Veritone Redact: Uploaded to Veritone's cloud — directly or through the request platform's integration. Veritone describes CJIS-compliant cloud hosting; region and sovereignty options are not described in its published documentation | AccessPoint: Inside your own Microsoft 365 and Azure tenant. Face detection runs on your App Service with no outside call; on-screen text detection and transcription use Azure AI Document Intelligence and Azure AI Speech deployed in your tenant. The original recording is never modified - Detection: faces, plates, on-screen text — Veritone Redact: Automatic detection of human heads, licence plates and mobile data terminals, with user-defined objects for anything else; Veritone's CHP announcement also cites faces, medical information and driver's licence numbers | AccessPoint: In-tenant face detection with stabilised tracking (one proposed tracked mark per person) and on-screen text via frame OCR against your detection patterns — a licence plate, a name badge, a case number on a monitor — each proposal carrying a rule citation. No dedicated plate, head or body detector; anything else is drawn once and tracked automatically - Audio: mute, bleep, voice distortion — Veritone Redact: Automatic detection of sensitive speech and PII; product page describes voice masking and multilingual transcription. Which obscuring effects are available per span is not itemised in its published documentation | AccessPoint: Mute, bleep and voice distortion (pitch-shifted so every word stays audible) can be combined on one recording, each span with its own exemption — the severance Ontario's IPC has ordered in place of removal - Transcript-anchored marks — Veritone Redact: Time-synced transcripts are part of the product; the Escondido PD case study describes time-correlated transcription of sensitive content | AccessPoint: Time-coded, speaker-labelled transcript; Find & redact, detection rules and the AI pass propose Mute marks over the spoken span for you to accept or dismiss. Needs Azure AI Speech deployed in your tenant - Link to the request and the exemption cited — Veritone Redact: The FOI-platform integrations describe a one-click round trip of the file. Whether a per-span legal justification travels back into the request file's own withholding record is not described in the published integration materials | AccessPoint: Every mark — region, audio span or whole-record withhold — carries the exemption, alternates, comments, flags and approval like a page redaction, the in-frame caption can show it, and the request's redaction log lists each span with its effect and exemption - Audit log and release record — Veritone Redact: Detailed logs, chain-of-custody records and downloadable audit trails, held in Veritone's application | AccessPoint: Hash-chained, append-only audit ledger in the request file; each release carries a MANIFEST.sha256 of every entry, a Redaction Index and a "How this release was prepared" statement that counts manual, rule-proposed, model-proposed and propagated marks - Formats and the burned release — Veritone Redact: Audio, video and image files are supported; the redacted file is returned to the agency or the request platform. Accepted formats, size limits and the shape of the released file are not described in its published documentation | AccessPoint: Uploads up to 2 GB by default in resumable blocks; the release renders MP4 / MP3 with marks burned in and a record-label caption, packaged in the same ZIP as the PDFs. Per-audience release variants are stored as exclusions, so a new mark applies to every cut by default - Integration with request platforms — Veritone Redact: Integrations announced with MCCi JustFOIA (August 2026) and OPEXUS FOIAXpress; the request lives in one system and the redaction in another | AccessPoint: AccessPoint is the request platform: recordings are documents on the request, added from the Documents tab or Teams meeting recordings, and the release decision feeds the Contents page, the redaction log and the statistics - Pricing model — Veritone Redact: Not described in its published documentation; typically an additional licence alongside the request platform | AccessPoint: Flat annual subscription by organization size, published on the site and billed through the Microsoft commercial marketplace — no per-user, per-seat or per-minute fees, and video and audio redaction is included Where Veritone Redact fits (honest concessions): - Your office already runs JustFOIA or FOIAXpress, the Veritone integration is licensed, and staff are comfortable with footage being processed in Veritone's cloud. - You want automated masking of heads and licence plates across a high volume of body-worn footage today, and a US-hosted, CJIS-aligned vendor cloud satisfies your security review. - You would rather outsource the work entirely — Veritone's Redaction Managed Service is an option AccessPoint does not offer. - Your redaction workload is mostly evidence preparation for prosecution rather than access-to-information releases, so a link to the request file and its exemption catalogue matters less. Q: What is Veritone Redact? A: Veritone Redact is Veritone's AI-assisted application for redacting sensitive material from audio, video, image and — since July 2026 — document evidence. Veritone's documentation describes it detecting human heads, licence plates and mobile data terminals, letting users define other objects to mask, producing time-synced transcripts with voice masking, and keeping detailed logs, chain-of-custody records and downloadable audit trails. It is sold to agencies directly, through a managed redaction service, and as an integration inside FOI request platforms such as JustFOIA and FOIAXpress. Q: Is there a Veritone Redact alternative that keeps footage in our own tenant? A: Yes. AccessPoint runs video and audio redaction inside your own Microsoft 365 and Azure tenant: the face detector runs on your App Service without calling an outside service, on-screen text detection and transcription use Azure services deployed in your tenant, and the original recording is never modified. There is no second vendor cloud in the chain of custody, and there is no separate seat licence — video and audio redaction is part of the platform. Q: Does AccessPoint detect faces and licence plates automatically like Veritone Redact? A: AccessPoint detects faces in-tenant and proposes one tracked mark per person for you to accept or dismiss, and reads on-screen text with frame OCR so a licence plate, a name badge or a case number on a monitor becomes a proposal carrying a rule citation. It does not ship a dedicated licence-plate, head or body detector; a subject seen from behind is drawn once and then tracked automatically in both directions. Every proposal is a suggestion until a reviewer accepts it — nothing is applied silently. Q: Our request platform already integrates with Veritone. Why would we change? A: The integration sends the recording out and brings a redacted file back. What it does not do, in the published integration materials, is carry a per-span legal justification into the request file's own withholding record. In AccessPoint the mark, its exemption and alternates, its approval, the burned caption, the release package and the time-based redaction log are one record that never crosses a vendor boundary — which is what a regulator or a requester challenging the severance will ask to see. Q: How does AccessPoint handle voice distortion compared with Veritone Redact? A: Veritone's product page describes voice masking as part of its audio capability. AccessPoint offers Mute, Bleep and Distort voice as effects on any audio span: Distort pitch-shifts the span so the speaker cannot be identified while every word stays audible, which is the severance the Ontario IPC has ordered in place of removal and one of the obscuring methods Washington's public-records fee statute lists. The three effects can be combined on the same recording, and the redaction log records the effect and exemption for each span. ### AccessPoint vs. Axon Redaction (Axon Enterprise, Inc.) URL: https://www.realizer.io/compare/axon-redaction — facts last reviewed 2026-09-04 Verdict: Axon's redaction capability is two things: Redaction Studio, the manual redaction editor that is part of Axon Evidence, and Redaction Assistant, a paid AI add-on inside Studio that masks heads, licence plates and screens and lets staff redact audio by clicking words in a transcript. For an agency whose body-worn footage already lives in Axon Evidence, redacting it there is the path of least resistance, and Axon has added agency-configured exemption codes and an exemption log to the workflow. AccessPoint's difference is scope and location: it is the access-request system rather than the evidence vault, it runs inside your own tenant rather than Axon's cloud, and the mark, its exemption, the burned release, its hash manifest and the time-based redaction log stay in the request file beside the paper records — with no per-seat add-on for the AI assistance. Axon Redaction fact sheet: - Product: Axon Redaction Studio (part of Axon Evidence) and Axon Redaction Assistant (paid AI add-on within Studio) - Vendor: Axon Enterprise, Inc. - Form factor: Feature of the Axon Evidence cloud digital-evidence management system; no on-premise hardware - Processing location: Axon Evidence's cloud, which Axon describes as meeting CJIS requirements; its trust centre lists FedRAMP High, ISO/IEC 27001 and SOC 2. The hosting provider and region options are not described on those pages - Pricing model: Contact Axon for pricing programs and plans; Redaction Studio is part of Axon Evidence, Redaction Assistant is a paid add-on. Redaction is not listed among the components of Axon's AI Era Plan bundle - Notable integrations: Native to the Axon camera and Axon Evidence ecosystem; integration with FOI request platforms is not described in its published documentation Side by side: - Where the footage is processed — Axon Redaction: In Axon Evidence's cloud, where Axon camera footage already lives; Axon describes CJIS-aligned, encrypted cloud hosting and a full audit trail on every file action. Provider and region are not described in its published product pages | AccessPoint: Inside your own Microsoft 365 and Azure tenant. Face detection runs on your App Service with no outside call; on-screen text detection and transcription use Azure AI Document Intelligence and Azure AI Speech deployed in your tenant. The original recording is never modified - Detection: faces, plates, on-screen text — Axon Redaction: Redaction Assistant masks heads, licence plates and screens, lists every unique head in a thumbnail panel for selection, and tracks heads in and out of frame; bulk processing of up to 20 videos, with a two-hour video returned in about ten minutes (vendor figures). Studio adds a manual object tracker | AccessPoint: In-tenant face detection with stabilised tracking (one proposed tracked mark per person) and on-screen text via frame OCR against your detection patterns — a licence plate, a name badge, a case number on a monitor — each proposal carrying a rule citation. No dedicated plate, head or body detector; anything else is drawn once and tracked automatically in both directions - Audio: mute, bleep, voice distortion — Axon Redaction: Studio redacts audio PII manually and can select a single audio stream in multi-stream files; Assistant redacts words found in the transcript. Whether the released audio is muted, bleeped or pitch-shifted for a span is not described in its published documentation | AccessPoint: Mute, bleep and voice distortion (pitch-shifted so every word stays audible) can be combined on one recording, each span with its own exemption — the severance Ontario's IPC has ordered in place of removal - Transcript-anchored marks — Axon Redaction: With Redaction Assistant, search for or click any word in the transcript to redact it throughout the video | AccessPoint: Time-coded, speaker-labelled transcript; Find & redact, detection rules and the AI pass propose Mute marks over the spoken span for you to accept or dismiss. Needs Azure AI Speech deployed in your tenant - Link to the request and the exemption cited — Axon Redaction: Agency-configured exemption codes in a drop-down, assigned per mask from the redacted-objects panel; masks without a code are flagged. The access request itself lives in whatever system the records office uses | AccessPoint: Every mark — region, audio span or whole-record withhold — carries the exemption from the jurisdiction pack, alternates, comments, flags and approval like a page redaction, the in-frame caption can show it, and the request's redaction log lists each span with its effect and exemption - Audit log and release record — Axon Redaction: Axon Evidence records every view, edit and download on a file in its audit trail; an exemption log is generated automatically with the export of the redacted file. Whether each log entry carries the time span it applies to is not described in its published documentation | AccessPoint: Hash-chained, append-only audit ledger in the request file; each release carries a MANIFEST.sha256 of every entry, a Redaction Index and a "How this release was prepared" statement that counts manual, rule-proposed, model-proposed and propagated marks - Formats and the burned release — Axon Redaction: An export of the redacted file plus the exemption log; accepted formats, size limits and release packaging are not described in its published product pages | AccessPoint: Uploads up to 2 GB by default in resumable blocks; the release renders MP4 / MP3 with marks burned in and a record-label caption, packaged in the same ZIP as the PDFs. Per-audience release variants are stored as exclusions, so a new mark applies to every cut by default - Integration with request platforms — Axon Redaction: Native to Axon Evidence; the redacted file and log are exported and then handled in the records office's own request system | AccessPoint: AccessPoint is the request platform: recordings are documents on the request, added from the Documents tab or Teams meeting recordings, and the release decision feeds the Contents page, the redaction log and the statistics - Pricing model — Axon Redaction: Quoted through Axon sales; Studio is part of Axon Evidence, Redaction Assistant is a paid add-on | AccessPoint: Flat annual subscription by organization size, published on the site and billed through the Microsoft commercial marketplace — no per-user, per-seat or per-minute fees, and video and audio redaction is included Where Axon Redaction fits (honest concessions): - Your agency is standardized on Axon cameras and Axon Evidence, so the footage is already there and redacting it in place avoids a download-and-re-upload step. - Body-worn video is the bulk of your redaction workload and Redaction Assistant's head, plate and screen masking with bulk initiation is the throughput you need. - Prosecution disclosure, not access-to-information, is the main reason you redact, and Axon Evidence's chain of custody on the original is what the court will ask about. - Your records office is content to receive the redacted export and exemption log from the evidence team and file them against the request in its own system. Q: What are Axon Redaction Studio and Redaction Assistant? A: Redaction Studio is the manual redaction editor built into Axon Evidence, Axon's cloud digital-evidence system: open a video, mask audio and video personal information, track an object through the file, assign an agency-configured exemption code to each mask and download the exemption log with the redacted export. Redaction Assistant is a paid AI add-on inside Studio that masks heads, licence plates and screens, shows every unique head in a thumbnail panel for selection, processes up to twenty videos at once and redacts words found in the transcript. Axon relaunched both in October 2024. Q: Is there an Axon Redaction alternative for offices that are not on Axon Evidence? A: Yes. AccessPoint redacts video and audio from any source — body-worn, CCTV, dispatch and 911 audio, interview recordings, Teams meetings — inside your own Microsoft 365 and Azure tenant, as part of the access-request platform rather than an evidence vault. The AI assistance (in-tenant face detection, on-screen text OCR, transcript-based proposals) is included rather than licensed as an add-on, and pricing is flat by organization size and published on the site. Q: Does AccessPoint mask heads and licence plates automatically like Redaction Assistant? A: AccessPoint detects faces in-tenant and proposes one tracked mark per person for you to accept or dismiss, and reads on-screen text with frame OCR so a licence plate, a name badge or a case number on a monitor becomes a proposal with a rule citation. It does not ship a dedicated head, body or licence-plate detector; a subject seen from behind is drawn once and then tracked automatically in both directions, stopping rather than drifting when it loses the subject. Nothing is applied until a reviewer accepts it. Q: Axon already gives us an exemption log. What does AccessPoint add? A: Axon's exemption log records the agency code assigned to each mask; whether each entry carries the time span it covers is not described in Axon's published documentation. In AccessPoint the exemption is a property of the mark itself — with alternates, comments and an approval — the caption burned into the frame can show it, and the request's redaction log lists every span with its effect and exemption beside the page-level entries for the paper records. The release also carries a hash manifest and a statement of how it was prepared, including how many marks were model-proposed. Q: Can we use both — redact in Axon Evidence for court and in AccessPoint for access requests? A: Yes, and many agencies will. Axon Evidence remains the system of record for the original footage and its chain of custody, and prosecution disclosure can continue there. AccessPoint handles the access-to-information copy: the responsive footage is added to the request, marked with the exemptions the jurisdiction pack provides, released as a burned MP4 or MP3 in the same package as the documents, and logged span by span. Nothing needs to be migrated between the two. ### AccessPoint vs. Secure Redact (Pimloc Limited) URL: https://www.realizer.io/compare/secure-redact — facts last reviewed 2026-09-04 Verdict: Secure Redact is Pimloc's self-serve SaaS for automatically blurring faces, heads, licence plates and screens in CCTV and body-worn video, with transcript-based audio redaction, a chain-of-custody record on every file, and published credit pricing — one credit for a minute of video — with separate UK/EU and US processing options. For a UK council, school, NHS trust or transport operator that needs to answer subject-access and FOI requests for CCTV and is happy with a specialist SaaS, it is a strong, transparent choice. AccessPoint's difference is that it is the access-request platform, not a redaction service: the recording is processed in your own tenant, every mark carries the statutory exemption it relies on, and the burned release, its hash manifest and the time-based redaction log stay in the same request file as the documents — priced flat by organization size rather than per minute. Secure Redact fact sheet: - Product: Secure Redact — automated redaction, audit and discovery platform for video, audio, images and documents - Vendor: Pimloc Limited, Somerset House, London - Form factor: Self-serve SaaS, open APIs, integrations inside partner VMS/DEMS platforms, and private or customer-cloud deployment for enterprise - Processing location: Pimloc's SaaS infrastructure with a choice of UK/Europe or US processing jurisdiction; private or customer-cloud options for enterprise. SOC 2 Type 2 and Cyber Essentials Plus listed - Pricing model: Published credit plans: 1 credit = 1 minute of video, 5 minutes of audio, 30 images or 10 documents. Basic 10 credits from $65 / £49 per month on annual billing, Pro 20 credits from $119 / £89, Advanced 30 credits from $159 / £119; Enterprise from 60 credits per month on a 12-month contract; 10 free credits on sign-up - Notable integrations: Milestone XProtect and Eagle Eye Networks direct integrations; partner listings include Rhombus, NICE, Network Optix and Cisco Meraki. Integration with FOI request platforms is not described in its published documentation Side by side: - Where the footage is processed — Secure Redact: Uploaded to Pimloc's SaaS, with a choice of UK/Europe or US processing jurisdiction; a private or customer-cloud deployment is offered to enterprise customers | AccessPoint: Inside your own Microsoft 365 and Azure tenant. Face detection runs on your App Service with no outside call; on-screen text detection and transcription use Azure AI Document Intelligence and Azure AI Speech deployed in your tenant. The original recording is never modified - Detection: faces, plates, on-screen text — Secure Redact: Automatic blurring of faces, heads, licence plates, screens, displays and mobile data terminals; vendor claims over 99% of personal data identified. Detection of printed text on screen (names, numbers) is described for documents rather than video frames | AccessPoint: In-tenant face detection with stabilised tracking (one proposed tracked mark per person) and on-screen text via frame OCR against your detection patterns — a licence plate, a name badge, a case number on a monitor — each proposal carrying a rule citation. No dedicated plate, head or body detector; anything else is drawn once and tracked automatically in both directions - Audio: mute, bleep, voice distortion — Secure Redact: Automatic redaction of names, addresses, dates and other personal data in audio via named-entity recognition, plus manually created audio ranges. Whether a span is muted, bleeped or pitch-shifted in the output is not described in its published documentation | AccessPoint: Mute, bleep and voice distortion (pitch-shifted so every word stays audible) can be combined on one recording, each span with its own exemption — the severance Ontario's IPC has ordered in place of removal - Transcript-anchored marks — Secure Redact: Automatically generated transcripts that are editable and downloadable, used to pick the words to redact; audio can also be translated into English | AccessPoint: Time-coded, speaker-labelled transcript; Find & redact, detection rules and the AI pass propose Mute marks over the spoken span for you to accept or dismiss. Needs Azure AI Speech deployed in your tenant - Link to the request and the exemption cited — Secure Redact: Not described in its published documentation — Secure Redact is positioned as the redaction step for DSARs and FOI requests managed elsewhere | AccessPoint: Every mark — region, audio span or whole-record withhold — carries the exemption from the jurisdiction pack, alternates, comments, flags and approval like a page redaction, the in-frame caption can show it, and the request's redaction log lists each span with its effect and exemption - Audit log and release record — Secure Redact: A full audit trail and chain of custody on every file, covering processing, redacting, storing and sharing | AccessPoint: Hash-chained, append-only audit ledger in the request file; each release carries a MANIFEST.sha256 of every entry, a Redaction Index and a "How this release was prepared" statement that counts manual, rule-proposed, model-proposed and propagated marks - Formats and the burned release — Secure Redact: Accepts mp4, mov, avi, webm, wmv, mpeg, 3gp and mkv; 4K support on the Advanced plan; anonymized video can be shared with third parties. The output format and whether sharing links expire are not described in its published documentation | AccessPoint: Uploads up to 2 GB by default in resumable blocks; the release renders MP4 / MP3 with marks burned in and a record-label caption, packaged in the same ZIP as the PDFs. Per-audience release variants are stored as exclusions, so a new mark applies to every cut by default - Integration with request platforms — Secure Redact: Direct integrations with video-management and evidence platforms (Milestone XProtect, Eagle Eye Networks) and an API for custom workflows; no FOI or DSAR request platform integration is described | AccessPoint: AccessPoint is the request platform: recordings are documents on the request, added from the Documents tab or Teams meeting recordings, and the release decision feeds the Contents page, the redaction log and the statistics - Pricing model — Secure Redact: Published per-minute credit plans from $65 / £49 a month on annual billing, with top-up credits; enterprise contracts from 60 credits a month | AccessPoint: Flat annual subscription by organization size, published on the site and billed through the Microsoft commercial marketplace — no per-user, per-seat or per-minute fees, and video and audio redaction is included Where Secure Redact fits (honest concessions): - You are a UK or EU public body — a council, school, NHS trust or transport operator — answering DSARs and FOI requests for CCTV, and a UK-hosted specialist SaaS with SOC 2 and Cyber Essentials Plus satisfies your data-protection officer. - Your volume is small and irregular, so paying by the minute of footage on a monthly plan is cheaper than a platform subscription. - Your footage sits in Milestone XProtect or Eagle Eye Networks and you want to send clips to redaction from inside the video-management system. - You need live-stream anonymization or analytics over anonymized video, which Secure Redact offers and AccessPoint does not. Q: What is Secure Redact? A: Secure Redact is a redaction platform built by Pimloc Limited in London. It automatically blurs faces, heads, licence plates and screens in CCTV, body-worn, dash-cam and drone footage, generates transcripts and redacts names, addresses and dates in audio, redacts documents and images, and keeps a chain-of-custody record on every file. It is sold as self-serve SaaS with published credit pricing, through APIs and partner video-management platforms, and as a private-cloud deployment for enterprise customers, with a choice of UK/Europe or US processing. Q: Is there a Secure Redact alternative that runs in our own Microsoft 365 tenant? A: Yes. AccessPoint redacts video and audio inside your own Microsoft 365 and Azure tenant, as part of the access-request platform: the face detector runs on your App Service without calling an outside service, on-screen text detection and transcription use Azure services deployed in your tenant, and the original recording is never modified. There are no per-minute credits — video and audio redaction is included in a flat subscription by organization size. Q: How does AccessPoint's detection compare with Secure Redact's? A: Secure Redact automatically blurs faces, heads, licence plates and screens and claims over 99 per cent of personal data identified. AccessPoint detects faces in-tenant and proposes one tracked mark per person, and reads on-screen text with frame OCR so a licence plate, a name badge or a case number on a monitor becomes a proposal carrying a rule citation. It does not ship a dedicated head, body or licence-plate detector — a subject seen from behind is drawn once and tracked automatically — and every proposal waits for a reviewer to accept or dismiss it, so nothing is applied silently. Q: Secure Redact publishes its prices. How does AccessPoint's pricing compare? A: Both publish. Secure Redact charges by credit — one credit is a minute of video or five minutes of audio — on monthly plans from $65 / £49 on annual billing, with top-ups and enterprise contracts from 60 credits a month. AccessPoint is a flat annual subscription by organization size, published on the site and billed through the Microsoft commercial marketplace, with no per-user, per-seat or per-minute fees; video and audio redaction is part of the platform rather than metered. Q: Does AccessPoint cover UK data-protection and FOI requests the way Secure Redact does? A: AccessPoint ships jurisdiction packs for the UK FOI Act, the Environmental Information Regulations and UK GDPR subject-access requests alongside Canadian, US, EU and other regimes — each preloading deadlines, exemption catalogues, business-day calendars and letter templates. A video mark cites the same exemption catalogue as a page redaction, so the section relied on for blurring a bystander in CCTV is recorded in the redaction log exactly as it would be for a paragraph in a document. ### AccessPoint vs. CaseGuard (CaseGuard) URL: https://www.realizer.io/compare/caseguard — facts last reviewed 2026-09-04 Verdict: CaseGuard Studio is a US-built redaction application that installs on the agency's own machines — including air-gapped networks — and covers video, audio, images and documents from one interface, with automatic detection of faces, licence plates, screens and other objects, mute / bleep / resample audio tools, transcription in more than a hundred languages and published per-user pricing from $279 to $379 a month billed annually. For an office that wants a desktop tool under its own roof and can budget a seat for each redactor, it is a well-featured option. AccessPoint's difference is that it is the access-request platform rather than a workstation: the recording is one document on the request, every mark carries the statutory exemption it relies on, the burned release and its time-based redaction log stay in the request file, and pricing is flat by organization size with no per-user fee. CaseGuard fact sheet: - Product: CaseGuard Studio — installed redaction suite for video, audio, images and documents, with transcription, translation and investigation tools; also On-Demand redaction services - Vendor: CaseGuard, Arlington, Virginia - Form factor: Application installed on the customer's machines or network; on-premise deployment and offline mode listed for Ultimate and Enterprise plans - Processing location: The customer's own machines, per the vendor, including air-gapped networks; its pricing terms also refer to cloud-based AI hours and an AI allotment, so confirm which passes run locally - Pricing model: Published per-user plans billed annually: Doc Suite $279, Media Suite $299, Ultimate Suite $379 per user per month; Enterprise custom pricing from 50 seats - Notable customers and integrations: Testimonials on its site from the Long Beach City Prosecutor's Office, Manatee County Government, St. John County Sheriff's Office, University of Arizona Police Department and others; footage import from Axon Evidence.com and Box.com Side by side: - Where the footage is processed — CaseGuard: On the agency's own machine or network — CaseGuard says it is not cloud-based and needs no internet connection to process video — with on-premise deployment and offline mode in the Ultimate and Enterprise plans. Its refund terms reference cloud-based AI hours and an AI allotment | AccessPoint: Inside your own Microsoft 365 and Azure tenant. Face detection runs on your App Service with no outside call; on-screen text detection and transcription use Azure AI Document Intelligence and Azure AI Speech deployed in your tenant. The original recording is never modified - Detection: faces, plates, on-screen text — CaseGuard: Automatic detection of faces, licence plates, screens and mobile data terminals, notepads, vehicles and bodies — twelve categories, per the vendor — plus a Smart Tracker that follows a drawn shape until it leaves the frame | AccessPoint: In-tenant face detection with stabilised tracking (one proposed tracked mark per person) and on-screen text via frame OCR against your detection patterns — a licence plate, a name badge, a case number on a monitor — each proposal carrying a rule citation. No dedicated plate, head or body detector; anything else is drawn once and tracked automatically in both directions - Audio: mute, bleep, voice distortion — CaseGuard: Mute, bleep or resample (change the tone of a voice to conceal identity) on part or all of a recording | AccessPoint: Mute, bleep and voice distortion (pitch-shifted so every word stays audible) can be combined on one recording, each span with its own exemption — the severance Ontario's IPC has ordered in place of removal - Transcript-anchored marks — CaseGuard: Automatic transcription with speaker identification in more than 100 languages; search or highlight keywords in the transcript and redact with one click; transcripts export to Word, PDF or text | AccessPoint: Time-coded, speaker-labelled transcript; Find & redact, detection rules and the AI pass propose Mute marks over the spoken span for you to accept or dismiss. Needs Azure AI Speech deployed in your tenant - Link to the request and the exemption cited — CaseGuard: Exemption logs are described, and an exemption report is listed for the Ultimate and Enterprise plans. Whether an exemption attaches to a time span on a recording, and how it reaches the request file, is not described in its published documentation | AccessPoint: Every mark — region, audio span or whole-record withhold — carries the exemption from the jurisdiction pack, alternates, comments, flags and approval like a page redaction, the in-frame caption can show it, and the request's redaction log lists each span with its effect and exemption - Audit log and release record — CaseGuard: Audit logs and compliance reports in every plan; standard and transcription reports in Ultimate and Enterprise; redactions are permanent and metadata is scrubbed on export | AccessPoint: Hash-chained, append-only audit ledger in the request file; each release carries a MANIFEST.sha256 of every entry, a Redaction Index and a "How this release was prepared" statement that counts manual, rule-proposed, model-proposed and propagated marks - Formats and the burned release — CaseGuard: Video, audio and image files with permanent, burned-in redactions; the list of accepted and exported formats and any size limit are not described on its product pages | AccessPoint: Uploads up to 2 GB by default in resumable blocks; the release renders MP4 / MP3 with marks burned in and a record-label caption, packaged in the same ZIP as the PDFs. Per-audience release variants are stored as exclusions, so a new mark applies to every cut by default - Integration with request platforms — CaseGuard: Footage import from Axon Evidence.com and Box.com; third-party integrations are listed for the Ultimate and Enterprise plans. No FOI request platform integration is described | AccessPoint: AccessPoint is the request platform: recordings are documents on the request, added from the Documents tab or Teams meeting recordings, and the release decision feeds the Contents page, the redaction log and the statistics - Pricing model — CaseGuard: Published per-user seats billed annually — $279, $299 or $379 per user per month depending on suite — with Enterprise pricing from 50 seats and a pro-rated money-back guarantee | AccessPoint: Flat annual subscription by organization size, published on the site and billed through the Microsoft commercial marketplace — no per-user, per-seat or per-minute fees, and video and audio redaction is included Where CaseGuard fits (honest concessions): - Your security policy requires redaction on an air-gapped or fully offline workstation, with no cloud tenant of any kind in the chain. - One or two dedicated redactors handle all of the office's footage, so per-user seats are affordable and a desktop tool matches how they work. - You need investigation and enhancement tools — sharpening plates, clarifying footage, detecting tattoos — alongside redaction, which CaseGuard bundles and AccessPoint does not offer. - You want to outsource overflow to the vendor's On-Demand redaction team from time to time. Q: What is CaseGuard Studio? A: CaseGuard Studio is an installed redaction suite from CaseGuard of Arlington, Virginia. It redacts video, audio, images and documents from one interface, automatically detecting faces, licence plates, screens, notepads, vehicles and bodies, muting, bleeping or resampling audio, and transcribing and translating in more than a hundred languages. The vendor says it runs locally on the customer's machines, including air-gapped networks, and publishes per-user pricing of $279 to $379 a month billed annually, with an Enterprise tier from fifty seats. Q: Is there a CaseGuard alternative that does not charge per user? A: Yes. AccessPoint includes video and audio redaction in a flat annual subscription by organization size, published on the site and billed through the Microsoft commercial marketplace, with no per-user or per-seat fee. It runs in the browser inside your own Microsoft 365 and Azure tenant, so anyone with the right role on a request can review and mark a recording without an installed application or an assigned licence. Q: CaseGuard runs offline. Does AccessPoint send footage to the cloud? A: AccessPoint sends nothing to a third party. It runs in your own Microsoft 365 and Azure tenant: the face detector runs on your App Service without calling an outside service, and on-screen text detection and transcription use Azure AI Document Intelligence and Azure AI Speech deployed in that same tenant. If your policy requires a machine with no cloud tenant at all, CaseGuard's offline mode is the better fit; if your policy is that data stays in the tenant your organization already governs, AccessPoint meets it without a workstation. Q: How does AccessPoint's detection compare with CaseGuard's? A: CaseGuard detects faces, licence plates, screens, notepads, vehicles and bodies and tracks a drawn shape until it leaves the frame. AccessPoint detects faces in-tenant and proposes one tracked mark per person, and reads on-screen text with frame OCR so a licence plate, a name badge or a case number on a monitor becomes a proposal carrying a rule citation. It does not ship a dedicated head, body or licence-plate detector — a subject seen from behind is drawn once and tracked automatically in both directions — and every proposal waits for a reviewer to accept or dismiss it. Q: CaseGuard has an exemption report. What does AccessPoint's redaction log add? A: CaseGuard lists exemption logs and, in its Ultimate and Enterprise plans, an exemption report; whether an exemption attaches to a time span on a recording is not described in its published documentation. In AccessPoint the exemption is a property of the mark itself — with alternates, comments and an approval — the caption burned into the frame can show it, and the request's redaction log lists every span with its effect (box, blur, pixelate, mute, bleep, distort or withhold) and exemption beside the page-level entries for the documents in the same release. The package also carries a hash manifest and a statement of how it was prepared. ## Jurisdiction packs (full detail) ### Canada — Federal (pack ca-fed-atip) URL: https://www.realizer.io/solutions/canada-federal-atip — pack content last reviewed 2026-07-13 Legislation: ATIA (Access to Information Act, R.S.C. 1985, c. A-1) — Access to records under the control of a federal government institution; Privacy Act (Privacy Act, R.S.C. 1985, c. P-21) — Personal-information requests and the protection of personal information held by institutions; Directive on Automated Decision-Making (Treasury Board of Canada Secretariat) — Mandatory Algorithmic Impact Assessment for automated decision systems, published to the Open Government Portal Oversight: Information Commissioner of Canada & Privacy Commissioner of Canada — The Information Commissioner has order-making power over access complaints; the Privacy Commissioner oversees the handling of personal information under the Privacy Act. - Response deadline: 30 calendar days from receipt - Extensions: Permitted under s. 9 — large volumes, consultations, third-party notice - Application fee: $5 (search and preparation fees waived under current policy) - Algorithmic Impact Assessments: Mandatory for automated decision systems (TBS Directive) - Oversight: Information Commissioner (order-making) and Privacy Commissioner of Canada - Languages: Bilingual — English and French Q: Does AccessPoint cover both the Access to Information Act and the Privacy Act? A: Yes. The federal configuration ships both regimes in one pack — ATIA access requests and Privacy Act personal-information requests — with their shared 30-day clock, section 9 extensions, exemption catalogues, and the order-making Information Commissioner and the Privacy Commissioner reflected in the complaint workflows. Q: Can it run the Algorithmic Impact Assessment required by the TBS Directive? A: Yes. AccessPoint's assessment engine runs Algorithmic Impact Assessments end to end — impact scoring and tiering, section delegation, review, and a published result — on the same platform as your Privacy Impact Assessments, with a full audit trail suitable for the Directive on Automated Decision-Making. Q: Is the platform fully bilingual? A: Yes. AccessPoint ships bilingual (English/French) and every interface element, notice, letter, and template can be presented in either language, supporting Official Languages requirements for federal institutions. Q: Where does federal data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### British Columbia (pack ca-bc-fippa) URL: https://www.realizer.io/solutions/british-columbia-fippa — pack content last reviewed 2026-07-13 Legislation: FIPPA (Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165) — Provincial ministries and agencies, local public bodies, and other designated public bodies; Bill 22 (2021) (Freedom of Information and Protection of Privacy Amendment Act, 2021) — Added mandatory privacy management programs and breach notification (in force February 1, 2023) and a $10 application fee for general requests Oversight: Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) — Independent, order-making oversight — the Commissioner reviews access decisions and can issue binding orders, and investigates privacy complaints and breaches. - Response deadline: 30 business days from receipt - Extensions: Permitted (s. 10) — large volumes, consultations, third-party notice; longer extensions need OIPC approval - Application fee: $10 for general records requests; no fee to access your own personal information - Privacy duties: Mandatory privacy management program, breach notification, and PIAs - Oversight: Information and Privacy Commissioner for BC (order-making) - Languages: English Q: Does AccessPoint support BC's mandatory privacy management program and breach notification? A: Yes. The 2021 amendments to FIPPA require BC public bodies to maintain a privacy management program and to notify the OIPC and affected individuals of a breach that could reasonably be expected to result in significant harm (in force February 1, 2023). AccessPoint runs the program, the privacy impact assessments, and the breach-notification workflow alongside your access requests. Q: What is the response deadline for a BC FIPPA request? A: A public body must respond within 30 business days, with extensions available under section 10 for large volumes, consultations, or third-party notice; longer extensions require the Commissioner's approval. AccessPoint calculates every date on British Columbia's business-day calendar. Q: Is the Information and Privacy Commissioner for BC order-making? A: Yes. The OIPC for British Columbia conducts reviews and inquiries and can issue binding orders on access decisions, as well as investigate privacy complaints and breaches. AccessPoint tracks reviews and inquiries with their statutory clocks and a guided closure. Q: Where does British Columbia data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Alberta (pack ca-ab-atia) URL: https://www.realizer.io/solutions/alberta-atia — pack content last reviewed 2026-09-07 Legislation: ATIA (Access to Information Act, SA 2024, c. A-1.4) — Access to records held by Alberta public bodies — the access half of the former FOIP, in force June 11, 2025; Protection of Privacy Act (Protection of Privacy Act, SA 2024, c. P-28.5) — The privacy half of the former FOIP — collection, use, disclosure, breach notification, and privacy impact assessments, in force June 11, 2025 Oversight: Office of the Information and Privacy Commissioner of Alberta (OIPC) — Independent, order-making oversight — the Commissioner reviews access decisions and can issue binding orders, and investigates privacy complaints and breaches under both new Acts. - Response deadline: 30 business days from receipt - Extensions: Section 16: up to 30 further business days where the applicant agrees, a large number of records is involved or consultation is needed, with additional reasonable periods on the same grounds (s. 16(2)); the applicant may ask the Commissioner to review an extension - Governing law: ATIA (access) and the Protection of Privacy Act (privacy), replacing FOIP as of June 11, 2025 - Privacy duties: Breach notification and privacy impact assessments under the Protection of Privacy Act - Oversight: Information and Privacy Commissioner of Alberta (order-making) - Languages: English Q: Does AccessPoint support Alberta's new ATIA and Protection of Privacy Act? A: Yes. On June 11, 2025 Alberta replaced FOIP with the Access to Information Act (access requests) and the Protection of Privacy Act (the privacy program). AccessPoint ships pre-configured for both — the new citations, exemptions, deadlines, breach-notification rules, and privacy impact assessments. Q: What is the response deadline for an ATIA request? A: A public body must respond within 30 business days, with s. 16 extensions of up to 30 further business days where the applicant agrees, a large number of records is involved or consultation is needed, plus additional reasonable periods on the same grounds; the applicant may ask the Commissioner to review an extension. AccessPoint calculates every date on Alberta's business-day calendar. Q: Is the Alberta Commissioner order-making? A: Yes. The Office of the Information and Privacy Commissioner of Alberta reviews access decisions and can issue binding orders, and it investigates privacy complaints and breaches under both new Acts. AccessPoint tracks reviews and inquiries with their statutory clocks and a guided closure. Q: Where does Alberta data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Saskatchewan (pack ca-sk-foip) URL: https://www.realizer.io/solutions/saskatchewan-foip — pack content last reviewed 2026-07-13 Legislation: FOIP (The Freedom of Information and Protection of Privacy Act, SS 1990-91, c. F-22.01) — Provincial government institutions — ministries, and prescribed Crown corporations, boards, and commissions; LA FOIP (The Local Authority Freedom of Information and Protection of Privacy Act, SS 1990-91, c. L-27.1) — Local authorities — municipalities, school divisions, health entities, universities, police services, and library boards; HIPA (The Health Information Protection Act, SS 1999, c. H-0.021) — Personal health information held by a trustee is governed separately by HIPA — see the Saskatchewan HIPA page Oversight: Office of the Saskatchewan Information and Privacy Commissioner (OIPC) — Independent oversight on a recommendation model — the Commissioner reviews access decisions and privacy matters and issues public reports with recommendations, with the courts as the enforcement backstop. - Response deadline: 30 calendar days from receipt (s. 7) - Extensions: Section 12 — a further 30 days maximum (60 days total); no route beyond - Application fee: None for provincial FOIP; $20 for a municipal LA FOIP request - Search & preparation: First 2 hours free under FOIP (1 hour under LA FOIP), then $15 per half-hour - Oversight: Saskatchewan Information and Privacy Commissioner (recommendation model) - Languages: English Q: Does AccessPoint handle both FOIP and LA FOIP? A: Yes. The Saskatchewan configuration ships both regimes in one pack — the provincial Freedom of Information and Protection of Privacy Act and the municipal Local Authority FOIP — each with its own fee rules (no fee for provincial requests, a $20 fee for municipal requests), exemption numbering, and correspondence templates. Q: What is the response deadline, and can it be extended? A: A head must respond within 30 calendar days (section 7). A single extension of up to a further 30 days is available under section 12 — a maximum of 60 days in total. Saskatchewan does not provide a route to extend beyond that. AccessPoint calculates every date on the province's calendar. Q: How is personal health information handled? A: Personal health information held by a trustee is carved out of FOIP and LA FOIP and governed instead by The Health Information Protection Act (HIPA). AccessPoint ships a separate Saskatchewan HIPA configuration for health-information custodians. Q: Where does Saskatchewan data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Manitoba (pack ca-mb-fippa) URL: https://www.realizer.io/solutions/manitoba-fippa — pack content last reviewed 2026-07-13 Legislation: FIPPA (The Freedom of Information and Protection of Privacy Act, C.C.S.M. c. F175) — Provincial departments and agencies and local public bodies — municipalities, school divisions, and health authorities — under one Act; PHIA (The Personal Health Information Act, C.C.S.M. c. P33.5) — Personal health information held by a trustee is governed separately by PHIA — see the Manitoba PHIA page Oversight: Manitoba Ombudsman, with the Information and Privacy Adjudicator — The Ombudsman investigates access and privacy complaints and makes recommendations; where a public body does not comply, only the Ombudsman may refer the matter to the Information and Privacy Adjudicator, who can make a binding order. - Response deadline: 45 days from receipt (s. 11) - Extensions: Up to a further 30 days (s. 15) — about 75 days in most cases; consultations and third-party notice - Coverage: One Act for both provincial departments and local public bodies - Fees: No fee to access your own personal information; search and preparation fees may apply to larger requests - Oversight: Manitoba Ombudsman; binding orders via the Information and Privacy Adjudicator - Languages: English (French services available) Q: What is the response deadline for a Manitoba FIPPA request? A: A public body must respond within 45 days (section 11), extendable by up to a further 30 days under section 15 for consultations, third-party notice, or large volumes — about 75 days in most cases. AccessPoint calculates every date automatically. Q: Does one Manitoba configuration cover municipalities and school divisions? A: Yes. Manitoba covers provincial departments and local public bodies — including municipalities, school divisions, and health authorities — under a single Act, so one AccessPoint configuration serves them all rather than a separate municipal system. Q: How does oversight work in Manitoba? A: The Manitoba Ombudsman investigates complaints and makes recommendations. Where a public body does not comply, only the Ombudsman may refer the matter to the Information and Privacy Adjudicator, who can make a binding order. AccessPoint tracks a matter through the full path, including compliance and judicial-review windows. Q: Where does Manitoba data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Ontario (pack ca-on-fippa) URL: https://www.realizer.io/solutions/ontario-fippa — pack content last reviewed 2026-07-13 Legislation: FIPPA (Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F.31) — Provincial ministries, agencies, universities, and other designated institutions; Bill 194 (Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024) — FIPPA privacy amendments in force July 1, 2025 — mandatory PIAs, breach notification, and Ontario's first public-sector AI accountability rules; Bill 97 (Plan to Protect Ontario Act (Budget Measures), 2026) — FIPPA access modernization in force July 1, 2026 — a 45-business-day response time, business-day timelines, and a one-time second extension; MFIPPA (Municipal Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. M.56) — Municipalities and local boards — shipped as a separate Ontario configuration Oversight: Information and Privacy Commissioner of Ontario (IPC) — Independent, order-making oversight — hears appeals of access decisions and investigates privacy complaints and breaches. - Response deadline: 45 business days (Bill 97, in force July 1, 2026) - Extensions: Section 27, plus a one-time second extension under Bill 97 - Application fee: $5, plus search and preparation fees per the FIPPA schedule - Privacy impact assessments: Mandatory before collecting personal information (Bill 194, since July 1, 2025) - Oversight: Information and Privacy Commissioner of Ontario (order-making, appeals) - Languages: English, with French-language services Q: Does AccessPoint support Ontario's Bill 194 PIA requirement? A: Yes. Bill 194 requires FIPPA institutions to complete a written privacy impact assessment before collecting personal information, effective July 1, 2025. AccessPoint's assessment engine runs PIAs end to end — screening, questionnaire, an embedded risk register, review, and an exportable regulator-ready summary — with a full audit trail. Q: Is MFIPPA (municipal) supported as well? A: Yes. Ontario municipalities and local boards are covered by MFIPPA, which AccessPoint ships as a separate Ontario configuration because the section numbers diverge from FIPPA. The same platform serves provincial and municipal institutions. Q: Does it handle appeals to the IPC? A: Yes. AccessPoint's complaints and appeals module tracks appeals to the Information and Privacy Commissioner of Ontario with their own statutory clocks, an investigation workspace, a representations sign-off, and a guided closure that records the disposition and any order. Q: Where does Ontario data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Ontario (Municipal) (pack ca-on-mfippa) URL: https://www.realizer.io/solutions/ontario-mfippa — pack content last reviewed 2026-07-13 Legislation: MFIPPA (Municipal Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. M.56) — Municipalities, local boards, police services boards, and other designated local institutions; Bill 97 (Plan to Protect Ontario Act (Budget Measures), 2026) — MFIPPA modernization — a 45-business-day response time, business-day timelines, staged access plans, and the first mandatory municipal PIAs and breach reporting, phased in through July 1, 2026 and January 1, 2027; FIPPA (Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F.31) — Provincial ministries, agencies, and universities — shipped as a separate Ontario configuration Oversight: Information and Privacy Commissioner of Ontario (IPC) — Independent, order-making oversight — hears appeals of municipal access decisions and issues binding orders, investigates privacy complaints, and under Bill 97 gains expanded power to review municipal information practices and order changes. - Response deadline: 45 business days (Bill 97, in force July 1, 2026) - Extensions: Section 20, plus a staged access plan under Bill 97 - Application fee: $5, plus search and preparation fees per the MFIPPA schedule - Municipal privacy impact assessments: Mandatory before collecting personal information (Bill 97, from January 1, 2027) - Oversight: Information and Privacy Commissioner of Ontario (order-making, appeals) - Languages: English, with French-language services Q: Does AccessPoint reflect Bill 97's new municipal timelines? A: Yes. Bill 97 extends the MFIPPA response time from 30 days to 45 business days, effective July 1, 2026, and lets institutions propose a staged access plan in prescribed cases. AccessPoint runs the business-day clock, the Ontario holiday calendar, and the extension and staged-access rules for you. Q: Does Bill 97 really require municipal PIAs and breach reporting? A: Yes. The privacy amendments Bill 194 made to FIPPA in force July 1, 2025 did not extend to the municipal sector. Bill 97 changes that: from January 1, 2027, municipalities and local boards must complete privacy impact assessments before collecting personal information and report breaches to the IPC where there is a real risk of significant harm. AccessPoint runs both. Q: We're a provincial institution under FIPPA, not municipal — is that covered? A: Yes. AccessPoint ships a separate Ontario FIPPA configuration for provincial ministries, agencies, and universities, including the Bill 194 privacy obligations. See the Ontario FIPPA page at /solutions/ontario-fippa. Q: Where does municipal data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Québec (pack ca-qc-acces) URL: https://www.realizer.io/solutions/quebec-loi-sur-lacces — pack content last reviewed 2026-07-13 Legislation: Loi sur l'accès (Act respecting Access to documents held by public bodies and the Protection of personal information, CQLR c. A-2.1) — Access to documents held by Québec public bodies and the protection of the personal information they hold; Law 25 (An Act to modernize legislative provisions as regards the protection of personal information, S.Q. 2021, c. 25) — Privacy modernization phased in from 2022 to 2024 — mandatory confidentiality-incident reporting, privacy impact assessments (EFVP), governance, and stronger CAI enforcement; Charter of the French language (Charter of the French language, CQLR c. C-11 (as amended by Law 96, S.Q. 2022, c. 14)) — French as the language of the public administration — access requests and responses are handled primarily in French Oversight: Commission d'accès à l'information du Québec (CAI) — Oversees both access and privacy through two divisions — an oversight division that supervises compliance and can order corrective measures and pursue penal sanctions under Law 25, and an adjudicative division that renders binding decisions on access and rectification disputes, appealable on questions of law to the Court of Québec. - Response deadline: 20 days from receipt (s. 47) - Extensions: One extension of up to 10 days (s. 47) - Fees: Consultation is free; regulated fees for transcription, reproduction, and transmission - Confidentiality-incident reporting: Mandatory to the CAI and affected individuals (Law 25, since 2022) - Oversight: Commission d'accès à l'information (oversight and binding adjudication) - Languages: French — the regime operates primarily in French Q: Does AccessPoint support Québec's Law 25 obligations? A: Yes. Alongside your A-2.1 access requests, AccessPoint runs the Law 25 privacy program — privacy impact assessments (EFVP), confidentiality-incident reporting to the Commission d'accès à l'information and affected individuals, and governance records — on the same platform, with a full audit trail. Q: Is the platform available in French? A: Yes. AccessPoint is French-primary for Québec: every interface element, notice, letter, and template operates in French, consistent with the Charter of the French language, with English available where a requester needs it. Q: Does it handle CAI oversight and adjudication? A: Yes. AccessPoint tracks both oversight complaints and adjudicative disputes before the Commission d'accès à l'information, each with its own clock, an investigation workspace, and a guided closure that records the disposition or decision. Q: Where does Québec data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### New Brunswick (pack ca-nb-rtippa) URL: https://www.realizer.io/solutions/new-brunswick-rtippa — pack content last reviewed 2026-07-13 Legislation: RTIPPA (Right to Information and Protection of Privacy Act, S.N.B. 2009, c. R-10.6) — One act for both provincial and local public bodies — access to records and the protection of personal information; Official Languages Act (Official Languages Act, S.N.B. 2002, c. O-0.5) — New Brunswick is officially bilingual — requests and responses are handled in English or French; PHIPAA (Personal Health Information Privacy and Access Act, S.N.B. 2009, c. P-7.05) — Personal health information held by custodians — shipped as a separate New Brunswick configuration Oversight: Office of the Ombud (New Brunswick) — Independent oversight on a recommendation model — the Ombud investigates access and privacy complaints and issues recommendations to the public body; unresolved matters may be taken to the Court of King's Bench. - Response deadline: 30 business days (s. 11) - Extensions: Up to an additional 30 business days (s. 11) - Application fee: None — no application or processing fees - Complaint fee: None — complaints to the Ombud are free - Oversight: Office of the Ombud — recommendations, not binding orders - Languages: English and French — New Brunswick is officially bilingual Q: Is New Brunswick really a no-fee regime? A: Yes. Under RTIPPA there is no application fee and no charge to search for or prepare records, and complaints to the Ombud are free as well. AccessPoint ships without fee calculators for New Brunswick and focuses on answering each request within the statutory time. Q: Does one configuration cover municipalities too? A: Yes. RTIPPA is a single act for both provincial and local public bodies, so municipalities and other local bodies run on the same New Brunswick configuration as departments and agencies. Q: How does Ombud oversight work in AccessPoint? A: New Brunswick uses a recommendation model. AccessPoint's complaints module tracks a complaint to the Office of the Ombud through investigation, the Ombud's recommendations, and the public body's response, recording the outcome on an audit trail. Q: Where does New Brunswick data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Nova Scotia (pack ca-ns-foipop) URL: https://www.realizer.io/solutions/nova-scotia-foipop — pack content last reviewed 2026-07-13 Legislation: FOIPOP (Freedom of Information and Protection of Privacy Act, S.N.S. 1993, c. 5) — Provincial departments, agencies, universities, and other public bodies; Municipal access (Part XX, MGA) (Municipal Government Act, S.N.S. 1998, c. 18, Part XX) — Municipal access-and-privacy rules today — to be repealed and folded into the new Act by Bill 150; Bill 150 (Freedom of Information and Protection of Privacy Act (2025), Royal Assent October 3, 2025, in force April 1, 2027) — A consolidated Act — municipal access folded in, an independent Commissioner, a 30-business-day clock, mandatory PIAs, and breach notification Oversight: Office of the Information and Privacy Commissioner for Nova Scotia (Review Officer) — Independent oversight on a recommendation model — the Review Officer reviews access and privacy decisions and issues recommendations; unresolved matters may go to the Supreme Court of Nova Scotia. Under Bill 150 the office becomes an officer of the Legislature but keeps the recommendation model. - Response deadline: 30 days today; 30 business days under Bill 150 (April 1, 2027) - Extensions: Permitted for large or complex requests and third-party consultation - Application fee: $5 for general records; none for your own personal information - Privacy impact assessments: Mandatory under Bill 150 (from April 1, 2027) - Oversight: Information and Privacy Commissioner / Review Officer (recommendations) - Languages: English Q: Is AccessPoint ready for Bill 150? A: Yes. AccessPoint ships both the current FOIPOP regime and the Bill 150 model — the 30-business-day clock, the consolidated municipal rules, mandatory privacy impact assessments, and breach notification — so you can adopt the new Act when it takes effect on April 1, 2027. Q: Does Bill 150 give the Commissioner binding order power? A: No. Bill 150 makes the Information and Privacy Commissioner an officer of the Legislature, strengthening independence, but keeps the recommendation model — the Commissioner reviews and recommends, and enforceable orders still come from the courts. AccessPoint tracks reviews and recommendations through to closure. Q: Does it cover municipalities? A: Yes. Municipal access runs under Part XX of the Municipal Government Act today, and Bill 150 folds municipalities into the FOIPOP Act itself. AccessPoint runs the municipal regime in both forms. Q: Where does Nova Scotia data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Prince Edward Island (pack ca-pe-foipp) URL: https://www.realizer.io/solutions/prince-edward-island-foipp — pack content last reviewed 2026-07-13 Legislation: FOIPP (Freedom of Information and Protection of Privacy Act, R.S.P.E.I. 1988, c. F-15.01) — Access to records held by PEI public bodies and the protection of the personal information they hold; FOIPP General Regulations (Freedom of Information and Protection of Privacy Act General Regulations, PEI Reg EC564/02) — The fee schedule and the list of public bodies designated under the FOIPP Act; Health Information Act (Health Information Act, R.S.P.E.I. 1988, c. H-1.41) — Patient access to personal health information held by custodians — shipped as a separate PEI configuration Oversight: Office of the Information and Privacy Commissioner (Prince Edward Island) — Independent officer of the Legislative Assembly. After a review under the FOIPP Act, the Commissioner may issue a binding order that the public body has a duty to comply with — an order-making model, distinct from the recommendation-only offices elsewhere in Atlantic Canada. - Response deadline: 30 days - Extensions: Up to an additional 30 days - Application fee: $5 for general records; none for your own personal information - Fee waivers: Available in defined circumstances - Oversight: Information and Privacy Commissioner — independent reviews and binding orders - Languages: English Q: Can PEI's Information and Privacy Commissioner issue binding orders? A: Yes. After a review under the FOIPP Act, the Commissioner can issue an order that the public body has a duty to comply with — an order-making model, unlike the recommendation-only offices elsewhere in Atlantic Canada. AccessPoint keeps a complete, order-ready record of every decision. Q: What is the response deadline? A: A PEI public body must respond within 30 days, with an extension of up to a further 30 days in defined circumstances. AccessPoint runs the clock on the Island's holiday calendar and flags extensions before they fall due. Q: Does AccessPoint handle the $5 fee and waivers? A: Yes. It applies the $5 fee for general-records requests, waives it for a person's own personal information, estimates any additional fees per the regulations, and records fee-waiver decisions on the audit trail. Q: Where does PEI data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Newfoundland & Labrador (pack ca-nl-atippa) URL: https://www.realizer.io/solutions/newfoundland-labrador-atippa — pack content last reviewed 2026-07-13 Legislation: ATIPPA, 2015 (Access to Information and Protection of Privacy Act, 2015, SNL 2015, c. A-1.2) — One act for access to records and protection of personal information held by provincial and local public bodies — in force June 1, 2015 after the Wells statutory review; ATIPPA Cost Schedule (Cost schedule made under ATIPPA, 2015 (effective June 1, 2015)) — Search-time thresholds and reproduction costs — no application fee, and no charge for a request for your own personal information Oversight: Office of the Information and Privacy Commissioner for Newfoundland and Labrador (OIPC) — Independent oversight — reviews access decisions and privacy complaints and issues reports with recommendations; unusually, a public body that declines a recommendation to release records must itself apply to the Supreme Court of Newfoundland and Labrador for a declaration, or comply. - Response deadline: 20 business days — the strictest statutory clock in Canada (s. 16) - Extensions: None self-serve — every extension needs the Commissioner's approval, ruled on within three business days (s. 23) - Application fee: None — no charge for your own personal information; 10 to 15 hours of search time free before any hourly charge (s. 25) - Privacy impact assessments: Mandatory for executive-government departments and branches (s. 72) - Oversight: Information and Privacy Commissioner (recommendations; the public body must comply or go to court) - Languages: English (provincial French-language services available) Q: How strict is the ATIPPA, 2015 response deadline? A: Twenty business days — the tightest statutory clock in Canada (section 16). A public body cannot extend on its own: under section 23 every extension must be approved by the Information and Privacy Commissioner, who decides within three business days. AccessPoint computes the due date on the provincial business-day calendar, tracks extension applications and their outcomes, and applies only the clock pauses the Act allows. Q: What happens if the Commissioner recommends releasing records? A: Newfoundland & Labrador is unusual. After a review the Commissioner issues a report with recommendations (section 48), and a public body that decides not to release the records must — within 10 business days — either comply or apply to the Supreme Court of Newfoundland and Labrador (Trial Division) for a declaration that it is authorized to refuse (sections 49–50). The burden is on the public body, not the applicant. AccessPoint tracks the head's decision, the clock, and the court path, with court-ready evidence from the audit ledger. Q: Does it handle PIAs and privacy breaches under the Act? A: Yes. Section 72 requires privacy impact assessments for executive-government departments and branches, and section 64 requires reporting privacy breaches to the Commissioner. AccessPoint runs PIAs on a configurable questionnaire engine and works breaches to closure with a live notification checklist, all on the same platform with a full audit trail. Q: Where does Newfoundland & Labrador data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Yukon (pack ca-yt-atipp) URL: https://www.realizer.io/solutions/yukon-atipp — pack content last reviewed 2026-07-13 Legislation: ATIPP Act (Access to Information and Protection of Privacy Act, SY 2018, c. 9) — One act for both access to records and protection of personal information held by Yukon public bodies — in force April 1, 2021, replacing the 1995 Act; ATIPP Regulation (O.I.C. 2021/025) — Response timelines, processing-fee schedule, free-hour thresholds, and procedures — replaced the 1996 Access to Information Regulation on April 1, 2021 Oversight: Yukon Information and Privacy Commissioner (IPC) — Independent oversight — investigates access and privacy complaints and issues public reports with recommendations; a public body that rejects a recommendation must give reasons, and the applicant may seek review in the Supreme Court of Yukon. - Response deadline: 30 business days from the activation date (s. 50) - Extensions: Up to 15 business days by the access officer (30 with consent); longer only with the Commissioner's approval (ss. 62–63) - Application fee: None — processing charged at $30 per hour after free hours (3 to 10 hours free) - Privacy impact assessments: Required before new or significantly changed programs and data-linking (s. 11) - Oversight: Yukon Information and Privacy Commissioner (recommendations, with review in the Supreme Court of Yukon) - Languages: English and French Q: What is the response deadline under Yukon's ATIPP Act? A: Thirty business days from the activation date of the request (section 50). AccessPoint calculates the due date on the Yukon business-day calendar, tracks the access officer's extensions of up to 15 business days — 30 with the applicant's consent — under section 62, and flags when a longer extension needs the Commissioner's approval under section 63. Q: How does AccessPoint handle Yukon's mandatory and discretionary exemptions? A: The 2021 Act splits exemptions into information a public body must refuse to disclose (Division 8) and information it may refuse (Division 9). AccessPoint ships both divisions as a colour-coded catalogue mapped to the governing section, so redactions are tagged correctly and assembled into a defensible exemption manifest, with the clear-public-interest override kept in view. Q: Does it support PIAs and breach notification under the Act? A: Yes. Section 11 requires a privacy impact assessment before a ministerial public body launches or significantly changes a program, service, or data-linking activity, and section 32 requires notifying the Commissioner and affected individuals when a breach poses a risk of significant harm. AccessPoint runs both — a PIA engine and a live breach-notification calculator — on the same platform, with a full audit trail. Q: Where does Yukon data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Northwest Territories (pack ca-nt-atipp) URL: https://www.realizer.io/solutions/northwest-territories-atipp — pack content last reviewed 2026-07-13 Legislation: ATIPP Act (Access to Information and Protection of Privacy Act, SNWT 1994, c. 20) — Access to records and protection of personal information held by Government of the Northwest Territories departments, agencies, boards, and other public bodies designated under the Act; Bill 29 (An Act to Amend the Access to Information and Protection of Privacy Act, SNWT 2019, c. 8) — Major provisions in force July 30, 2021 — introduced binding order-making, a 20-business-day clock, mandatory privacy impact assessments, and mandatory breach notification Oversight: Information and Privacy Commissioner of the Northwest Territories — Independent, order-making oversight since Bill 29 — reviews access decisions and privacy complaints and issues binding orders; an order can be filed and enforced as an order of the Supreme Court of the Northwest Territories. - Response deadline: 20 business days from receipt; a late response is a deemed refusal (s. 8) - Extensions: Self-extend up to 20 business days on defined grounds; any longer extension needs the Commissioner's authorization (ss. 11, 11.1) - Application fee: None — the application fee was removed in 2021; service fees apply only above a $250 chargeable total - Privacy impact assessments: Mandatory before new programs and systems collect personal information (s. 42.1, Bill 29) - Oversight: Information and Privacy Commissioner — binding order-making since 2021 (Bill 29) - Languages: English, French, and the territory's nine official Indigenous languages (s. 7) Q: Does the NWT Commissioner really issue binding orders now? A: Yes. Bill 29, in force July 30, 2021, replaced the former recommendation model with binding order-making. After a review the Information and Privacy Commissioner can order a public body to give access (section 35); the body must comply within 20 business days or appeal to the Supreme Court of the Northwest Territories (section 37), and an order can be filed and enforced as an order of the Court (section 35(6)). AccessPoint tracks orders, the compliance clock, and the appeal path, with court-ready evidence from the audit ledger. Q: What did Bill 29 change for privacy? A: It made privacy impact assessments mandatory before a public body develops a new enactment, system, program, or service that handles personal information (section 42.1), and it introduced mandatory breach notification — reporting material breaches to the Commissioner (section 49.9) and notifying affected individuals on a real risk of significant harm (section 49.10). AccessPoint runs PIAs and a live breach-notification calculator on the same platform, with a full audit trail. Q: What is the response deadline in the Northwest Territories? A: Twenty business days from receipt (section 8); a late response is a deemed refusal. A public body may self-extend up to 20 business days on defined grounds (section 11), and any longer extension needs the Commissioner's authorization (section 11.1). AccessPoint computes the due date on the NWT business-day calendar and tracks every extension. Q: Where does Northwest Territories data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Nunavut (pack ca-nu-atipp) URL: https://www.realizer.io/solutions/nunavut-atipp — pack content last reviewed 2026-09-07 Legislation: ATIPP Act (Access to Information and Protection of Privacy Act, C.S.Nu., c. A-20) — Access to records and protection of personal information held by Government of Nunavut public bodies — carried forward from the Northwest Territories at division on April 1, 1999; ATIPP Regulations (NWT Reg (Nu) 206-96) — Prescribed fees, estimates, and procedures under the Act — a $25 fee for general requests, and none for a request for your own personal information Oversight: Information and Privacy Commissioner of Nunavut — Independent oversight — reviews access and privacy decisions and issues reports with recommendations; the head of the public body makes the final decision, which an applicant may appeal to the Nunavut Court of Justice. - Response deadline: 25 business days from receipt (s. 8(1), as amended by S.Nu. 2017, c. 26); a late response is a deemed refusal (s. 8(2)) - Extensions: An extension for a reasonable period on defined grounds, with notice to the applicant (s. 11) — no fixed statutory cap - Application fee: $25 for general-information requests; none for your own personal information - Breach notification: Mandatory — material breaches to the Commissioner, individuals on a real risk of significant harm (ss. 49.9–49.10) - Oversight: Information and Privacy Commissioner (recommendations, with appeal to the Nunavut Court of Justice) - Languages: Inuktut, English, and French (s. 7); no fee for translation of a record Q: What kind of oversight does Nunavut's ATIPP Act provide? A: A recommendation model. After a review the Information and Privacy Commissioner issues a report with recommendations (section 35); within 30 days the head of the public body decides whether to follow them (section 36), and an applicant can appeal the decision to the Nunavut Court of Justice (section 37). The Commissioner does not issue binding orders. AccessPoint tracks the review, the head's decision, and the appeal path, with a full audit trail. Q: Does Nunavut require breach notification? A: Yes — and it was the first jurisdiction in Canada to require it of all public bodies. A material privacy breach must be reported to the Commissioner (section 49.9), and affected individuals must be notified where the breach poses a real risk of significant harm (section 49.10). AccessPoint logs breaches and runs a live notification checklist computed from those duties. Q: Nunavut's Act is dated — what happens when it is modernized? A: AccessPoint is configuration-driven, so it fits the Act as it stands today — the 25-business-day clock, the recommendation model, the $25 general-request fee — and adapts as the law changes. Reform has been recommended repeatedly, through a comprehensive IPC review, committee reports, and a withdrawn 2024 amendment bill; when order-making, statutory PIAs, or new coverage arrive, you reconfigure rather than replace the system. Q: Where does Nunavut data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Ontario — PHIPA (pack ca-on-phipa) URL: https://www.realizer.io/solutions/ontario-phipa — pack content last reviewed 2026-07-13 Legislation: PHIPA (Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A) — Access to and correction of personal health information held by health information custodians — in force November 1, 2004; O. Reg. 329/04 (General regulation under PHIPA) — Mandatory breach reporting to the IPC in the prescribed circumstances (since October 1, 2017) and the annual breach-statistics report to the Commissioner (since 2019); FIPPA / MFIPPA (Freedom of Information and Protection of Privacy Act & its municipal counterpart) — Ontario's public-body access and privacy laws, sharing the same oversight office — shipped as separate configurations Oversight: Information and Privacy Commissioner of Ontario (IPC) — Independent, order-making oversight under PHIPA — reviews access and correction complaints, investigates privacy breaches, and issues binding orders, including administrative penalties. A final order may be filed with the Superior Court of Justice and enforced as a court judgment. - Access deadline: As soon as possible and no later than 30 days to respond to a request for one's own record (s. 54), extendable by a further 30 days - Correction: Custodians must respond to a correction request within 30 days; a refused correction carries a statement of disagreement (s. 55) - Access fees: Reasonable cost recovery with a fee estimate given first; no fixed amount is prescribed by regulation (s. 54(11)) - Breach notification: Notify affected individuals at the first reasonable opportunity, and report to the IPC in the prescribed circumstances (since October 1, 2017) - Oversight: Information and Privacy Commissioner of Ontario (binding orders and administrative penalties) - Languages: English, with French-language services Q: How long does an Ontario custodian have to respond to an access request? A: Under PHIPA, a health information custodian must respond as soon as possible and no later than 30 days after a request for access to the individual's own record, with a further 30-day extension available in defined circumstances. AccessPoint computes the due date on Ontario's calendar and tracks every request against it. Q: Does the IPC make binding orders under PHIPA? A: Yes. Unlike the recommendation-model provinces, the Information and Privacy Commissioner of Ontario has order-making power under PHIPA — it can order access or correction, order information practices changed, and impose administrative penalties, and a final order can be filed with the Superior Court of Justice and enforced as a judgment. AccessPoint keeps the investigation record and representations complete so your position is defensible. Q: When must a breach be reported to the IPC? A: PHIPA requires custodians to notify affected individuals at the first reasonable opportunity, and to report to the Commissioner in the circumstances the regulation prescribes — including theft, unauthorized access by someone who ought to have known they lacked authority, a pattern of breaches, and breaches significant by their sensitivity or scale — a duty in force since October 1, 2017. Custodians must also file annual breach statistics. AccessPoint assesses the circumstances and computes both. Q: Where does Ontario health data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, records, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Ontario — CYFSA Part X (pack ca-on-cyfsa) URL: https://www.realizer.io/solutions/ontario-cyfsa — pack content last reviewed 2026-08-10 Legislation: Child, Youth and Family Services Act — Part X (S.O. 2017, c. 14, Sched. 1, Part X) — The access, correction, and privacy regime for personal information held by service providers, in force since 1 January 2020; Access to one's own personal information (CYFSA Part X, access provisions) — An individual's right to request access to personal information about themselves held by a service provider, subject to the Part X exceptions; Correction of personal information (CYFSA Part X, correction provisions) — The right to request correction of inaccurate or incomplete personal information, with a statement of disagreement where correction is refused Oversight: Information and Privacy Commissioner of Ontario (IPC) — The IPC oversees Part X of the CYFSA — reviewing complaints about access, correction, and privacy, and issuing binding orders against service providers. The same Commissioner oversees FIPPA, MFIPPA, and PHIPA, so an Ontario organization subject to more than one regime answers to one regulator. - Access deadline: 30 days, with a permitted extension on notice - Correction: Correction or a statement of disagreement where refused - Who is covered: Service providers under the CYFSA — including children's aid societies and licensees - Breach duty: Notice to the individual, and reporting to the IPC in prescribed circumstances - Oversight: IPC Ontario — binding orders - Languages: English, French Q: Who is subject to Part X of the CYFSA? A: Service providers under the Child, Youth and Family Services Act, 2017 — including children's aid societies and licensees delivering services under the Act. Part X governs how they collect, use, and disclose personal information, and gives individuals the right to access and correct their own information. It has been in force since 1 January 2020. Q: How is Part X different from PHIPA or FIPPA? A: It is a separate regime with its own exceptions and its own actors, even though the IPC of Ontario oversees all three. PHIPA covers health information custodians; FIPPA and MFIPPA cover provincial and municipal institutions; Part X covers CYFSA service providers. AccessPoint ships each as its own jurisdiction pack, so an organization subject to more than one runs each on its correct rules rather than approximating. Q: Does it handle breach notification? A: Yes. Log an unauthorized collection, use, disclosure, or loss, run the assessment, notify the affected individual, and report to the Information and Privacy Commissioner where Part X requires it — with the whole sequence timestamped for a later review. Q: Where does the information reside? A: Entirely within your own Microsoft 365 and Azure tenant. Case files, requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Alberta — HIA (pack ca-ab-hia) URL: https://www.realizer.io/solutions/alberta-hia — pack content last reviewed 2026-07-13 Legislation: HIA (Health Information Act, R.S.A. 2000, c. H-5) — Access to and correction of health information held by custodians and their affiliates; Health Information Regulation (Alta Reg 70/2001) — The $25 basic access fee, the fee schedule, and the mandatory breach-notification rules; POPA & ATIA (Protection of Privacy Act & Access to Information Act (SA 2024)) — Alberta's new public-sector privacy and access laws, in force June 11, 2025 — they replaced FOIP, but the HIA continues to govern health custodians; shipped as separate configurations Oversight: Office of the Information and Privacy Commissioner of Alberta (OIPC) — Independent, order-making oversight under the HIA — reviews access and correction decisions, investigates privacy breaches, and issues binding orders. Ignoring a Commissioner's order is an offence. - Access deadline: Every reasonable effort to respond within 30 days to a request for one's own record (s. 12), extendable by 30 days or longer with the Commissioner's permission - Correction: Custodians decide a correction request within 30 days (s. 13); a refused correction carries a statement of disagreement (s. 14) - Access fees: A $25 basic fee under the Health Information Regulation, with additional cost-based fees per the schedule and a fee estimate given first - Breach notification: Notify the Commissioner, the Minister, and the affected individual as soon as practicable where there is a risk of harm (s. 60.1, since August 31, 2018) - Oversight: Office of the Information and Privacy Commissioner of Alberta (binding orders) - Languages: English Q: How long does an Alberta custodian have to respond to an access request? A: Under the HIA, a custodian must make every reasonable effort to respond within 30 days to a request for an individual's own health information, with an extension of up to 30 days — or longer with the Commissioner's permission. AccessPoint computes the due date on Alberta's calendar and tracks every request against it. Q: What does it cost to access your own record, and does AccessPoint handle fees? A: The Health Information Regulation sets a $25 basic fee for an access request, with additional cost-based fees under the schedule for copying and processing. AccessPoint applies the basic fee, builds the required fee estimate, and tracks deposits and any waiver. Q: Does the HIA require breaches to be reported? A: Yes. Since August 31, 2018, a custodian that experiences a loss of, or unauthorized access to or disclosure of, individually identifying health information must, as soon as practicable, give notice to the Information and Privacy Commissioner, the Minister of Health, and the affected individual where there is a risk of harm. AccessPoint assesses the risk of harm and computes all three notifications. Q: Where does Alberta health data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, records, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Saskatchewan — HIPA (pack ca-sk-hipa) URL: https://www.realizer.io/solutions/saskatchewan-hipa — pack content last reviewed 2026-07-13 Legislation: HIPA (The Health Information Protection Act, S.S. 1999, c. H-0.021) — Access to and amendment of personal health information held by trustees — in force September 1, 2003; HIP Regulations, 2023 (The Health Information Protection Regulations, 2023, c. H-0.021 Reg 2) — Trustee privacy-program, training, retention, and information-management-service-provider requirements — in force August 1, 2023; FOIP & LA FOIP (The Freedom of Information and Protection of Privacy Act & The Local Authority Freedom of Information and Protection of Privacy Act) — Saskatchewan's public-body access and privacy laws, sharing the same oversight office — shipped as separate configurations Oversight: Office of the Saskatchewan Information and Privacy Commissioner (IPC) — Independent oversight under HIPA — reviews access and amendment matters and investigates privacy complaints, issuing recommendations rather than binding orders. A trustee decides whether to follow the recommendations, and an applicant may appeal to the Court of King's Bench, which decides the matter afresh. - Access deadline: Within 30 days to respond to a request for one's own record (s. 36), extendable by up to 30 days - Amendment: Trustees respond to an amendment request within 30 days; a refused amendment carries a notation on the record (s. 40) - Access fees: A reasonable, cost-recovery fee; no dollar amount is set in the Act or regulations (s. 39) - Breach handling: HIPA imposes a mandatory duty to protect personal health information (s. 16); the Commissioner recommends notifying affected individuals and the IPC as best practice - Oversight: Office of the Saskatchewan Information and Privacy Commissioner (recommendations, not binding orders) - Languages: English Q: How long does a Saskatchewan trustee have to respond to an access request? A: Under HIPA, a trustee must respond within 30 days to a request for access to the individual's own personal health information, with an extension of up to 30 days in defined circumstances. AccessPoint computes the due date on Saskatchewan's calendar and tracks every request against it. Q: Does Saskatchewan's Commissioner make binding orders? A: No. The Saskatchewan Information and Privacy Commissioner issues recommendations rather than binding orders. After a review, the trustee decides whether to follow them, and an applicant may appeal to the Court of King's Bench, which decides the matter afresh. AccessPoint keeps the investigation record and representations complete so your position is defensible. Q: Does HIPA require breaches to be reported? A: HIPA imposes a mandatory duty to protect personal health information, but it does not yet require breaches to be reported to affected individuals or the Commissioner — the Commissioner recommends notification as best practice. AccessPoint assesses each breach and produces the notifications on the timeline you choose, so you are ready if the law changes. Q: Where does Saskatchewan health data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, records, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Manitoba — PHIA (pack ca-mb-phia) URL: https://www.realizer.io/solutions/manitoba-phia — pack content last reviewed 2026-07-13 Legislation: PHIA (The Personal Health Information Act, C.C.S.M. c. P33.5) — Personal health information held by a trustee — a health professional, health care facility, public body, or health services agency Oversight: Manitoba Ombudsman, with the Information and Privacy Adjudicator — The Ombudsman investigates complaints and makes recommendations; where a trustee does not comply, only the Ombudsman may refer the matter to the Information and Privacy Adjudicator, who can make a binding order. - Access clock: Tiered under s. 6 — 24 hours (hospital in-patient's current care), 72 hours (current care outside hospital), 30 days otherwise - Correction requests: Decided within 30 days (s. 12), with a statement of disagreement if refused - Fees: A reasonable fee, capped by regulation; no fee for a correction request - Breach notification: Mandatory since January 1, 2022 (s. 19.0.1) on a real-risk-of-significant-harm test - Oversight: Manitoba Ombudsman; binding orders via the Information and Privacy Adjudicator - Languages: English Q: What is the access deadline under Manitoba PHIA? A: PHIA uses a tiered clock under section 6: 24 hours where the trustee is a hospital and the information is about care currently being provided to an in-patient; 72 hours where the information is about care the trustee is currently providing outside a hospital; and 30 days in any other case. AccessPoint calculates each tier automatically. Q: Does AccessPoint handle PHIA breach notification? A: Yes. Since January 1, 2022, a trustee must notify the affected individual and the Manitoba Ombudsman of a breach that could reasonably create a real risk of significant harm (s. 19.0.1). AccessPoint logs the breach, runs the harm assessment, and tracks the notices to closure. Q: How does oversight work in Manitoba? A: The Manitoba Ombudsman investigates complaints and makes recommendations. Where a trustee does not comply, only the Ombudsman may refer the matter to the Information and Privacy Adjudicator, who can make a binding order — after which the trustee must comply within the statutory window or seek judicial review. AccessPoint tracks the full path. Q: Where does Manitoba health data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Records, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### New Brunswick — PHIPAA (pack ca-nb-phipaa) URL: https://www.realizer.io/solutions/new-brunswick-phipaa — pack content last reviewed 2026-07-13 Legislation: PHIPAA (Personal Health Information Privacy and Access Act, S.N.B. 2009, c. P-7.05) — Access to and correction of personal health information held by custodians — in force September 1, 2010, and deemed substantially similar to Canada's PIPEDA for health custodians; RTIPPA (Right to Information and Protection of Privacy Act, S.N.B. 2009, c. R-10.6) — New Brunswick's public-body access and privacy law, sharing the same oversight office — shipped as a separate configuration Oversight: Office of the Ombud (New Brunswick) — Independent oversight of PHIPAA through its Access and Privacy Division — investigates access complaints and privacy-breach matters and issues recommendations rather than binding orders. The role was formerly a standalone Access to Information and Privacy Commissioner. - Access deadline: 30 business days for a custodian to respond to a request for one's own record, with a further period available in defined circumstances - Correction: Individuals may request correction of inaccurate or incomplete records, answered on the same 30-business-day timeline - Access fees: Examination is free; a fair and reasonable fee for search, preparation, copying, and delivery may apply under the regulations (copying capped at roughly $0.25 per page) - Breach notification: Custodians must notify the affected individual and the Ombud of theft, loss, or unauthorized access or disclosure, unless there is no adverse impact on the individual - Oversight: Office of the Ombud (recommendations, not binding orders) - Languages: English and French (New Brunswick is officially bilingual) Q: How long does a New Brunswick custodian have to respond to an access request? A: PHIPAA gives an individual the right to their own personal health information, and a custodian must respond within 30 business days of the request, with a further period available in defined circumstances. AccessPoint computes the due date on New Brunswick's business-day calendar, tracks every request against it, and flags anything at risk of running late. Q: Does AccessPoint handle correction requests and disclosure rules? A: Yes. Individuals can ask a custodian to correct a record that is inaccurate or incomplete, and AccessPoint runs correction requests alongside the consent and disclosure decisions that govern when personal health information may be shared — each captured with an auditable record. Q: How does it support breach notification? A: AccessPoint logs a privacy breach, walks you through assessing whether it could adversely affect the individual, and produces a live checklist of notifications to affected individuals and, where warranted, to the Office of the Ombud — the independent overseer of PHIPAA. Q: Where does New Brunswick health data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, records, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Nova Scotia — PHIA (pack ca-ns-phia) URL: https://www.realizer.io/solutions/nova-scotia-phia — pack content last reviewed 2026-07-13 Legislation: PHIA (Personal Health Information Act, S.N.S. 2010, c. 41) — Access to and correction of personal health information held by custodians — in force June 1, 2013; FOIPOP (Freedom of Information and Protection of Privacy Act, S.N.S. 1993, c. 5) — Nova Scotia's public-body access and privacy law, sharing the same oversight office — shipped as a separate configuration Oversight: Information and Privacy Commissioner for Nova Scotia (Review Officer) — Independent oversight under PHIA — reviews access, correction, and breach matters and issues recommendations rather than binding orders. Unresolved matters may be appealed to the Supreme Court of Nova Scotia. - Access deadline: As soon as possible and no later than 30 days to respond to a request for one's own record - Correction: Custodians must respond to a correction request within 30 days; there is no fee to request a correction - Access fees: Custodians may charge reasonable, cost-based fees for copies - Breach notification: Notify the individual at the first reasonable opportunity where a breach could cause harm or embarrassment; report to the Review Officer in the circumstances PHIA sets out - Oversight: Information and Privacy Commissioner / Review Officer (recommendations, not binding orders) - Languages: English Q: How long does a Nova Scotia custodian have to respond to an access request? A: Under PHIA, a custodian must respond as soon as possible and no later than 30 days after a request for access to the individual's own record; the deadline can be extended by 30 days, or longer with the Review Officer's permission. AccessPoint computes the due date on Nova Scotia's calendar and tracks every request against it. Q: Does the Review Officer make binding orders? A: No. Nova Scotia's Information and Privacy Commissioner acts as the Review Officer and issues recommendations rather than binding orders, and unresolved matters may be appealed to the Supreme Court of Nova Scotia. AccessPoint's reviews module keeps the investigation record and representations complete so your position is defensible at every stage. Q: How does it support breach notification? A: AccessPoint logs a breach, helps you assess whether it could cause the individual harm or embarrassment, and produces a live checklist of notification to the affected person and, in the circumstances PHIA sets out, to the Review Officer. Q: Where does Nova Scotia health data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, records, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Newfoundland & Labrador — PHIA (pack ca-nl-phia) URL: https://www.realizer.io/solutions/newfoundland-labrador-phia — pack content last reviewed 2026-07-13 Legislation: PHIA (Personal Health Information Act, S.N.L. 2008, c. P-7.01) — Access to and correction of personal health information held by custodians — in force April 1, 2011; ATIPPA, 2015 (Access to Information and Protection of Privacy Act, 2015, S.N.L. 2015, c. A-1.2) — The province's public-body access and privacy law, sharing the same oversight office — shipped as a separate configuration Oversight: Office of the Information and Privacy Commissioner (OIPC NL) — Independent oversight under PHIA — reviews access, correction, and breach complaints and issues recommendations; access refusals may be appealed to the Supreme Court of Newfoundland and Labrador, Trial Division. - Access deadline: 60 days for a custodian to respond to a request for one's own record - Correction: Individuals may request correction of factually inaccurate records - Access fees: A reasonable fee is permitted under section 57; information is often provided free at the point of care - Breach notification: Notify the individual and the OIPC where a breach could reasonably be expected to cause harm - Oversight: Office of the Information and Privacy Commissioner (recommendations; appeals to the Supreme Court) - Languages: English Q: How long does a custodian in Newfoundland and Labrador have to respond? A: PHIA gives an individual the right to their own personal health information, and a custodian must respond no later than 60 days after receiving the request. AccessPoint computes the due date on the provincial calendar and tracks every request against it. Q: What can a custodian charge for access? A: PHIA permits a reasonable fee under section 57, and the Commissioner has encouraged information to be provided free at the point of care where it is not voluminous. AccessPoint applies your fee categories consistently and records what was charged and why. Q: How does it support breach notification? A: AccessPoint logs a breach, helps you assess whether it could reasonably be expected to cause harm, and produces a live checklist of notification to the affected individual and to the Office of the Information and Privacy Commissioner using the Commissioner's reporting process. Q: Where does Newfoundland and Labrador health data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, records, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Prince Edward Island — HIA (pack ca-pe-hia) URL: https://www.realizer.io/solutions/prince-edward-island-hia — pack content last reviewed 2026-07-13 Legislation: HIA (Health Information Act, R.S.P.E.I. 1988, c. H-1.41) — Access to and correction of personal health information held by custodians, and the provincial Electronic Health Record — in force July 1, 2017; FOIPP (Freedom of Information and Protection of Privacy Act, R.S.P.E.I. 1988, c. F-15.01) — PEI's public-body access and privacy law, sharing the same oversight office — shipped as a separate configuration Oversight: Information and Privacy Commissioner of Prince Edward Island — Independent oversight of the Health Information Act — reviews access and correction decisions and oversees privacy breaches, issuing recommendations. - Access deadline: 30 days for a custodian to give an open, accurate, and complete response to a request for one's own record - Correction: Custodians must respond to a correction request within 30 days - Access fees: Custodians may charge reasonable, cost-based fees for copies - Breach notification: Custodians must notify affected individuals and the Information and Privacy Commissioner at the first reasonable opportunity, unless there is no adverse impact on health care or on the individual - Oversight: Information and Privacy Commissioner of Prince Edward Island (recommendations) - Languages: English Q: Is Prince Edward Island's Health Information Act in force? A: Yes. The Health Information Act came into force on July 1, 2017, and governs how custodians — including health care facilities, health care providers, Island EMS, and Canadian Blood Services — collect, use, disclose, and give individuals access to personal health information. AccessPoint ships pre-configured for it. Q: Does PEI require breaches to be reported to the Commissioner? A: Yes. Under the Health Information Act, custodians must notify affected individuals and the Information and Privacy Commissioner at the first reasonable opportunity, unless the breach will have no adverse impact on health care or on the individual. AccessPoint assesses adverse impact and computes both notifications. Q: How long does a custodian have to respond to an access request? A: A custodian must respond to a request for an individual's own personal health information within 30 days, and the response must be open, accurate, and complete. Correction requests carry the same 30-day response. AccessPoint tracks both against the Prince Edward Island calendar. Q: Where does Prince Edward Island health data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, records, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Yukon — HIPMA (pack ca-yt-hipma) URL: https://www.realizer.io/solutions/yukon-hipma — pack content last reviewed 2026-08-10 Legislation: Health Information Privacy and Management Act (SY 2013, c. 16 (HIPMA)) — Yukon's health privacy statute — how custodians collect, use, disclose, and safeguard health information, and the individual's rights over it; Access to one's own health information (HIPMA, access provisions) — An individual's right to examine and receive a copy of health information about themselves held by a custodian, subject to the Act's limited exceptions; Correction of health information (HIPMA, correction provisions) — The right to request correction of inaccurate or incomplete health information, with a statement of disagreement where correction is refused Oversight: Yukon Information and Privacy Commissioner — The Yukon IPC oversees HIPMA alongside the territory's ATIPP Act — reviewing complaints about access, correction, and privacy practices, investigating breaches, and making findings and recommendations to custodians. - Access deadline: 30 days, with an extension in the circumstances the Act allows - Correction: Correction, or a statement of disagreement where refused - Who is covered: Custodians under HIPMA — health facilities, practitioners, and territorial health bodies - Breach duty: Notification to the individual and the Commissioner where the Act requires it - Oversight: Yukon Information and Privacy Commissioner - Languages: English, French Q: Who is a custodian under HIPMA? A: The Act applies to the health facilities, practitioners, and territorial health bodies it designates as custodians of health information. If your organization holds health information about Yukoners in the course of providing care or administering the health system, HIPMA governs how you collect, use, disclose, and safeguard it — and gives individuals rights over it. Q: How long do we have to answer an access request? A: 30 days, with an extension in the circumstances the Act allows. AccessPoint computes the due date on receipt over Yukon's statutory-holiday calendar, tracks any extension with its ground and notice, and shows the clock on the file rather than leaving it to a spreadsheet. Q: Do you also run the territory's ATIPP Act? A: Yes — as a separate pack. Yukon's ATIPP Act (2021) governs access to records held by public bodies, and HIPMA governs health information held by custodians. AccessPoint ships each with its own clock, exceptions, and vocabulary, and an organization subject to both can run them side by side on one platform under one Commissioner. Q: Where does health information reside? A: Entirely within your own Microsoft 365 and Azure tenant. Records, requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Northwest Territories — HIA (pack ca-nt-hia) URL: https://www.realizer.io/solutions/northwest-territories-hia — pack content last reviewed 2026-08-10 Legislation: Health Information Act (SNWT 2014, c. 2 (HIA)) — The Northwest Territories' health privacy statute — custodian duties over collection, use, disclosure, and safeguarding of health information; Access and correction (HIA, access and correction provisions) — An individual's right to access health information about themselves and to request correction, with a statement of disagreement where correction is refused; Privacy impact assessments (HIA, PIA provisions) — The statutory duty to conduct a privacy impact assessment before implementing a new or substantially modified health information system Oversight: Northwest Territories Information and Privacy Commissioner — The NWT IPC oversees the Health Information Act alongside the territory's ATIPP Act — receiving breach notifications, reviewing complaints about access, correction, and privacy practices, and making findings and recommendations to custodians. - Access deadline: 30 days, with an extension in the circumstances the Act allows - Correction: Correction, or a statement of disagreement where refused - Breach duty: Mandatory — notice to the individual and to the Commissioner - PIA duty: Statutory, before a new or substantially modified health information system - Oversight: NWT Information and Privacy Commissioner - Languages: English, French Q: What makes the NWT Health Information Act different? A: Two duties stand out. Breach notification is mandatory rather than discretionary — both the affected individual and the Commissioner must be notified where the Act requires it. And a privacy impact assessment is a statutory precondition to implementing a new or substantially modified health information system, not merely good practice. AccessPoint ships both as real workflows. Q: How does the statutory PIA work in AccessPoint? A: As a full assessment case: a questionnaire scoped to the system under review, sections assigned to the people who can answer them, an embedded risk register where each risk carries a mitigation and an owner, and a versioned, dated summary with sign-off. Because it is dated and versioned, the assessment demonstrably precedes implementation — which is what the Act asks. Q: Do you also run the territory's ATIPP Act? A: Yes — as a separate pack. NWT's ATIPP Act governs access to records held by public bodies and carries a 20-business-day clock with order-making oversight; the HIA governs health information held by custodians. An organization subject to both runs each on its own rules on one platform. Q: Where does health information reside? A: Entirely within your own Microsoft 365 and Azure tenant. Records, requests, assessments, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Québec — Renseignements de santé (pack ca-qc-rsss) URL: https://www.realizer.io/solutions/quebec-rsss — pack content last reviewed 2026-07-13 Legislation: Loi 5 (LRSSS) (Loi sur les renseignements de santé et de services sociaux, CQLR c. R-22.1) — Access to, correction of, and protection of health and social services information held by health and social services bodies — core provisions in force July 1, 2024, with certain provisions phasing in later; Law 25 (Act to modernize legislative provisions as regards the protection of personal information, S.Q. 2021, c. 25) — Québec's broader privacy reform, whose privacy-by-default, consent, and assessment requirements Law 5 mirrors for the health sector Oversight: Commission d'accès à l'information (CAI) — Oversees the application of Law 5 with inspection and adjudicative powers. Law 5 is backed by penal sanctions of up to $150,000 rather than the administrative monetary penalties available under Law 25. - Access deadline: A maximum of 30 days to respond to a request for one's own health and social services information - Correction: Individuals may request correction of their information - Access fees: Access to one's own information is generally provided without charge, subject to reasonable reproduction or transcription costs - Breach notification: Report confidentiality incidents to the CAI and affected persons where there is a risk of serious harm, and keep a register of incidents - Oversight: Commission d'accès à l'information (inspection and adjudicative powers; penal sanctions up to $150,000) - Languages: French (primary), with English Q: What is Law 5 and when did it take effect? A: Law 5 is Québec's Loi sur les renseignements de santé et de services sociaux (LRSSS, CQLR c. R-22.1). Its core provisions came into force on July 1, 2024, with certain provisions phasing in later. It governs how health and social services bodies collect, use, communicate, and give individuals access to health information, and AccessPoint ships pre-configured for it. Q: How does Law 5 relate to Law 25? A: Law 5 is the health-sector regime and carries much of Law 25 into it — privacy by default, consent, and privacy assessments — while the Commission d'accès à l'information oversees both. AccessPoint maps Law 5 to the Law 25 requirements it mirrors so your health and general privacy programs stay aligned. Q: Does AccessPoint support the right to restrict access and confidentiality-incident reporting? A: Yes. AccessPoint records a person's directives to restrict who may see their information and enforces them in disclosure decisions, and it logs confidentiality incidents, assesses the risk of serious harm, and produces notifications to the Commission d'accès à l'information and affected individuals, with the register Law 5 requires. Q: Where does Québec health data reside? A: Entirely within your own Microsoft 365 and Azure tenant, presented in a French-first interface. Requests, records, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Canada — PIPEDA (pack ca-pipeda) URL: https://www.realizer.io/solutions/canada-pipeda — pack content last reviewed 2026-07-13 Legislation: PIPEDA (Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5) — Access to and correction of personal information held by private-sector organizations in the course of commercial activity; Breach of Security Safeguards Regulations (SOR/2018-64) — Mandatory breach reporting to the Privacy Commissioner, notification to affected individuals, and record-keeping of every breach — in force November 1, 2018 Oversight: Office of the Privacy Commissioner of Canada (OPC) — Independent ombudsman-model oversight — investigates complaints and breaches and issues findings and recommendations rather than binding orders. After the Commissioner reports, a complainant may apply to the Federal Court, which hears the matter afresh and can order changes and award damages. The Commissioner may also audit organizations and enter compliance agreements. - Access deadline: Respond to an access request no later than 30 days after receipt (s. 8(3)), with a single extension of up to 30 more days in defined circumstances (s. 8(4)) - Correction: Amend personal information shown to be inaccurate or incomplete; an unresolved challenge is recorded and passed to third parties with access (Schedule 1, cl. 4.9.5-4.9.6) - Access fees: Access must be at minimal or no cost; an organization may charge only after informing the individual of the approximate cost (s. 8(6)) - Breach reporting: Report breaches of security safeguards to the OPC and notify affected individuals where there is a real risk of significant harm, and keep a record of every breach (since November 1, 2018) - Oversight: Office of the Privacy Commissioner of Canada (ombudsman model; matters proceed to the Federal Court) - Languages: Bilingual — English and French Q: How long does an organization have to respond to a PIPEDA access request? A: PIPEDA requires an organization to respond to an access request no later than 30 days after receiving it, with a single extension of up to 30 more days where meeting the limit would unreasonably interfere with the organization's activities or where necessary consultations make it impracticable. AccessPoint computes the due date and tracks every request against it. Q: When must a breach be reported under PIPEDA? A: Since November 1, 2018, an organization must report a breach of security safeguards to the Office of the Privacy Commissioner of Canada and notify affected individuals where it is reasonable to believe the breach creates a real risk of significant harm — and it must keep a record of every breach, whatever harm it poses. AccessPoint assesses the real-risk test, computes both notifications, and maintains the breach register. Q: Does the Privacy Commissioner make binding orders? A: Not today. The OPC operates on an ombudsman model — it investigates and issues findings and recommendations, and a complainant can then apply to the Federal Court, which hears the matter afresh and can order changes and award damages. The Consumer Privacy Protection Act proposed under Bill C-27 would have added order-making and penalties, but it died when Parliament was prorogued in January 2025. AccessPoint keeps a defensible record either way. Q: Where does your PIPEDA data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, records, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### British Columbia — PIPA (pack ca-bc-pipa) URL: https://www.realizer.io/solutions/british-columbia-pipa — pack content last reviewed 2026-08-10 Legislation: Personal Information Protection Act (SBC 2003, c. 63 (PIPA)) — British Columbia's private-sector privacy law, governing how organizations collect, use, disclose, and secure personal information; Access to one's own personal information (PIPA, access provisions) — An individual's right to request the personal information an organization holds about them, how it has been used, and to whom it has been disclosed; Correction of personal information (PIPA, correction provisions) — The right to request correction of an error or omission, with annotation where the organization declines to correct Oversight: Office of the Information and Privacy Commissioner for British Columbia — The OIPC for BC oversees PIPA alongside the public-sector FIPPA. It is an order-making regulator — a Commissioner's order binds the organization, rather than merely recommending — which makes the record you keep on each request materially more important. - Access deadline: 30 business days, with an extension in the circumstances PIPA allows - Correction: Correction, or annotation where the organization declines - Who is covered: Private-sector organizations, non-profits, and associations operating in BC - Relationship to PIPEDA: Deemed substantially similar — PIPA displaces PIPEDA for intra-provincial activity - Oversight: OIPC for BC — order-making - Languages: English, French Q: Does PIPA or PIPEDA apply to my organization? A: For a private-sector organization's activity within British Columbia, PIPA applies — it has been deemed substantially similar to PIPEDA, so it displaces the federal law for intra-provincial activity. PIPEDA continues to govern federally regulated works and undertakings, and personal information crossing provincial or national borders in the course of commercial activity. AccessPoint ships both as separate packs so you can run whichever governs, or both. Q: How long do we have to answer an access request? A: 30 business days, with an extension in the circumstances PIPA allows. AccessPoint computes the due date on receipt over British Columbia's statutory-holiday calendar and tracks any extension with its ground and the notice given. Q: Does PIPA apply to non-profits? A: Yes — unlike PIPEDA, which is tied to commercial activity, BC's PIPA reaches organizations broadly, including many non-profits, societies, and associations operating in the province. That is one of the practical reasons BC organizations that assumed they were outside private-sector privacy law find that they are not. Q: Where does personal information reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, records, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Alberta — PIPA (pack ca-ab-pipa) URL: https://www.realizer.io/solutions/alberta-pipa — pack content last reviewed 2026-08-10 Legislation: Personal Information Protection Act (SA 2003, c. P-6.5 (PIPA)) — Alberta's private-sector privacy law, governing how organizations collect, use, disclose, and secure personal information; Access and correction (PIPA, access and correction provisions) — An individual's right to their own personal information, its uses and disclosures, and to request correction of an error or omission; Mandatory breach notification (PIPA, s. 34.1) — The duty to notify the Commissioner without unreasonable delay of an incident involving a real risk of significant harm to an individual Oversight: Office of the Information and Privacy Commissioner of Alberta — The OIPC of Alberta oversees PIPA alongside the public-sector access law and the Health Information Act. Under s.34.1 the Commissioner receives breach reports directly and may require an organization to notify affected individuals — a power that predates the equivalent federal duty by years. - Access deadline: 45 days, with an extension in the circumstances PIPA allows - Correction: Correction, or annotation where the organization declines - Breach duty: s.34.1 — notify the Commissioner without unreasonable delay where there is a real risk of significant harm - Who is covered: Private-sector organizations, non-profits, and associations operating in Alberta - Oversight: OIPC of Alberta — order-making - Languages: English, French Q: Does PIPA or PIPEDA apply to my organization? A: For a private-sector organization's activity within Alberta, PIPA applies — it has been deemed substantially similar to PIPEDA and displaces it intra-provincially. PIPEDA still governs federally regulated works and undertakings and information crossing provincial or national borders in commercial activity. AccessPoint ships both as separate packs. Q: What triggers the s.34.1 duty to notify the Commissioner? A: An incident involving the loss of, or unauthorized access to or disclosure of, personal information where a reasonable person would consider that there exists a real risk of significant harm to an individual. AccessPoint runs that assessment on every incident — the information involved, its sensitivity, the probability of misuse — and records the reasoning whether the outcome is to report or not to report. Q: How is Alberta's clock different from BC's? A: Alberta PIPA runs a 45-day access clock; British Columbia's PIPA runs 30 business days. The two Acts share a name and a purpose but differ in their detail, which is why AccessPoint ships them as separate packs rather than one generic western-Canada configuration. Q: Where does personal information reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, incidents, records, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Québec — Secteur privé (Loi 25) (pack ca-qc-prive) URL: https://www.realizer.io/solutions/quebec-secteur-prive — pack content last reviewed 2026-08-10 Legislation: Loi sur la protection des renseignements personnels dans le secteur privé (RLRQ c. P-39.1) — Québec's private-sector privacy statute, substantially modernized by Law 25 (2021) and phased in through 2024; Évaluation des facteurs relatifs à la vie privée (EFVP) (P-39.1, EFVP provisions) — The mandatory privacy impact assessment for projects acquiring, developing, or overhauling an information system involving personal information, and for communications outside Québec; Incidents de confidentialité (P-39.1, incident provisions) — The duty to keep an incident register, and to notify the Commission d'accès à l'information and affected individuals where an incident presents a risk of serious injury Oversight: Commission d'accès à l'information du Québec (CAI) — The CAI oversees both Québec's public-sector access regime and the private-sector law. Under Law 25 it receives confidentiality-incident notifications, reviews complaints, and holds significant administrative monetary penalty and sanction powers — the strongest enforcement toolkit of any Canadian privacy regulator. - Response deadline: 30 days for access, correction, portability, and de-indexing requests - EFVP: Mandatory for qualifying system projects and for communications outside Québec - Incidents: A register for every incident; CAI and individual notice where there is a risk of serious injury - Portability: Computerized personal information supplied in a structured, commonly used technological format - Automated decisions: Notice at the time of the decision, with a right to make observations - Languages: Français, English Q: Who does Québec's private-sector law apply to? A: Organizations that collect, hold, use, or communicate personal information in the course of carrying on an enterprise in Québec. Because Québec's regime has been deemed substantially similar to PIPEDA, it displaces the federal law for intra-provincial activity — so a Québec enterprise works to P-39.1 and answers to the CAI. Q: When is an EFVP mandatory? A: Law 25 requires a privacy impact assessment for any project to acquire, develop, or overhaul an information system or electronic service delivery involving personal information, and before communicating personal information outside Québec. AccessPoint runs the EFVP as a full assessment case — dated, versioned, and signed off — so the assessment demonstrably precedes the project. Q: Do we have to record incidents that aren't reportable? A: Yes. Law 25 requires a register of confidentiality incidents covering every incident, not only those that trigger notification. Notification to the CAI and to affected individuals is separately required where the incident presents a risk of serious injury. AccessPoint registers all incidents and runs the risk assessment that decides notification, recording the reasoning either way. Q: Is the platform available in French? A: Yes. AccessPoint's interface ships natively in French, and this pack is French-first — statutory wording, correspondence templates, and vocabulary in French, with English available for organizations that operate in both. ### United States — Federal (pack us-foia) URL: https://www.realizer.io/solutions/united-states-foia — pack content last reviewed 2026-07-24 Legislation: FOIA (Freedom of Information Act, 5 U.S.C. § 552) — Access to records under the control of a federal executive-branch agency; FOIA Improvement Act of 2016 (Pub. L. 114-185) — Codified the foreseeable-harm standard and a presumption of openness, a 25-year sunset on the deliberative-process privilege, and a minimum 90-day administrative-appeal window Oversight: Office of Government Information Services (OGIS) at the National Archives — The federal FOIA Ombudsman — offers voluntary mediation and dispute resolution, reviews agency FOIA compliance, and may issue advisory opinions; it does not order disclosure. Enforcement is by de novo review in the U.S. district courts, with government-wide policy set by the Department of Justice Office of Information Policy. - Response deadline: 20 business days to make a determination (5 U.S.C. § 552(a)(6)(A)) - Extensions: Additional 10 business days for unusual circumstances (§ 552(a)(6)(B)) - Filing fee: None; search, review, and duplication fees vary by requester category - Exemptions: Nine, under 5 U.S.C. § 552(b), applied with the foreseeable-harm test - Oversight: OGIS at the National Archives (FOIA Ombudsman, mediation); courts review de novo - Languages: English Q: Does AccessPoint handle Privacy Act requests too? A: Yes — as a separate companion configuration. This page covers the Freedom of Information Act pack; first-party access to and amendment of a person's own records under the Privacy Act of 1974 (5 U.S.C. § 552a) ships as its own pack. See the US Privacy Act solution page. Both run on the same platform, so an agency that answers both statutes works them in one system. Q: How does it track the 20-business-day deadline and extensions? A: AccessPoint computes business-day due dates from the federal holiday calendar and starts the clock at intake. It also tracks the additional 10-business-day extension for unusual circumstances under 5 U.S.C. § 552(a)(6)(B) — records from field offices, voluminous records, or consultation with another agency — with the notice to the requester on file. Q: Does it support OGIS mediation and administrative appeals? A: Yes. AccessPoint tracks the minimum 90-day administrative-appeal window and referrals to the Office of Government Information Services, the FOIA Ombudsman at the National Archives. OGIS offers voluntary mediation and is not order-making — final enforcement is by de novo review in the U.S. district courts, and AccessPoint keeps the record either path needs. Q: Where does agency data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### California (pack us-ca-pra) URL: https://www.realizer.io/solutions/california-pra — pack content last reviewed 2026-07-13 Legislation: California Public Records Act (Cal. Gov. Code §§ 7920.000 et seq.) — Access to records of state and local agencies; recodified by AB 473, operative January 1, 2023, without substantive change to the law; California Constitution (Cal. Const. art. I, § 3(b) (Proposition 59, 2004)) — Constitutional right of access to information concerning the conduct of the people's business, to be construed broadly in favour of access Oversight: California superior courts (no dedicated records agency) — California has no records commissioner, Attorney General ruling, or administrative appeal. A requester enforces the Public Records Act by petition for a writ of mandate in the superior court, and a prevailing requester recovers court costs and reasonable attorney's fees. - Response deadline: 10 days to determine whether disclosable records are held (Gov. Code § 7922.535) - Extensions: Up to 14 days more in unusual circumstances, by written notice - Application fee: None; copies at the direct cost of duplication - Enforcement: Writ of mandate in the superior court — no AG ruling, no administrative appeal - Oversight: The courts; a prevailing requester recovers attorney's fees - Languages: English Q: What is the deadline to respond under the California Public Records Act? A: Ten days. Within 10 days of receiving a request an agency must determine whether it holds disclosable records and notify the requester — this is a determination deadline, not a deadline to hand over the records. It can be extended by up to 14 days in unusual circumstances, on written notice. AccessPoint tracks both windows in calendar days, as section 7922.535 counts them. Q: Is there an Attorney General ruling or appeal step? A: No. Unlike some states, California has no Attorney General ruling and no administrative appeal. A requester who is refused enforces the right by petition for a writ of mandate in the superior court, and a prevailing requester recovers court costs and reasonable attorney's fees. AccessPoint keeps a complete, court-ready record for that path. Q: What can an agency charge for copies? A: Only the direct cost of duplication, plus the statutory programming cost to produce a record from an electronic system; there is no application fee for inspection. AccessPoint computes and logs the charge per request so it stays within the statutory limit. Q: Where does agency data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### New York (pack us-ny-foil) URL: https://www.realizer.io/solutions/new-york-foil — pack content last reviewed 2026-07-13 Legislation: FOIL (N.Y. Public Officers Law art. 6 (§§ 84–90)) — Access to records of state and local government agencies in New York; Personal Privacy Protection Law (N.Y. Public Officers Law art. 6-A (§§ 91–99)) — State agencies' handling of personal information and an individual's access to records about themselves Oversight: Committee on Open Government (advisory) — Advisory oversight — the Committee on Open Government issues advisory opinions and guidance on FOIL but does not order disclosure. A denial is challenged first by administrative appeal to the agency head, then by an Article 78 proceeding in State Supreme Court, where attorney's fees may be awarded. - Response deadline: 5 business days to grant, deny, or acknowledge in writing (POL § 89(3)(a)) - Production: Within a reasonable time, by an approximate date stated at acknowledgement - Copy fee: 25 cents per page for copies up to 9 by 14 inches, or actual reproduction cost - Appeal: 30 days to appeal to the agency head; decision in 10 business days; then Article 78 - Oversight: Committee on Open Government (advisory opinions) - Languages: English Q: How fast must a New York agency respond under FOIL? A: Within five business days of receiving a request, the agency must grant access, deny it in writing, or acknowledge the request in writing and give a reasonable approximate date for its response. AccessPoint starts the 5-business-day clock at intake, tracks the promised date, and flags a request before it drifts into a constructive denial. Q: How are appeals handled? A: A requester has 30 days to appeal a denial in writing to the agency head or governing body, which must fully explain its decision or grant access within 10 business days. If the denial stands, review is by an Article 78 proceeding in State Supreme Court, where the court may award attorney's fees. AccessPoint runs the appeal workflow on those clocks. Q: Is the Committee on Open Government an enforcement body? A: No — it is advisory. The Committee on Open Government issues advisory opinions and guidance on FOIL but does not order disclosure; enforcement runs through the administrative appeal and an Article 78 proceeding. AccessPoint builds the Committee's guidance into your exemption and timeliness rules. Q: Where does agency data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Texas (pack us-tx-pia) URL: https://www.realizer.io/solutions/texas-pia — pack content last reviewed 2026-07-13 Legislation: Texas Public Information Act (Tex. Gov't Code ch. 552) — Access to information collected, assembled, or maintained by a governmental body; Attorney General decisions (Tex. Gov't Code §§ 552.301–.306) — To withhold excepted information without a prior determination, a governmental body must request an Attorney General decision within 10 business days; the ruling generally issues within 45 business days Oversight: Texas Attorney General, Open Records Division — The Open Records Division issues the rulings that decide whether excepted information may be withheld — a governmental body must request a decision within 10 business days, or the information is presumed public, and the ruling binds that request. Requesters may also seek a writ of mandamus in court. - Response standard: Promptly; certify in writing if not available within 10 business days (§ 552.221) - To withhold: Request an Attorney General decision within 10 business days (§ 552.301) - AG ruling: Issued generally within 45 business days (§ 552.306) - Charges: Attorney General cost rules — standard paper copy 10 cents per page - Oversight: Texas Attorney General, Open Records Division - Languages: English Q: When must a Texas governmental body respond to a request? A: Information must be produced promptly. When it cannot be produced within 10 business days of the request, the officer for public information must certify that fact in writing to the requester and set a date and hour within a reasonable time when it will be available. AccessPoint computes the 10-business-day point and drafts the certification. Q: What makes Texas different — the Attorney General ruling? A: Yes. To withhold excepted information without a prior determination, the governmental body must request an Attorney General decision within 10 business days and notify the requester; otherwise the information is presumed public. The Open Records Division then rules, generally within 45 business days. AccessPoint manages the trigger, the briefing, and the file through to the ruling. Q: What can a governmental body charge? A: Charges follow the Attorney General's cost rules — a standard paper copy at 10 cents per page, plus labour and programming at the set rates; a requester may ask for an itemized estimate in advance. AccessPoint computes the charge to the cost rules and issues the estimate. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Florida (pack us-fl-sunshine) URL: https://www.realizer.io/solutions/florida-sunshine — pack content last reviewed 2026-07-13 Legislation: Florida Public Records Act (Ch. 119, Fla. Stat.) — Access to records made or received by any agency in connection with the transaction of official business; Constitutional right of access (Fla. Const. art. I, § 24) — Every person's right to inspect or copy any public record, subject only to constitutional or statutory exemptions; Government-in-the-Sunshine Law (§ 286.011, Fla. Stat.) — The open-meetings requirement — the companion of the public-records right in Florida's Sunshine framework Oversight: Florida Attorney General (advisory opinions and mediation) — Advisory oversight — the Attorney General issues public-records opinions and runs a voluntary Open Government Mediation Program, but does not order disclosure. Access rests on Article I, Section 24 of the Florida Constitution and Chapter 119, and is enforced by civil action or mandamus, with attorney's fees to a prevailing requester. - Response standard: No fixed deadline — a reasonable time to retrieve records and redact exempt material - Legal basis: Chapter 119, Fla. Stat., and Article I, Section 24 of the Florida Constitution - Copy fee: Up to 15 cents per one-sided page (20 cents two-sided; $1 certified) - Special service charge: Reasonable, labour-based, for extensive clerical, supervisory, or IT effort - Oversight: Attorney General — advisory opinions and voluntary mediation; the courts enforce - Languages: English Q: What is the deadline to respond to a Florida public-records request? A: There is no fixed statutory deadline. Chapter 119 requires production within a reasonable time — limited to the time needed to retrieve the records and redact exempt or confidential material — and unjustified delay is treated as an unlawful refusal of access. AccessPoint times each request and flags delay before it becomes a problem. Q: What can an agency charge? A: The statutory copy fee is up to 15 cents per one-sided page (20 cents two-sided; $1 for a certified copy). When a request requires extensive clerical, supervisory, or information-technology effort, the agency may add a reasonable special service charge based on the actual labour cost. AccessPoint computes both and itemizes them. Q: Is there an oversight body that orders disclosure? A: No records commissioner orders disclosure in Florida. The Attorney General issues advisory opinions and runs a voluntary Open Government Mediation Program, but enforcement is judicial — a civil action or mandamus, with attorney's fees to a prevailing requester. AccessPoint keeps a complete, court-ready record. Q: Where does agency data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Illinois (pack us-il-foia) URL: https://www.realizer.io/solutions/illinois-foia — pack content last reviewed 2026-07-13 Legislation: Illinois FOIA (Freedom of Information Act, 5 ILCS 140) — Records of Illinois state and local public bodies — agencies, boards, municipalities, districts, and other governmental units; Public Access Counselor (5 ILCS 140/9.5) — Binding-opinion review of denials by the Public Access Counselor in the Office of the Attorney General, subject to administrative review; Commercial-purpose requests (5 ILCS 140/3.1) — A separate 21-business-day response track for records requested for a commercial purpose Oversight: Public Access Counselor, Office of the Illinois Attorney General — Reviews denials and issues binding opinions enforceable against public bodies, or resolves matters by mediation; a binding opinion is subject to administrative review in the circuit court. - Response deadline: 5 business days to grant or deny (Section 3(d)) - Extensions: One 5-business-day extension for enumerated reasons (Section 3(e)) - Commercial requests: 21 business days for records sought for a commercial purpose (Section 3.1) - Copy fees: First 50 letter/legal black-and-white pages free, then $0.15 per page (Section 6) - Review of denials: Request for review by the Public Access Counselor — binding opinion within 60 days - Languages: English Q: How long does an Illinois public body have to respond to a FOIA request? A: Five business days to grant or deny (Section 3(d)), with one five-business-day extension for enumerated reasons (Section 3(e)). Requests for a commercial purpose have a separate 21-business-day track (Section 3.1). AccessPoint runs each on its own Illinois business-day clock, with reminders before the deadline. Q: What is the Public Access Counselor, and does AccessPoint support it? A: The Public Access Counselor sits in the Illinois Attorney General's office and reviews denials. It can issue a binding opinion — enforceable against the public body and subject only to administrative review — generally within 60 days of a request for review, or resolve the matter by mediation. AccessPoint keeps every request review-ready so a request for review is a package you already hold. Q: Does it handle Section 7 exemptions and redaction? A: Yes. AccessPoint ships the full Section 7(1) exemption catalogue, colour-coded for redaction, and records the specific exemption citation on each withholding — the same basis the Public Access Counselor and a reviewing court will expect. Q: Where does our FOIA data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Washington (pack us-wa-pra) URL: https://www.realizer.io/solutions/washington-pra — pack content last reviewed 2026-07-13 Legislation: Public Records Act (RCW 42.56) — Records of Washington state and local agencies, open for inspection and copying unless a specific exemption applies; Fullest assistance (RCW 42.56.100) — The agency's duty to provide the fullest assistance and the most timely possible action on requests for records; Judicial enforcement and penalties (RCW 42.56.550) — Court review of denials, mandatory costs and attorney fees, and a penalty of up to $100 per day for wrongful denial Oversight: Washington superior courts; Attorney General model rules (WAC 44-14) — The Public Records Act is enforced through the superior courts, which award costs, reasonable attorney fees, and per-day penalties; the Attorney General publishes non-binding model rules and advisory guidance. - Response deadline: 5 business days to respond (RCW 42.56.520) - Response options: Provide records, give an internet link, acknowledge with a reasonable estimate, seek clarification, or deny - Inspection: No charge to inspect records - Charges: Per-page copy charges and customized-service charges (RCW 42.56.120) - Penalties: Costs, attorney fees, and up to $100 per day for wrongful denial (RCW 42.56.550) - Languages: English Q: How fast must a Washington agency respond to a public records request? A: Within five business days the agency must do one of five things — provide the records, give an internet link to them, acknowledge the request and give a reasonable estimate of the time needed, seek clarification, or deny with reasons (RCW 42.56.520). AccessPoint tracks the five-business-day clock and records which response was made. Q: What is the "fullest assistance" duty? A: RCW 42.56.100 requires agencies to provide the fullest assistance to requesters and the most timely possible action on requests — including producing readily available records promptly and delivering large requests in installments. AccessPoint builds reasonable-estimate and installment production into the workflow. Q: What are the penalties for getting a PRA request wrong? A: Under RCW 42.56.550 a court may award costs, reasonable attorney fees, and a penalty of up to $100 for each day a person was wrongly denied the right to inspect or copy a record. Because exposure accrues daily, AccessPoint timestamps every action so the handling of each request is defensible on review. Q: Where does our public-records data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Pennsylvania (pack us-pa-rtkl) URL: https://www.realizer.io/solutions/pennsylvania-rtkl — pack content last reviewed 2026-07-24 Legislation: Pennsylvania Right-to-Know Law (65 P.S. §§ 67.101–67.3104) — Access to records of Commonwealth and local agencies, presumed public unless exempt; Office of Open Records appeals (65 P.S. §§ 67.1101–67.1102) — A requester may appeal a denial or deemed denial to the Office of Open Records within 15 business days; the OOR issues a binding final determination within 30 days Oversight: Pennsylvania Office of Open Records — The Office of Open Records hears appeals from denied and deemed-denied requests and issues final determinations that bind both the agency and the requester — an enforceable order on the 31st day unless a party appeals to Commonwealth Court, for a Commonwealth or legislative agency, or to the county Court of Common Pleas, for a local agency. - Response standard: Respond in writing within 5 business days; silence is a deemed denial (§ 67.901) - Extension: Up to 30 days more on written notice for stated reasons — legal review, off-site or archived records (§ 67.902) - Appeal: To the Office of Open Records within 15 business days; binding final determination in 30 days (§ 67.1101) - Exceptions: 30 enumerated exceptions in Section 708(b) (§ 67.708) - Charges: Up to 25 cents per page; no charge for legal or agency review (§ 67.1307) - Oversight: Pennsylvania Office of Open Records Q: When must a Pennsylvania agency respond to a request? A: An agency must respond in writing within 5 business days of receiving a written request. If it does not, the request is deemed denied. The agency may take up to 30 additional days on written notice for stated reasons — such as legal review or off-site records. AccessPoint computes the 5-business-day point and the extension and reminds you before each. Q: What makes Pennsylvania different — the Office of Open Records appeal? A: Yes. A requester who is denied, or deemed denied, may appeal to the Office of Open Records within 15 business days. An appeals officer reviews the record and issues a final determination within 30 days that binds both the agency and the requester, and becomes an enforceable order on the 31st day unless appealed to court. AccessPoint manages the window, the appeal record, and the file to the determination. Q: What can an agency charge? A: Charges follow Section 1307 — up to 25 cents per page for a standard copy, plus postage and certification at set rates, with no fee for legal or agency review; a requester can be asked to prepay when the estimate exceeds $100. AccessPoint computes the charge to the fee schedule and issues the estimate. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Ohio (pack us-oh-pra) URL: https://www.realizer.io/solutions/ohio-pra — pack content last reviewed 2026-07-24 Legislation: Ohio Public Records Act (Ohio Rev. Code § 149.43) — Access to records kept by any public office, produced promptly and within a reasonable period of time; Court of Claims public records complaints (Ohio Rev. Code § 2743.75) — An expeditious and economical alternative to a mandamus action — a complaint is referred to mediation, then a special master issues a report and recommendation to a judge Oversight: Ohio Court of Claims — The Court of Claims runs the R.C. 2743.75 special docket for public records disputes — a $25 complaint first goes to mediation with a court attorney or magistrate, and if that fails a special master issues a report and recommendation on which a judge enters a final order. A requester may instead seek a writ of mandamus in court, but not both. - Response standard: Copies promptly and within a reasonable period of time — no fixed day count (R.C. 149.43(B)(1)) - Enforcement: By mandamus, or a R.C. 2743.75 Court of Claims complaint ($25) after a 3-business-day notice to cure - Exceptions: Records excepted from 'public record' under R.C. 149.43(A)(1) - Charges: Actual cost of copies — no profit and no statutory per-page maximum (R.C. 149.43(B)(1)) - Oversight: Ohio Court of Claims (special docket) or the courts on mandamus - Languages: English Q: When must an Ohio public office respond to a request? A: The Public Records Act sets no fixed number of days. Records must be made available for inspection promptly, and copies provided within a reasonable period of time — judged on the facts, such as the volume and the redaction needed. AccessPoint time-stamps each request and flags ageing files so your response stays within a reasonable time and is defensible on the record. Q: What makes Ohio different — the Court of Claims path? A: Yes. Instead of a mandamus lawsuit, a requester can file a complaint with the Court of Claims under R.C. 2743.75 for a $25 fee, after giving the office three business days to cure. The case goes to mediation first, then to a special master whose report and recommendation a judge adopts, modifies, or rejects. AccessPoint tracks the cure notice, the record, and the file to the order. Q: What can a public office charge? A: Only the actual cost of the copies — the office cannot profit from a request, and Ohio sets no statutory per-page maximum. A requester may ask for records on paper, on a chosen medium, or by email, and the office charges the real cost of that medium. AccessPoint itemizes the charge at cost. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Georgia (pack us-ga-ora) URL: https://www.realizer.io/solutions/georgia-ora — pack content last reviewed 2026-07-24 Legislation: Georgia Open Records Act (O.C.G.A. §§ 50-18-70–50-18-77) — Access to public records of state and local agencies, open unless a specific exemption applies; Response and enforcement (O.C.G.A. §§ 50-18-71, 50-18-73) — Records produced within 3 business days; a requester may seek Attorney General mediation or a superior-court action to compel, with attorney's fees available Oversight: Georgia Attorney General (Open Government Mediation Program) and the superior courts — The Attorney General's Open Government Mediation Program offers informal mediation of open-records disputes with local governments, and the Attorney General may bring civil or criminal enforcement. A requester may also petition the superior court to compel disclosure, where a judge can order production and award attorney's fees. - Response standard: Within 3 business days — produce, or state the cost and a timeline (§ 50-18-71(b)(1)(A)) - Mediation & enforcement: Attorney General mediation, or a superior-court action to compel with attorney's fees (§ 50-18-73) - Exemptions: Statutory exemptions in § 50-18-72, each cited when a record is withheld - Charges: Up to 10 cents per page; labour at the lowest-paid capable employee's rate, first quarter-hour free (§ 50-18-71(c)) - Oversight: Georgia Attorney General and the superior courts - Languages: English Q: When must a Georgia agency respond to a request? A: Within 3 business days. In that window the records custodian must produce the responsive records or, where they cannot be produced then, state in writing the records being withheld with the exemption cited, or give a good-faith estimate of the cost and a timeline. AccessPoint computes the three-business-day deadline from intake and reminds the custodian before it lands. Q: What makes Georgia different — the 3-business-day clock? A: Yes. Three business days is one of the tightest response duties in the country, and there is no routine extension to a comfortable few weeks — a knowing and willful failure is a misdemeanour. The custodian must respond fast, producing records or explaining the withholding and the cost. AccessPoint drives the deadline, the reminders, and the produce-or-explain response. Q: What can an agency charge? A: Charges follow Section 71 — up to 10 cents per page for letter or legal copies, plus search, retrieval, and redaction labour at the hourly rate of the lowest-paid full-time employee with the skill to do it, with the first quarter-hour free; prepayment can be required when the estimate exceeds $500. AccessPoint computes the charge and issues the estimate. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### New Jersey (pack us-nj-opra) URL: https://www.realizer.io/solutions/new-jersey-opra — pack content last reviewed 2026-07-24 Legislation: New Jersey Open Public Records Act (N.J.S.A. 47:1A-1 et seq.) — Access to government records made, maintained, kept on file, or received by a public agency in the course of its official business; OPRA appeals (N.J.S.A. 47:1A-6) — A requestor denied access may, at their option, file a complaint with the Government Records Council or bring an action in Superior Court before a designated judge; a prevailing requestor is entitled to a reasonable attorney's fee Oversight: New Jersey Government Records Council (GRC) — The Government Records Council mediates and adjudicates denial-of-access complaints under OPRA, issues advisory opinions, and trains custodians — a free administrative alternative to court whose final decisions are appealable to the Appellate Division. A requestor may instead take the dispute to the Superior Court, heard by a judge designated for records cases; the choice of forum is the requestor's alone. - Response standard: 7 business days from receipt — 14 if redaction is required, 21 if records are in storage; no response is a deemed denial (§ 47:1A-5) - Appeal route: Requestor's choice — Government Records Council complaint or Superior Court action (§ 47:1A-6) - Exemptions: Records excluded from the definition of 'government record' (§ 47:1A-1.1) and the § 47:1A-9 exceptions - Charges: $0.05 per letter-size page, $0.07 per legal-size page; special service charge for an extraordinary expenditure of time - Oversight: New Jersey Government Records Council - Languages: English Q: When must a New Jersey agency respond to an OPRA request? A: Within 7 business days of receipt — extended to 14 business days where the records require redaction and 21 business days where they are in storage or archived, with commercial requests generally on the 14-business-day track. A custodian who does not respond in time is treated as having denied the request. AccessPoint computes each deadline against the New Jersey holiday calendar and flags the deemed-denial date. Q: What makes New Jersey different — the choice of appeal forum? A: Yes. Under N.J.S.A. 47:1A-6 a requestor denied access chooses the forum: file a complaint with the Government Records Council, a free administrative body that mediates and adjudicates the dispute, or bring an action in the Superior Court before a designated judge. The right to institute either proceeding is the requestor's alone, and a prevailing requestor recovers a reasonable attorney's fee. AccessPoint keeps the record and correspondence ready for whichever route is taken. Q: What can an agency charge? A: The statutory copy fees are 5 cents per letter-size page and 7 cents per legal-size page; for electronic or special-format records the actual cost of the medium applies. Where a request requires an extraordinary expenditure of staff time, the custodian may add a reasonable special service charge based on the actual cost. AccessPoint computes the charge and issues the estimate. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### North Carolina (pack us-nc-pra) URL: https://www.realizer.io/solutions/north-carolina-pra — pack content last reviewed 2026-07-24 Legislation: North Carolina Public Records Act (N.C. Gen. Stat. Ch. 132) — Access to public records made or received in the transaction of public business by any agency of North Carolina government or its subdivisions; Mediation of public records disputes (N.C. Gen. Stat. § 7A-38.3E) — Mediation is a mandatory step in a public-records civil action — initiated within 30 days of the responsive pleadings — and a jurisdictional prerequisite to the superior court deciding the case Oversight: North Carolina Superior Court (no central records agency) — North Carolina has no information commissioner or central oversight agency. A person denied access enforces the Act by a civil action in the superior court, which must go through mandatory mediation under G.S. 7A-38.3E before a judge decides; the action is set for immediate hearing and a court may award reasonable attorney's fees. The Attorney General offers non-binding guidance only. - Response standard: As promptly as possible; inspection during regular business hours (G.S. 132-6) - Enforcement: Civil action in superior court after mandatory mediation (G.S. 7A-38.3E) - Exemptions: Narrow, specific exceptions scattered through the General Statutes — few by design - Charges: No fee to inspect; uncertified copies at actual cost; special service charge for extensive IT or clerical time (G.S. 132-6.2) - Oversight: No central agency — the superior courts enforce the Act - Languages: English Q: How quickly must a North Carolina agency respond to a request? A: The Act sets no fixed number of days. Records must be made available for inspection and copying as promptly as possible during regular business hours, and an agency may not use delay as a way to avoid disclosure. AccessPoint tracks the age of every request so an agency can show it acted promptly rather than merely assert it. Q: What makes North Carolina different — mediation before court? A: Two things together. Access is exceptionally broad — records are the property of the people under G.S. 132-1 and the exceptions are few and specific — and there is no oversight agency to appeal to. A denied requester enforces the Act by suing in superior court, but under G.S. 7A-38.3E mediation is a mandatory, jurisdictional step that must happen before a judge decides. AccessPoint keeps a documented record ready for both. Q: What can an agency charge? A: There is no charge to inspect public records. For copies, an agency may charge no more than the actual cost of reproduction; where a request requires extensive use of information technology or extensive clerical or supervisory assistance, it may add a reasonable special service charge based on actual labour cost (G.S. 132-6.2). AccessPoint computes the charge and issues the estimate. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Michigan (pack us-mi-foia) URL: https://www.realizer.io/solutions/michigan-foia — pack content last reviewed 2026-07-24 Legislation: Michigan Freedom of Information Act (MCL 15.231 et seq.) — Access to public records prepared, owned, used, in the possession of, or retained by a public body in the performance of an official function; FOIA appeals (MCL 15.240) — A requester may appeal a denial in writing to the head of the public body, who responds within 10 business days, and may then bring an action in the circuit court — the Court of Claims for a state public body — within 180 days of the final denial Oversight: Head of the public body, then the Circuit Court (no central FOIA agency) — Michigan has no central FOIA commissioner. A requester appeals a denial first to the head of the public body, who must respond within 10 business days, and may then sue in the circuit court — the Court of Claims for a state body — within 180 days. A prevailing requester may recover attorney's fees, and a court may assess punitive damages for an arbitrary and capricious denial. The Attorney General publishes guidance only. - Response standard: 5 business days; one extension of up to 10 business days on written notice (MCL 15.235(2)(d)) - Fee deposit: Good-faith deposit up to 50% when the estimated fee exceeds $50 (MCL 15.234) - Exemptions: The section 13(1) exemptions (MCL 15.243) - Charges: Search and review labour, copying at actual cost, and mailing — no overhead (MCL 15.234) - Oversight: Appeal to the head of the public body, then the Circuit Court - Languages: English Q: When must a Michigan public body respond to a FOIA request? A: Within 5 business days of receiving the request, by granting it, denying it, granting it in part and denying it in part, or issuing one written notice extending the time by no more than 10 business days. A failure to respond in time is treated as a final decision to deny. AccessPoint computes each deadline against the Michigan holiday calendar and flags the extension window. Q: What makes Michigan different — the appeal and deposit rules? A: Yes. Under MCL 15.240 a denied requester appeals first to the head of the public body — a written appeal stating the word 'appeal' — who has 10 business days to respond before any circuit-court action (the Court of Claims for a state body) within 180 days. Separately, under MCL 15.234 the body may require a good-faith deposit of up to 50% once the estimated fee exceeds $50. AccessPoint manages the appeal record and the deposit together. Q: What can a public body charge? A: Only the labour to search for, examine, review, and separate exempt material, the actual cost of copies, and mailing — never overhead. When the estimated fee tops $50 the body may require a good-faith deposit of up to half, with an itemized estimate, and the balance is due within 45 days of the notice (MCL 15.234). AccessPoint computes the charge and issues the estimate and deposit request. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Virginia (pack us-va-foia) URL: https://www.realizer.io/solutions/virginia-foia — pack content last reviewed 2026-07-24 Legislation: Virginia Freedom of Information Act (Va. Code § 2.2-3700 et seq.) — Access to public records held by public bodies, officials, and employees, for citizens of the Commonwealth and representatives of the media; Virginia Freedom of Information Advisory Council (Va. Code § 30-178 et seq.) — Issues advisory opinions interpreting FOIA and provides training; it advises and clarifies but cannot compel production — enforcement is by court petition under § 2.2-3713 Oversight: Virginia Freedom of Information Advisory Council (FOIA Council) — The FOIA Council issues advisory opinions — oral or written — that interpret the Act and help resolve disputes, and it trains officials and requesters. Its opinions guide practice but do not bind or compel; a requester enforces access by petition for mandamus or injunction in the general district or circuit court. - Response standard: Promptly, and in all cases within 5 working days; up to 7 additional working days if not practically possible (§ 2.2-3704(B)) - Who may request: Citizens of the Commonwealth and representatives of Virginia media (§ 2.2-3704(A)) - Exclusions: Discretionary exclusions — records may be withheld at the custodian's discretion (§§ 2.2-3705.1 to 2.2-3705.8) - Charges: Reasonable charges not to exceed actual cost of accessing, duplicating, supplying, or searching (§ 2.2-3704(F)) - Oversight: Virginia Freedom of Information Advisory Council; enforcement by court petition (§ 2.2-3713) - Languages: English Q: When must a Virginia public body respond to a FOIA request? A: Promptly, and in all cases within five working days of receiving the request. If it is not practically possible to respond within that time, the public body may take an additional seven working days (longer for certain criminal investigative files) after notifying the requester. AccessPoint computes the five-working-day point and drafts the extension notice. Q: What makes Virginia different — who can file, and who oversees FOIA? A: Virginia FOIA rights run only to citizens of the Commonwealth and to representatives of Virginia media, so requester status matters at intake. Oversight is advisory: the Virginia Freedom of Information Advisory Council issues opinions interpreting the Act but cannot compel production — binding relief comes by petition for mandamus or injunction in court. AccessPoint captures requester status and keeps both routes in view. Q: What can a public body charge? A: Reasonable charges that do not exceed the actual cost incurred in accessing, duplicating, supplying, or searching for the requested records; a requester may ask for a cost estimate in advance, and a deposit may be required for larger requests. AccessPoint computes the charge to actual cost and issues the estimate. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Massachusetts (pack us-ma-prl) URL: https://www.realizer.io/solutions/massachusetts-prl — pack content last reviewed 2026-07-24 Legislation: Massachusetts Public Records Law (G.L. c. 66 § 10; c. 4 § 7(26)) — Public inspection and copies of records held by state and municipal agencies; 'public records' is defined, with exemptions, at c. 4 § 7(26); Administrative and judicial appeal (G.L. c. 66 § 10A) — The Supervisor of Records issues written determinations and orders relief; unmet orders may be referred to the Attorney General, and requesters may sue in the Superior Court Oversight: Supervisor of Records, Public Records Division (Secretary of the Commonwealth) — On a requester's petition, the Supervisor of Records issues a written determination and, on finding a violation, orders the records access officer to produce records. If an agency will not comply, the Supervisor may refer the matter to the Attorney General, who may act to ensure compliance; requesters may also sue in the Superior Court. - Response standard: Written response within 10 business days (G.L. c. 66 § 10(a)–(b)) - Appeal: Petition the Supervisor of Records, who orders relief on finding a violation (§ 10A(b)) - Exemptions: The lettered exemptions (a)–(x) of clause Twenty-sixth (G.L. c. 4 § 7(26)) - Charges: 5 cents per page for black-and-white copies; first 2–4 hours of labour free, then up to $25/hour - Oversight: Supervisor of Records; Attorney General enforcement; Superior Court (§ 10A) - Languages: English Q: When must a Massachusetts agency respond to a public records request? A: Within ten business days, the records access officer must provide a written response — the records, a good-faith fee estimate, or a denial that cites a specific exemption. The Supervisor of Records may grant a limited good-cause extension. AccessPoint computes the ten-business-day point and drafts the response. Q: What makes Massachusetts different — the Supervisor of Records? A: Yes. A denied requester can petition the Supervisor of Records, who issues a written determination and, on finding a violation, orders the records access officer to produce the records. Unmet orders may be referred to the Attorney General, and requesters may sue in the Superior Court, where bad faith invites $1,000–$5,000 in punitive damages. AccessPoint assembles the petition record and tracks the file to the order. Q: What can an agency charge? A: Under the reformed rules, five cents per page for black-and-white copies or printouts; the first four hours of labour are free for state agencies and the first two for larger municipalities, with time then capped at $25 per hour unless the Supervisor approves more. AccessPoint computes the charge and issues an itemized estimate. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Arizona (pack us-az-prl) URL: https://www.realizer.io/solutions/arizona-prl — pack content last reviewed 2026-07-24 Legislation: Arizona Public Records Law (A.R.S. § 39-121 et seq.) — Public records and other matters in the custody of public officers are open to inspection; records must be furnished promptly during regular office hours; Commercial-purpose requests and enforcement (A.R.S. §§ 39-121.03, 39-121.02) — Commercial-purpose requesters file a statement of purpose and pay a surcharge reflecting commercial value; wrongful denial is challenged by special action in the superior court Oversight: No administrative appeal body — the superior court — Arizona has no records ombudsman or appeal board. A requester denied access enforces the law by special action in the superior court, which may order production and, where the requester substantially prevails, award attorney fees; wrongful denial can also support a claim for damages. - Response standard: Access promptly during regular office hours; no fixed statutory day count (A.R.S. § 39-121.01(D)) - Exemptions: No enumerated list — withholding turns on the common-law balancing test (Carlson v. Pima County) - Commercial purpose: A statement of purpose and a surcharge reflecting commercial value (A.R.S. § 39-121.03) - Charges: A copy fee where facilities allow; free for statutory purposes; commercial value added for commercial use - Oversight: No administrative appeal body; special action in the superior court (A.R.S. § 39-121.02) - Languages: English Q: How quickly must an Arizona custodian respond to a records request? A: Arizona sets no fixed number of days — records open to inspection must be furnished promptly during regular office hours, which the courts read as within a reasonable time given the request. AccessPoint clocks each request from intake so 'promptly' is measured and defensible. Q: What makes Arizona different — no exemption list? A: Yes. Arizona enumerates no exemptions. Records are presumed open, and a record is withheld only where confidentiality, personal privacy, or the best interests of the state outweigh disclosure under the common-law balancing test from Carlson v. Pima County — with redaction preferred to outright denial. AccessPoint documents the balancing decision for every record. Q: What can a custodian charge? A: For ordinary requests, a copy fee where facilities are available, and no charge for records sought for the statutory purposes the law protects. Commercial requesters must file a statement of purpose and pay a surcharge — the cost of time, materials, equipment, and personnel plus the reproduction's value on the commercial market. AccessPoint computes both and itemizes the charge. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Colorado (pack us-co-cora) URL: https://www.realizer.io/solutions/colorado-cora — pack content last reviewed 2026-07-24 Legislation: Colorado Open Records Act (CORA) (C.R.S. § 24-72-200.1 et seq.) — Public inspection of records made, maintained, or kept by any state or local governmental entity; Public records exemptions (C.R.S. § 24-72-204) — Three tiers — mandatory nondisclosure where other law or a privilege forbids release (§ 204(1)), discretionary denial where disclosure would be contrary to the public interest (§ 204(2)), and specifically exempt records the custodian shall not disclose (§ 204(3)) Oversight: Colorado district courts (judicial enforcement) — Colorado has no central open-records tribunal or ombudsman; CORA is enforced in court. An applicant denied inspection may apply to the district court for an order to show cause after giving the custodian at least fourteen days' written notice, and a prevailing applicant recovers court costs and attorney fees (§ 24-72-204(5)). - Response standard: Records available within three working days of receipt; up to seven additional working days for extenuating circumstances (§ 24-72-203(3)(b)) - Enforcement: No administrative appeal — apply to the district court for an order to show cause after 14 days' written notice (§ 24-72-204(5)) - Exemptions: Three tiers — mandatory (§ 204(1)), discretionary / public-interest (§ 204(2)), and specifically exempt (§ 204(3)) - Charges: Copies up to 25 cents per standard page; research and retrieval first hour free, then a capped statutory hourly rate (§ 24-72-205(5)–(6)) - Oversight: Colorado district courts; a prevailing applicant recovers attorney fees - Languages: English Q: When must a Colorado records custodian respond? A: Records must be made available within three working days of receipt. When extenuating circumstances exist — a voluminous request, records in remote storage, or the need to consult another entity — the custodian may issue written notice extending the deadline by up to seven additional working days. AccessPoint computes both points and drafts the extension notice. Q: What makes Colorado different — the three exemption tiers? A: Yes. CORA sorts every withholding into three tiers: mandatory nondisclosure where other law forbids release (§ 204(1)), discretionary denial where disclosure would be contrary to the public interest (§ 204(2)), and specifically exempt records the custodian shall not disclose (§ 204(3)). AccessPoint tags each record to its tier so the correct test is applied. Q: What can a governmental entity charge? A: Copies cost up to 25 cents per standard page. Research and retrieval is free for the first hour, then billed at a capped statutory hourly rate — but only if the entity published its fee policy before the request was received. AccessPoint computes the charge and issues the estimate. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Minnesota (pack us-mn-gdpa) URL: https://www.realizer.io/solutions/minnesota-gdpa — pack content last reviewed 2026-07-24 Legislation: Minnesota Government Data Practices Act (MGDPA) (Minn. Stat. Ch. 13) — Access to, and classification of, all government data created, collected, received, maintained, or disseminated by a Minnesota government entity; Advisory opinions (Minn. Stat. § 13.072) — The Commissioner of Administration issues written advisory opinions on data access, classification, and data-subject rights within 50 days; nonbinding, but given deference by a court, and an entity that follows one is shielded from damages and attorney-fee awards Oversight: Commissioner of Administration — Information Policy Analysis Division (IPAD) — IPAD administers Chapter 13 and issues the Commissioner's advisory opinions on data classification, public access, and data-subject rights (§ 13.072). The opinions are not binding, but a court must give them deference, and an entity acting in conformity is shielded from damages and attorney-fee awards. Enforcement itself runs through the district court or the Office of Administrative Hearings (§§ 13.08, 13.085). - Response standard: Public data produced in an appropriate and prompt manner (§ 13.03, subd. 2); a data subject is shown data about themselves within 10 days (§ 13.04, subd. 3) - Advisory opinions: The Commissioner of Administration (IPAD) issues written opinions within 50 days — nonbinding but given deference in court (§ 13.072) - Data classification: Every element is public, private, confidential, nonpublic, or protected nonpublic (§ 13.02) — not an exemption list - Charges: 100 or fewer letter/legal pages: up to 25 cents per page; otherwise the actual cost of search, retrieval, and copying (§ 13.03, subd. 3) - Oversight: Commissioner of Administration (IPAD); enforcement in district court or the Office of Administrative Hearings - Languages: English Q: How fast must a Minnesota government entity respond? A: Public data must be produced in an appropriate and prompt manner (§ 13.03, subd. 2); the statute sets no fixed number of days. When an individual asks to see data about themselves, the responsible authority must comply immediately if possible, or within ten days excluding weekends and holidays (§ 13.04, subd. 3). AccessPoint tracks both clocks. Q: What makes Minnesota different — the data-classification model? A: Yes. Chapter 13 has no exemption list. All government data are public unless classified otherwise, and every element is public, private, confidential, nonpublic, or protected nonpublic (§ 13.02). Access follows the classification. AccessPoint stores the class with the data so the right person sees the right element. Q: What can a government entity charge? A: For 100 or fewer black-and-white letter or legal pages, no more than 25 cents per page; beyond that, the actual cost of searching for, retrieving, and copying the data (§ 13.03, subd. 3). AccessPoint computes the charge and issues the estimate. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Connecticut (pack us-ct-foia) URL: https://www.realizer.io/solutions/connecticut-foia — pack content last reviewed 2026-07-24 Legislation: Connecticut Freedom of Information Act (C.G.S. § 1-200 et seq. (Title 1, Ch. 14)) — Public inspection and copying of the records of any public agency, promptly during regular business hours; Appeals to the Freedom of Information Commission (C.G.S. § 1-206) — A person denied access may appeal to the Commission within 30 days; the Commission mediates, holds a hearing, issues binding orders to disclose, and may impose civil penalties — its orders enforceable in Superior Court Oversight: Connecticut Freedom of Information Commission (FOIC) — The Freedom of Information Commission hears appeals within 30 days of a denial (§ 1-206(b)), assigns an ombudsman to mediate, and after a contested-case hearing issues binding orders to produce records — not mere advice. It may impose civil penalties on officials, and its orders are enforceable in Superior Court, with noncompliance a class B misdemeanor. - Response standard: Promptly during regular business hours; a failure to respond within 4 business days is deemed a denial (§§ 1-210(a), 1-206(a)) - Appeal: To the Freedom of Information Commission within 30 days of denial; a binding order after hearing (§ 1-206(b)) - Exemptions: The twenty-five categories of § 1-210(b) — including privacy, law-enforcement, preliminary-draft, and trade-secret records - Charges: Copies up to 25 cents per page (state agencies) or 50 cents per page (other public agencies) (§ 1-212) - Oversight: Freedom of Information Commission — binding orders and civil penalties up to $5,000, enforceable in Superior Court - Languages: English Q: When must a Connecticut public agency respond? A: Records must be provided promptly during regular business hours. A denial must be made in writing within four business days, and a failure to comply within four business days is itself deemed a denial (§ 1-206(a)), which starts the 30-day appeal clock. AccessPoint tracks the four-business-day point and drafts the response. Q: What makes Connecticut different — the Freedom of Information Commission? A: Yes. A denied requester appeals to the Commission within 30 days (§ 1-206(b)). After ombudsman mediation and a contested-case hearing, the Commission issues a binding order to produce — enforceable in Superior Court — and may impose civil penalties on the official. AccessPoint tracks the window and assembles the appeal file. Q: What can a public agency charge? A: Copies cost up to 25 cents per page for state agencies and up to 50 cents per page for all other public agencies (§ 1-212). AccessPoint computes the charge and issues the total. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### South Carolina (pack us-sc-foia) URL: https://www.realizer.io/solutions/south-carolina-foia — pack content last reviewed 2026-07-24 Legislation: South Carolina Freedom of Information Act (S.C. Code Ann. § 30-4-10 et seq.) — Public access to records of state and local public bodies; Response and production deadlines (S.C. Code Ann. § 30-4-30) — A public body must give its determination within 10 business days (20 for records 24 months or older), then furnish records within 30 calendar days of that determination (35 for older records) — or, where a deposit up to 25% is required, within 30 days of receiving it Oversight: South Carolina circuit court (judicial enforcement) — South Carolina has no FOIA commission or ombudsman with binding power. A requester denied records may apply to the circuit court under § 30-4-100 for a declaratory judgment and injunctive relief within one year, and either side may seek a § 30-4-110 hearing — with an initial hearing set within ten days, the matter concluded within six months, and a civil fine up to $500 for an arbitrary and capricious violation. The Attorney General issues advisory FOIA opinions, but they do not bind. - Response standard: Determination within 10 business days; 20 business days for records 24 months or older (§ 30-4-30) - Production: Furnished within 30 calendar days of the determination (35 for older records); a required deposit starts the clock (§ 30-4-30) - Exemptions: Matters exempt from disclosure (§ 30-4-40) - Charges: Actual cost of search, retrieval, and redaction; copies at no more than the prevailing commercial rate; deposit up to 25% (§ 30-4-30) - Oversight: Enforced in the circuit court (§§ 30-4-100, 30-4-110); Attorney General advisory opinions - Languages: English Q: When must a South Carolina public body respond to a request? A: In two steps. The public body must notify the requester of its determination whether it will comply within 10 business days — or 20 business days if the records are more than 24 months old. It must then furnish the records within 30 calendar days of that determination (35 for older records), and where a deposit is required the production clock runs from when the deposit is received. AccessPoint computes both deadlines from intake. Q: What makes South Carolina different — the two-step timeline? A: Yes. Unlike laws that set one deadline, South Carolina separates the decision from the delivery: a determination within 10 or 20 business days, then a distinct 30- or 35-calendar-day window to produce the records. AccessPoint tracks the response clock and the production clock as separate deadlines so neither slips. Q: What can a public body charge? A: Reasonable fees not to exceed the actual cost of the search, retrieval, and redaction of records, with copies at no more than the prevailing commercial rate. There is no charge for the examination and review to determine whether records are subject to disclosure, and a deposit of up to 25% of the anticipated cost may be required. AccessPoint computes the charge and issues the deposit request. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Maryland — Public Information Act (pack us-md-pia) URL: https://www.realizer.io/solutions/maryland-pia — pack content last reviewed 2026-08-10 Legislation: Maryland Public Information Act (Md. Code, General Provisions, Title 4) — The public right of access to records held by Maryland state and local government units; Required and permitted denials (GP Title 4, Subtitle 3) — The records a custodian must deny and those a custodian may deny, each cited on the response; Ombudsman and Compliance Board (GP Title 4, Subtitle 1B) — The Public Access Ombudsman's mediation of disputes, and the PIA Compliance Board's review of fee and other complaints Oversight: Maryland Public Access Ombudsman and the PIA Compliance Board — Maryland runs a two-track dispute system rather than a single regulator. The Public Access Ombudsman mediates disputes between applicants and custodians, and the PIA Compliance Board resolves complaints within its jurisdiction. Both operate outside court, and both start from the record the custodian kept. - Initial response: 10 working days - Production deadline: 30 days from receipt of the request - Denials: GP Title 4 required denials and permitted denials, cited on the response - Fees: Reasonable fees, with the statutory free tier applied before charges begin - Dispute paths: Public Access Ombudsman mediation; PIA Compliance Board complaints - Languages: English Q: What are the Maryland PIA deadlines? A: A custodian owes an initial response within 10 working days and must produce or deny the record within 30 days of receiving the request. AccessPoint computes both from the date of receipt over Maryland's statutory-holiday calendar and shows whichever falls next, so neither depends on someone remembering. Q: How does AccessPoint handle the Ombudsman and the Compliance Board? A: As tracked matters linked to the originating request. A mediation with the Public Access Ombudsman or a complaint before the PIA Compliance Board gets its own workspace, correspondence log, and disposition, so the history of a disputed request stays in one place rather than in an email folder. Q: Does it distinguish required denials from permitted ones? A: Yes, because Maryland does. GP Title 4 separates records a custodian must deny from records a custodian may deny, and the distinction matters when a decision is reviewed. AccessPoint ships them as separate, citable grounds and carries the citation onto the redaction and into the response. Q: Where do the records reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, responsive records, redactions, and audit history never leave your control — no third-party cloud and no vendor access. ### Indiana — APRA (pack us-in-apra) URL: https://www.realizer.io/solutions/indiana-apra — pack content last reviewed 2026-08-10 Legislation: Access to Public Records Act (IC 5-14-3) — The public right of access to records held by Indiana public agencies, with a presumption that records are disclosable; Exceptions to disclosure (IC 5-14-3-4) — Records that may not be disclosed, and records a public agency has discretion to withhold, each cited on the response; Public Access Counselor (IC 5-14-4) — The office that issues advisory opinions on APRA disputes between requesters and public agencies Oversight: Indiana Public Access Counselor — The Public Access Counselor issues advisory opinions on APRA complaints. The opinions are advisory rather than binding, but they are published, they are cited, and a court considering the same dispute will have read one — so the record an agency built while responding is what its position ultimately rests on. - Acknowledgment: 24 hours for requests made in person or by phone; 7 days for requests by mail or email - Production: Within a reasonable time — no fixed statutory day count - Exceptions: IC 5-14-3-4 mandatory and discretionary grounds, cited on the response - Fees: Copy fees per the statutory schedule, with the agency's fee policy applied - Oversight: Public Access Counselor — advisory opinions - Languages: English Q: What are Indiana's APRA deadlines? A: The acknowledgment duty depends on how the request arrived — 24 hours for a request made in person or by telephone, and 7 days for one made by mail or email. Production itself must occur within a reasonable time; APRA sets no fixed day count. AccessPoint sets the acknowledgment clock from the intake channel and ages every open request against a service target you configure. Q: How do you handle a statute with no production deadline? A: By making the agency's own performance visible and provable. You set an internal target, every request is aged against it, and the file records each step with its date — acknowledgment, search, custodian tasking, review, release. If a Public Access Counselor complaint follows, the trail is what answers the question of whether the time taken was reasonable. Q: Are Public Access Counselor opinions binding? A: No — they are advisory. But they are published and influential, and a court hearing the same dispute will typically have the opinion in front of it. AccessPoint tracks a Counselor complaint as a matter linked to the originating request, with its correspondence and outcome recorded. Q: Where do the records reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, responsive records, redactions, and audit history never leave your control — no third-party cloud and no vendor access. ### Tennessee — TPRA (pack us-tn-tpra) URL: https://www.realizer.io/solutions/tennessee-tpra — pack content last reviewed 2026-08-10 Legislation: Tennessee Public Records Act (T.C.A. § 10-7-503 et seq.) — The right of Tennessee citizens to inspect and copy records of governmental entities, unless otherwise provided by state law; Confidential records (T.C.A. § 10-7-504) — The catalogue of records made confidential by statute, cited on each withholding; Office of Open Records Counsel (T.C.A. § 8-4-601 et seq.) — The office that issues guidance, the schedule of reasonable charges, and informal dispute assistance Oversight: Tennessee Office of Open Records Counsel (OORC) — The OORC does not adjudicate, but it sets the framework most disputes are measured against — issuing guidance, maintaining the schedule of reasonable charges that governs what an entity may bill, and assisting citizens and records custodians informally before a matter reaches court. - Response: Promptly, and within 7 business days — produce, deny in writing, or state the time reasonably necessary - Who may request: Tennessee citizens; entities may require proof of citizenship - Confidentiality: The § 10-7-504 catalogue and other state statutes, cited on the response - Fees: Per the OORC schedule of reasonable charges, with the entity's public records policy applied - Oversight: Office of Open Records Counsel — guidance and informal assistance - Languages: English Q: Does the TPRA really limit requests to Tennessee citizens? A: Yes. The Act grants the right of inspection to citizens of Tennessee, and a governmental entity may require proof of Tennessee citizenship before responding. AccessPoint captures requester status and any supporting documentation at intake so the question is resolved up front, and records the basis if a request is declined on that ground. Q: What must we do within seven business days? A: One of three things: make the record available, deny the request in writing stating the basis, or advise the requester of the time reasonably necessary to produce it. AccessPoint tracks which response was given and, where a time estimate was provided, keeps it as a dated commitment that resurfaces as it approaches. Q: How are fees handled? A: Under the schedule of reasonable charges maintained by the Office of Open Records Counsel, together with your entity's own public records policy. AccessPoint applies the schedule, itemizes labour and copy charges, and keeps the calculation on the file. Q: Where do the records reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, responsive records, redactions, and audit history never leave your control — no third-party cloud and no vendor access. ### Missouri — Sunshine Law (pack us-mo-sunshine) URL: https://www.realizer.io/solutions/missouri-sunshine — pack content last reviewed 2026-08-10 Legislation: Missouri Sunshine Law (RSMo Chapter 610) — Missouri's open records and open meetings law, built on a stated policy that records of public governmental bodies are open unless otherwise provided; Records that may be closed (RSMo § 610.021) — The enumerated grounds on which a public governmental body may close a record, cited on each withholding; Custodian of records (RSMo § 610.023) — The duty to appoint a custodian and to respond to a request no later than the end of the third business day Oversight: Missouri Attorney General and the courts — Missouri has no records commissioner. Enforcement runs through the Attorney General's office and the courts, and Chapter 610 attaches civil penalties where a violation is found to be knowing, and higher penalties where it is found purposeful — which puts the quality of the body's own record at the centre of any dispute. - Response deadline: No later than the end of the third business day after receipt - Extensions: A detailed explanation and a date certain where more time is genuinely required - Closure grounds: The § 610.021 list, cited on each closed record - Fees: Search, research, and duplication at the statutory basis, itemized - Enforcement: Attorney General and the courts; civil penalties for knowing and purposeful violations - Languages: English Q: How fast must a Missouri public body respond? A: No later than the end of the third business day following the date the request is received. Where access cannot be given in that time, the custodian must provide a detailed explanation of the cause of the delay and the place and earliest time and date the record will be available. AccessPoint computes the three-day date on receipt and tracks any date certain given as its own commitment. Q: Does the Sunshine Law require records to be closed? A: No — § 610.021 permits closure on the listed grounds rather than requiring it. That distinction matters when a decision is reviewed, so AccessPoint records the specific ground relied on and carries the citation onto the redaction and into the response, rather than marking a record simply as withheld. Q: How does the platform help with the penalty provisions? A: Chapter 610 grades violations by intent, with civil penalties for knowing violations and higher penalties for purposeful ones. Because intent is inferred from the record, AccessPoint's contemporaneous, timestamped trail — who decided what, when, and on which statutory ground — is the practical protection. It is written as the work happens rather than assembled afterward. Q: Where do the records reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, responsive records, redactions, and audit history never leave your control — no third-party cloud and no vendor access. ### Wisconsin — Public Records Law (pack us-wi-prl) URL: https://www.realizer.io/solutions/wisconsin-prl — pack content last reviewed 2026-08-10 Legislation: Wisconsin Public Records Law (Wis. Stat. §§ 19.31–19.39) — A right of access built on a declared policy of the fullest and most complete information regarding governmental affairs; Limitations on access (Wis. Stat. § 19.36) — The statutory limits on the general right of access, applied alongside the common-law balancing test; Enforcement by mandamus (Wis. Stat. § 19.37) — The requester's action to compel release, with costs and reasonable attorney fees available to a prevailing requester Oversight: The courts, with guidance from the Wisconsin Department of Justice — Wisconsin has no records commissioner or administrative appeal. A dissatisfied requester goes to court by mandamus, where a prevailing requester may recover costs and reasonable attorney fees — so the authority's written denial, and the reasoning behind it, is the entire defence. - Response standard: As soon as practicable and without delay — no fixed statutory day count - Withholding test: The common-law balancing test, applied record by record - Statutory limits: Wis. Stat. § 19.36 and other statutory exceptions - Fees: Location, reproduction, and mailing costs on the statutory basis - Enforcement: Mandamus, with costs and attorney fees available to a prevailing requester - Languages: English Q: How quickly must a Wisconsin authority respond? A: As soon as practicable and without delay. Wisconsin deliberately sets no fixed day count, which means the reasonableness of your timing is judged after the fact against what you can show. AccessPoint ages every open request against an internal target you set and records each step with its date. Q: How does the balancing test work in AccessPoint? A: As a recorded analysis attached to the record it concerns. Rather than picking an exemption from a list, the reviewer records the public interest in disclosure, the harm relied on, and the conclusion — and the written denial is then built from that reasoning. Because Wisconsin denials must state reasons and are reviewed by a court, the reasoning and the letter should say the same thing. Q: Is there an administrative appeal? A: No. Wisconsin has no records commissioner and no administrative appeal — a dissatisfied requester brings a mandamus action, and a prevailing requester may recover costs and reasonable attorney fees. That is why the contemporaneous record behind a denial matters so much in this state. Q: Where do the records reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, responsive records, redactions, and audit history never leave your control — no third-party cloud and no vendor access. ### District of Columbia — FOIA (pack us-dc-foia) URL: https://www.realizer.io/solutions/district-of-columbia-foia — pack content last reviewed 2026-08-10 Legislation: District of Columbia Freedom of Information Act (D.C. Code § 2-531 et seq.) — The public right of access to records of District government agencies, construed with a strong presumption in favour of disclosure; Exemptions (D.C. Code § 2-534) — The categories a District agency may withhold, each cited on the response and read narrowly; Administrative appeal (D.C. Code § 2-537) — The appeal to the Mayor from a denial, followed by an action in the Superior Court of the District of Columbia Oversight: The Mayor's Office of Legal Counsel, then the Superior Court of the District of Columbia — DC FOIA appeals go to the Mayor — in practice the Mayor's Office of Legal Counsel — which issues written decisions on agency denials, with an action in Superior Court available after. Those decisions are published and cited, so an agency's reasoning is scrutinized on the record it produced. - Response deadline: 15 business days from receipt - Extension: Up to 10 additional business days in unusual circumstances, on written notice - Exemptions: The § 2-534 categories, cited on the response - Construction: A strong pro-disclosure presumption; exemptions read narrowly - Appeal: To the Mayor, then to the Superior Court of the District of Columbia - Languages: English Q: What is the DC FOIA deadline? A: 15 business days from receipt, extendable by up to 10 additional business days in unusual circumstances with written notice to the requester. AccessPoint computes both dates over the District's holiday calendar and records the circumstance relied on when an extension is taken. Q: How do appeals work? A: A requester may appeal a denial to the Mayor, in practice handled by the Mayor's Office of Legal Counsel, which issues a written decision; an action in the Superior Court of the District of Columbia is available after. AccessPoint tracks the appeal as a matter linked to the originating request, with its filing date, correspondence, and outcome. Q: Does the platform support line-by-line redaction? A: Yes, and it matters here. DC FOIA is construed in favour of disclosure and its exemptions are read narrowly, so withholding an entire document where portions are releasable is a common ground of reversal. AccessPoint applies exemptions to passages, carries the citation onto each one, and records the segregation decision. Q: Where do the records reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, responsive records, redactions, and audit history never leave your control — no third-party cloud and no vendor access. ### Alabama (pack us-al-prl) URL: https://www.realizer.io/solutions/alabama-prl — pack content last reviewed 2026-09-03 Legislation: Alabama Public Records Law (Ala. Code § 36-12-40 et seq. (Act 2024-278)) — Inspection and copying of records made or received in the course of public business by Alabama state and local government bodies, available to Alabama citizens; Records fees and time-intensive requests (Ala. Code § 36-12-41) — Copying and preparation fees, and the time-intensive-request track that extends the response window for voluminous or complex requests Oversight: Alabama circuit courts (judicial enforcement) — Alabama has no central open-records oversight body — Act 2024-278 added a response clock but not an appeal board or ombudsman. A requester denied access enforces the Public Records Law by action in circuit court, with no statutory filing window specified by the Act. - Response standard: Acknowledge, then respond within 15 business days of acknowledgment; extendable in 15-business-day increments, or up to 45 business days for time-intensive requests (Act 2024-278) - Enforcement: No administrative appeal — a request unanswered at 30 business days or 60 calendar days is presumed denied, clearing the way to circuit court - Exemptions: § 36-12-40(a) statutory grounds plus the Stone v. Consolidated Publishing (1981) common-law balancing test - Charges: Reasonable fee at Executive Order 734 rates — $0.50 per page, $20 per hour of preparation time - Oversight: No oversight body — enforcement is by circuit-court action, with no statutory filing window - Languages: English Q: Who can request records under Alabama's Public Records Law, and how quickly must an agency respond? A: Alabama's Public Records Law is open to Alabama citizens. Under Act 2024-278, an agency must acknowledge a request and respond substantively within 15 business days of acknowledgment, extendable in 15-business-day increments; time-intensive requests get up to 45 business days. AccessPoint tracks both dates and flags time-intensive requests automatically. Q: What happens if an Alabama agency stays silent, and how is a denial challenged? A: A request left unanswered at 30 business days or 60 calendar days — whichever comes first — is presumed denied. Alabama has no administrative appeal body, so a requester enforces the Public Records Law by action in circuit court, and the Act sets no statutory filing window for doing so. Q: What decides whether a record is exempt, and what can an agency charge? A: Alabama exempts records on the statutory grounds in § 36-12-40(a) plus the balancing test from Stone v. Consolidated Publishing Co. (1981), weighing disclosure against privacy and the public interest. Fees follow the rates carried over from Executive Order 734: $0.50 per page and $20 per hour of preparation time. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Alaska (pack us-ak-pra) URL: https://www.realizer.io/solutions/alaska-pra — pack content last reviewed 2026-09-03 Legislation: Alaska Public Records Act (AS 40.25.100–.295) — Public inspection and copying of the records of a public agency, open to any person; Public records regulations (2 AAC 96) — Implementing regulations governing request procedures, copy costs, and search-time billing Oversight: The relevant agency head, then Alaska superior courts — Alaska has no records ombudsman or independent oversight board. A denied requester first appeals in writing to the head of the public agency within 60 working days of the denial, and if still dissatisfied may bring an action in superior court within 30 days of the agency head's decision. - Response standard: 10 working days from receipt; extendable by 10 more working days on notice, or longer by agreement or Attorney General direction - Enforcement: Silence past the deadline is treated as a denial — appeal to the agency head within 60 working days, then superior court within 30 days of that decision - Exemptions: AS 40.25.120(a) statutory exemption list plus the common-law and constitutional privileges Alaska courts recognize - Charges: Unit-cost copies; the first 5 hours of search time each month are free, with no charge for review - Oversight: No independent oversight body — the agency head decides the first appeal, superior court the second - Languages: English Q: Who can request records under the Alaska Public Records Act? A: Any person may request records of an Alaska public agency — there is no residency or citizenship requirement. AccessPoint doesn't gate intake by requester eligibility for Alaska requests. Q: How quickly must an Alaska agency respond, and what happens if it doesn't? A: An agency has 10 working days to respond, extendable by 10 more working days on written notice, or longer by agreement or Attorney General direction. A request left unanswered past the deadline is treated as denied, which lets the requester appeal without waiting further. AccessPoint tracks the clock and flags the silent-denial trigger. Q: How is an Alaska denial appealed? A: There is no independent oversight board. A requester appeals in writing to the head of the public agency within 60 working days of the denial, and if the appeal is unsuccessful, may bring an action in superior court within 30 days of the agency head's decision. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Arkansas (pack us-ar-foia) URL: https://www.realizer.io/solutions/arkansas-foia — pack content last reviewed 2026-09-03 Legislation: Arkansas Freedom of Information Act (Ark. Code Ann. § 25-19-101 et seq. (amended 2023 and 2025)) — Inspection and copying of public records of Arkansas government bodies, available to Arkansas citizens; Personnel and employee-evaluation records (Ark. Code Ann. § 25-19-105) — Requires 24-hour notice to the affected public employee before personnel or employee-evaluation records are released, with a 3-day window for an Attorney General opinion Oversight: Arkansas circuit courts (no independent oversight board) — Arkansas has no FOIA ombudsman or appeal board — enforcement runs straight to court. A requester denied access may file in circuit court, which must set the matter for hearing within 7 days of the filing. - Response standard: Records due immediately; if in active use, in storage, or requiring redaction, within 3 working days of the request - Enforcement: No administrative appeal — file in circuit court, which must hold a hearing within 7 days of filing - Exemptions: § 25-19-105(b)(1)–(28) enumerated exemptions, plus the 24-hour employee-notice and 3-day Attorney General opinion rule for personnel records - Charges: Actual reproduction cost only — no search or review fee; prepayment may be required for costs over $25 - Oversight: No oversight body — Arkansas circuit courts enforce the Act on an expedited docket - Languages: English Q: Who can request records under Arkansas FOIA, and how quickly must a custodian respond? A: Arkansas FOIA is open to Arkansas citizens. Records are due immediately upon request; the only exception is a 3-working-day standard that applies when the record is in active use, in storage, or needs redaction before release. AccessPoint tracks which standard applies to each request from intake. Q: What makes Arkansas different — the personnel-records notice? A: Yes. Before a personnel or employee-evaluation record is released, Arkansas FOIA requires 24-hour notice to the affected employee, and either the employee or the requester may ask for a 3-day Attorney General opinion on whether the record must be disclosed. AccessPoint triggers this workflow automatically whenever a personnel record is requested. Q: What can an Arkansas custodian charge, and how is a denial enforced? A: Only the actual cost of reproduction — there is no search or review fee — though prepayment may be required for costs over $25. Arkansas has no administrative appeal body; a denied requester files in circuit court, which must set a hearing within 7 days of filing. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Delaware (pack us-de-foia) URL: https://www.realizer.io/solutions/delaware-foia — pack content last reviewed 2026-09-03 Legislation: Delaware Freedom of Information Act (29 Del. C. ch. 100) — Inspection and copying of public records of Delaware public bodies, available to Delaware citizens; Public records exemptions (29 Del. C. § 10002(o)(1)–(19)) — Nineteen enumerated categories of records excluded from the definition of public record Oversight: Delaware Department of Justice (Chief Deputy Attorney General), then Delaware Superior Court — A requester denied access by a state public body the Attorney General is obligated to represent must first petition the Chief Deputy Attorney General within 60 days of the denial; the Chief Deputy issues a written determination within 20 business days. Either side may then appeal the determination to Superior Court. - Response standard: 15 business days from receipt; more time only for voluminous records, records requiring legal advice, or archived records, with a good-faith estimate - Enforcement: Petition the Attorney General's Chief Deputy within 60 days of denial — mandatory before court for state public bodies the AG represents - Exemptions: 29 Del. C. § 10002(o)(1)–(19) — nineteen enumerated categories excluded from the public-record definition - Charges: First 20 pages free, then $0.10 per sheet - Oversight: The Chief Deputy Attorney General decides within 20 business days; either side may then appeal to Superior Court - Languages: English Q: Who can request records under Delaware FOIA? A: Delaware FOIA is open to Delaware citizens. AccessPoint captures citizenship at intake so the request is handled on the correct statutory basis from the start. Q: How quickly must a Delaware public body respond? A: Within 15 business days of receipt. More time is available only where records are voluminous, legal advice is required, or records are archived — and even then the body must give a good-faith estimate of when records will be available. AccessPoint tracks the clock and drafts the estimate. Q: How is a Delaware FOIA denial challenged? A: For state public bodies the Attorney General is obligated to represent, a requester must first petition the Chief Deputy Attorney General within 60 days of the denial. The Chief Deputy issues a written determination within 20 business days, and either side may then appeal that determination to Superior Court. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Hawaii (pack us-hi-uipa) URL: https://www.realizer.io/solutions/hawaii-uipa — pack content last reviewed 2026-09-03 Legislation: Hawaii Uniform Information Practices Act (UIPA) (HRS ch. 92F) — Public access to government records held by Hawaii state and county agencies; Exceptions to disclosure and the privacy test (HRS §§ 92F-13, 92F-14) — Five categories of records excepted from disclosure, and the balancing test weighing individual privacy against the public interest Oversight: Hawaii Office of Information Practices (OIP) — OIP is Hawaii's central open-records oversight body. A requester may appeal a denial to OIP within one year, and OIP's decisions bind the agency. A requester dissatisfied with the outcome may still bring a court action within two years. - Response standard: A Notice to Requester within 10 business days of the request, extendable to 20 business days in extenuating circumstances - Enforcement: Appeal a denial to the Office of Information Practices within one year of the agency's decision - Exemptions: The five § 92F-13 exceptions, including the § 92F-14 balancing test weighing privacy against the public interest - Charges: Search and review/segregation fees of $2.50 and $5 per 15 minutes; the first $30 (or $60 for public-interest requests) is waived - Oversight: OIP decisions bind the agency; court action remains available within two years - Languages: English Q: How quickly must a Hawaii agency respond to a UIPA request? A: An agency must send a Notice to Requester within 10 business days of the request, stating whether the record will be disclosed and when. In extenuating circumstances, that window extends to 20 business days. AccessPoint computes both deadlines and drafts the notice. Q: What makes Hawaii different — a binding OIP appeal? A: Yes. In most states, an open-records oversight body can only recommend. Hawaii's Office of Information Practices decides denial appeals within one year of the agency's decision, and its ruling binds the agency. A requester who still disagrees can pursue a court action, with a two-year window to do so. Q: What can a Hawaii agency charge, and what exceptions apply? A: Search time is billed at $2.50 per 15 minutes and review/segregation time at $5 per 15 minutes, with the first $30 waived automatically (up to $60 for requests found to be in the public interest). Disclosure exceptions run through the five categories in § 92F-13, including the § 92F-14 test balancing privacy against the public interest. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Idaho (pack us-id-pra) URL: https://www.realizer.io/solutions/idaho-pra — pack content last reviewed 2026-09-03 Legislation: Idaho Public Records Act (IPRA) (Idaho Code § 74-101 et seq.) — Public inspection and copying of records prepared, owned, used, or retained by any state or local public agency or independent public body corporate and politic; Public records exemptions (Idaho Code §§ 74-104 to 74-109) — Categories of records exempt from disclosure, plus the § 74-124 standards governing law-enforcement and investigatory records Oversight: Idaho district courts (judicial enforcement) — Idaho has no central public-records oversight agency; the Act is enforced in court. A person denied examination or copying of a public record may petition the district court for the county where the record is located within 180 days of the denial, and the court reviews the denial without deference to the agency. - Response standard: Idaho residents: 3 working days, extendable to 10; non-residents: 21 days, extendable to 35 — a residency split introduced in 2025 - Enforcement: No oversight agency — petition the district court for the county where the record is located within 180 days of denial - Exemptions: Idaho Code §§ 74-104 to 74-109, plus the § 74-124 law-enforcement and investigatory-records standards - Charges: Idaho residents get the first two hours of labour free; additional labour and copying charged at actual cost - Oversight: Idaho district courts; no administrative appeal or ombudsman - Languages: English Q: When must an Idaho agency respond to a records request? A: It depends on the requester's residency. Idaho residents are owed a response within three working days, extendable to ten for a voluminous or complex request. Non-residents run on a twenty-one-day clock, extendable to thirty-five. AccessPoint detects residency at intake, starts the correct clock, and drafts the matching extension notice. Q: What makes Idaho different — the residency-split clock? A: Yes. Since 2025, Idaho is one of the few states to give in-state and out-of-state requesters different statutory deadlines. Idaho residents get the fast three-to-ten-day clock; everyone else runs on the twenty-one-to-thirty-five-day clock. AccessPoint classifies each requester and applies the correct deadline automatically. Q: What can an Idaho agency charge? A: Idaho residents receive the first two hours of labour free; additional labour and copying are charged at actual cost. AccessPoint tracks the free-hours balance and computes the charge from there. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Iowa (pack us-ia-orl) URL: https://www.realizer.io/solutions/iowa-orl — pack content last reviewed 2026-09-03 Legislation: Iowa Open Records Law (Iowa Code ch. 22) — Public examination and copying of public records of government bodies, absent a specific confidentiality provision; Confidential records (Iowa Code § 22.7) — The enumerated list of records a government body may keep confidential, plus the § 22.8(4)(d) good-faith delay a custodian may take to determine whether a record is confidential Oversight: Iowa Public Information Board (IPIB) — IPIB investigates and resolves complaints alleging a violation of chapter 22, and unlike many states' advisory bodies it can issue binding orders enforceable in court. A complaint must be filed within 60 days of the alleged violation; a requester may also go directly to court for an injunction or mandamus. - Response standard: No fixed deadline — Iowa Code ch. 22 requires records to be made available for examination and copying with reasonable promptness - Enforcement: IPIB complaint within 60 days of the violation, with binding-order authority, or direct court action - Exemptions: The § 22.7 confidential-records list - Charges: Copies and the actual cost of retrieval, charged at cost - Oversight: Iowa Public Information Board; binding orders or court enforcement - Languages: English Q: When must an Iowa government body respond? A: Iowa Code ch. 22 sets no fixed deadline — records must be available for examination and copying with reasonable promptness. A custodian may take up to 10 business days or 20 calendar days, under § 22.8(4)(d), to determine in good faith whether a record is confidential. AccessPoint tracks that window so it's used as the defence it is, not treated as an automatic extension. Q: What makes Iowa different — the IPIB? A: Yes. Most states route unresolved records disputes straight to court or to a purely advisory body. Iowa's Public Information Board can investigate a complaint filed within 60 days of the alleged violation and issue a binding order. AccessPoint keeps the request record IPIB-ready throughout. Q: What can an Iowa government body charge? A: Copies and the actual cost of retrieval, billed at cost. AccessPoint computes the charge and documents the basis. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Kansas (pack us-ks-kora) URL: https://www.realizer.io/solutions/kansas-kora — pack content last reviewed 2026-09-03 Legislation: Kansas Open Records Act (KORA) (K.S.A. 45-215 et seq.) — Public inspection and copying of public records made, maintained, or kept by public agencies; Permissive exceptions (K.S.A. 45-221) — The 'shall not be required to disclose' exceptions a public agency may — but need not — withhold, including the (a)(10) criminal-investigation closure factors and the (a)(30) personal-privacy exception Oversight: Kansas Attorney General — A requester who believes an agency violated KORA may file a sworn complaint with the Attorney General, who may pursue civil penalties of up to $500 per violation; a requester may instead — or also — bring a civil action in district court. - Response standard: Act on a request by the third business day after receipt, with a written denial citing the specific K.S.A. 45-221 provision relied on - Enforcement: Sworn Attorney General complaint, or district-court action - Exemptions: K.S.A. 45-221 — permissive exceptions an agency 'shall not be required' to disclose, including the (a)(10) criminal-investigation and (a)(30) personal-privacy exceptions - Charges: Fees at actual cost - Oversight: Kansas Attorney General; civil penalties up to $500 per violation - Languages: English Q: When must a Kansas agency respond to a records request? A: K.S.A. 45-215 et seq. requires an agency to act on a request no later than the third business day after receipt. A denial must be in writing and cite the specific K.S.A. 45-221 provision relied on. AccessPoint tracks the deadline and drafts the citation-ready denial. Q: What makes Kansas different — permissive exceptions? A: Yes. K.S.A. 45-221 doesn't say an agency must withhold a record — it says the agency 'shall not be required to disclose' one. That includes the (a)(10) criminal-investigation closure factors and the (a)(30) personal-privacy exception, both of which call for judgment rather than a blanket rule. AccessPoint tracks which exception applies and the factors behind the decision. Q: What can a Kansas agency charge? A: Fees at actual cost. AccessPoint computes the charge and documents the basis. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Kentucky (pack us-ky-ora) URL: https://www.realizer.io/solutions/kentucky-ora — pack content last reviewed 2026-09-03 Legislation: Kentucky Open Records Act (ORA) (KRS 61.870–61.884) — Public inspection and copying of public records of the Commonwealth's public agencies, open to residents of Kentucky; Public records exceptions (KRS 61.878(1)(a)–(s)) — The enumerated exceptions a public agency may withhold, as amended by 2025 HB 520 Oversight: Kentucky Attorney General — A requester denied access may appeal to the Attorney General, who must issue a decision within 20 business days. That decision has the force of law unless the agency or the requester appeals it to circuit court within 30 days. - Response standard: Written determination within 5 business days of receipt - Enforcement: Attorney General appeal, decided within 20 business days with the force of law unless appealed to circuit court within 30 days - Exemptions: KRS 61.878(1)(a)–(s), as amended by 2025 HB 520 - Charges: Copies at actual cost; 10 cents per page is the long-standing reasonable-fee benchmark from case law, not a statutory figure - Oversight: Kentucky Attorney General, with circuit-court appeal - Languages: English Q: When must a Kentucky agency respond to a records request? A: KRS 61.870–61.884 requires a written determination — granting, denying, or partially denying the request, with the specific KRS 61.878(1) exception cited on any denial — within five business days of receipt. AccessPoint tracks the deadline and drafts the citation-ready determination. Q: What makes Kentucky different — binding Attorney General review? A: Yes. A requester denied access may appeal to the Attorney General, who must decide within 20 business days. Unlike a purely advisory opinion, that decision has the force of law unless the agency or the requester appeals it to circuit court within 30 days. AccessPoint keeps the request record ready for that appeal. Q: Who can make a request in Kentucky, and what can an agency charge? A: Since 2021, only residents of the Commonwealth may make an open-records request; AccessPoint checks residency at intake. Copies are charged at actual cost — the frequently cited 10-cents-per-page figure comes from case law as a reasonable-fee benchmark, not a statutory rate. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Louisiana (pack us-la-prl) URL: https://www.realizer.io/solutions/louisiana-prl — pack content last reviewed 2026-09-03 Legislation: Louisiana Public Records Law (La. R.S. 44:1 et seq.) — Public inspection, copying, and reproduction of records of public bodies; any adult person may request, and no reason for the request may be required; Public records exceptions (La. R.S. 44:3, 44:4, and 44:4.1) — The enumerated categories exempt from disclosure — Louisiana recognizes no general deliberative-process exemption Oversight: Louisiana district courts (judicial enforcement) — Louisiana has no central public-records oversight agency; the law is enforced in court. A requester denied a record — including one who receives no response at all, since silence is a deemed denial — may seek a writ of mandamus in district court, with no statutory filing deadline, and a custodian who arbitrarily withholds a record risks penalties of up to $100 per day. - Response standard: Written determination within 5 business days of receipt; silence is a deemed denial - Enforcement: No oversight agency — district-court mandamus, with no statutory filing deadline - Exemptions: R.S. 44:3, 44:4, and 44:4.1 — no general deliberative-process exemption - Charges: Free inspection; copies at $0.25 per page under the state fee schedule - Oversight: Louisiana district courts; penalties up to $100 per day for arbitrary withholding - Languages: English Q: When must a Louisiana custodian respond? A: La. R.S. 44:1 et seq. requires a written determination within five business days of receipt. If the custodian doesn't respond in that window, the request is deemed denied — which is enough to seek a writ of mandamus. AccessPoint tracks the deadline and flags the deemed-denial trigger automatically. Q: What makes Louisiana different — no deliberative-process exemption? A: Yes. Louisiana's exceptions in R.S. 44:3, 44:4, and 44:4.1 are specific and enumerated, and the law recognizes no general deliberative-process exemption for drafts or pre-decisional records. Any adult may request a record, and the custodian may never ask why. AccessPoint ties every withholding to a specific enumerated exception. Q: What can a Louisiana public body charge? A: Inspection is free. Copies are charged at $0.25 per page under the state fee schedule. AccessPoint computes the charge and documents the basis. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Maine (pack us-me-foaa) URL: https://www.realizer.io/solutions/maine-foaa — pack content last reviewed 2026-09-03 Legislation: Maine Freedom of Access Act (FOAA) (1 M.R.S. § 401 et seq.) — Public inspection and copying of public records held by state and local government agencies; any person may request, and no written request is required; Public records exclusions (1 M.R.S. § 402(3)(A)–(X)) — An enumerated list of excluded record categories, from attorney work product to certain security and personnel records — with no general privacy exemption outside the list Oversight: Maine Public Access Ombudsman — The Public Access Ombudsman, housed in the Office of the Attorney General, reviews FOAA complaints and issues advisory opinions but cannot order disclosure. A requester denied access may also appeal directly to Superior Court within 30 days of the denial, where the court reviews the withholding de novo. - Response standard: Acknowledgment and any written denial within 5 working days of receipt; production within a reasonable time thereafter (1 M.R.S. § 408-A) - Enforcement: Public Access Ombudsman review (advisory) or direct appeal to Maine Superior Court within 30 days of denial - Exemptions: The § 402(3)(A)–(X) exclusions — an enumerated list, with no general privacy exemption - Charges: 10¢ per standard page; first two hours of staff time free, then up to $25 per hour - Oversight: Public Access Ombudsman (advisory) and Maine Superior Court on appeal - Languages: English Q: When must a Maine agency respond to a FOAA request? A: Within 5 working days of receipt, the agency must acknowledge the request and, if it intends to deny access, provide written notice of the denial. Production of the records itself follows within a reasonable time after that. AccessPoint computes both points and drafts the acknowledgment or denial notice. Q: Does a FOAA request have to be in writing? A: No. Maine's FOAA allows any person to request records without submitting a written request, though a written request creates a clear record of the 5-working-day clock. AccessPoint logs the request and starts the clock the moment it's received, however it arrives. Q: What makes Maine different — no general privacy exemption? A: Yes. FOAA withholds a record only if it falls within the § 402(3)(A)–(X) exclusions — there is no broader, catch-all personal-privacy or public-interest exemption a custodian can invoke. AccessPoint tags each record against the enumerated exclusions so nothing is withheld on a ground the statute doesn't provide. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Mississippi (pack us-ms-pra) URL: https://www.realizer.io/solutions/mississippi-pra — pack content last reviewed 2026-09-03 Legislation: Mississippi Public Records Act of 1983 (Miss. Code Ann. § 25-61-1 et seq.) — Public inspection and copying of records created or received by a public body in the conduct of public business; any person may request; Public records exemptions (Miss. Code Ann. §§ 25-61-9, 25-61-11, 25-61-12) — Statutory exemptions for law-enforcement investigative records, personal and personnel information, and other listed categories — with law-enforcement incident reports themselves always public Oversight: Mississippi Ethics Commission — The Ethics Commission hears public-records complaints, mediates between the parties, and may order compliance and impose a civil penalty of up to $100 per violation against a public body that acts in bad faith. Either party may then seek review in chancery court, which considers the matter de novo. - Response standard: Production or written denial under the body's own adopted procedures — at most 7 working days, or 14 working days with a written explanation for the delay - Enforcement: Ethics Commission complaint (no filing deadline; mediation, compliance orders, penalties) then chancery court de novo review - Exemptions: The §§ 25-61-9, 25-61-11, and 25-61-12 exemptions; law-enforcement incident reports are always public - Charges: Fees limited to the actual cost of reproduction, search, and review, payable in advance - Oversight: Mississippi Ethics Commission, with de novo chancery court review on appeal - Languages: English Q: When must a Mississippi public body respond to a records request? A: Under its own adopted procedures — but no later than 7 working days, or 14 working days if the body provides a written explanation for the delay. AccessPoint tracks the body's specific procedure alongside the statutory outer limit and flags any response running past it. Q: What makes Mississippi different — how a denial gets challenged? A: Yes. Rather than heading straight to court, a requester files a complaint with the Ethics Commission — at any time, since there's no filing deadline. The Commission can mediate, order compliance, and fine a bad-faith denial up to $100 per violation. Either party can then seek chancery court review, which considers the matter de novo. Q: What can a public body charge for records? A: Only the actual cost of reproduction, search, and review — no flat fees or profit margin — and the body may require payment in advance. AccessPoint calculates the actual-cost estimate and documents it for the requester. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Montana (pack us-mt-pra) URL: https://www.realizer.io/solutions/montana-pra — pack content last reviewed 2026-09-03 Legislation: Montana Public Records Act (MCA § 2-6-1001 et seq.) — Statutory implementation of the constitutional right to know (Mont. Const. art. II, § 9); public inspection and copying of documents of state and local public bodies; Response deadlines (2025 amendments) (MCA § 2-6-1001 et seq., as amended by HB 100 (2025)) — Sets the 5-business-day acknowledgment standard and the 90-day (or 6-month, for the largest requests) fulfillment deadlines for state agencies Oversight: Montana district courts (judicial enforcement) — Montana has no administrative appeals board or ombudsman for public records; the Act is enforced in court. A requester denied access, or facing an unreasonable delay, may sue in district court, and a prevailing party recovers costs and attorney fees. - Response standard: State agencies acknowledge within 5 business days; complex requests must be fulfilled within 90 days, or 6 months for the largest (HB 100, 2025) - Enforcement: No administrative appeal — sue in district court, with attorney fees for a prevailing requester - Exemptions: No exemption list — withholding is decided by the individual-privacy balancing test under the constitutional right to know - Charges: Labour capped at $25 per hour, first hour free; a $5 filing fee applies - Oversight: Montana district courts; a prevailing requester recovers attorney fees - Languages: English Q: When must a Montana agency respond to a records request? A: State agencies must acknowledge the request within 5 business days. Fulfilling it can take longer: complex requests have up to 90 days, and the largest requests up to 6 months, under the 2025 HB 100 amendments. AccessPoint tracks all three clocks and flags a response running past them. Q: What makes Montana different — no exemption list? A: Yes. Montana's right to know is constitutional (Mont. Const. art. II, § 9), and the Public Records Act doesn't pair it with a list of exemptions. Every withholding is instead decided by balancing the public's right to know against the individual's privacy interest in that specific record. AccessPoint documents that balancing analysis for each redaction. Q: What can a Montana agency charge for records? A: Labour is capped at $25 per hour, with the first hour free, and a $5 filing fee applies. AccessPoint calculates the charge and itemises it against those caps. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Nebraska (pack us-ne-prs) URL: https://www.realizer.io/solutions/nebraska-prs — pack content last reviewed 2026-09-03 Legislation: Nebraska Public Records Statutes (Neb. Rev. Stat. §§ 84-712 to 84-712.09) — Public inspection and copying of records kept by a public body; response due within 4 business days of receipt; Discretionary withholding categories (Neb. Rev. Stat. § 84-712.05) — 30 categories a public body may, but need not, withhold, with mandatory segregation of any non-exempt material within an otherwise withholdable record Oversight: Nebraska Attorney General — A requester denied access may petition the Attorney General, who must dispose of the petition within 15 calendar days and may order the public body to disclose the records. A requester may instead, or additionally, seek a writ of mandamus in district court, where a prevailing party recovers attorney fees. - Response standard: Response within 4 business days of receipt (Neb. Rev. Stat. §§ 84-712 to 84-712.09) - Enforcement: Petition to the Attorney General (15-calendar-day disposition, may order disclosure) or a mandamus action, with attorney fees - Exemptions: 30 discretionary § 84-712.05 withholding categories, with mandatory segregation of non-exempt material - Charges: Copies at actual added cost; first 8 hours of search free for Nebraska residents; no charge for legal review - Oversight: Nebraska Attorney General (15-day disposition) or district court on mandamus - Languages: English Q: When must a Nebraska public body respond to a records request? A: Within 4 business days of receipt. AccessPoint starts that clock the moment a request is logged and flags any response running past it. Q: What makes Nebraska different — the Attorney General petition? A: Yes. A requester denied access can petition the Attorney General, who must dispose of the petition within 15 calendar days and may order the public body to disclose the records — a faster path than waiting for a mandamus action in district court, which remains available too. AccessPoint tracks the petition against the 15-day deadline. Q: What can a Nebraska public body charge for records? A: Copies at the actual added cost of reproduction. Nebraska residents get the first 8 hours of search time free, and there's no charge for the legal review needed to identify withholdable material. AccessPoint applies the resident benefit and calculates the charge accordingly. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Nevada (pack us-nv-pra) URL: https://www.realizer.io/solutions/nevada-pra — pack content last reviewed 2026-09-03 Legislation: Nevada Public Records Act (NRS ch. 239) — Public inspection and copying of books and records kept by a governmental entity; the entity must act by the end of the 5th business day after the request; Confidentiality by cross-reference (NRS 239.010(1)) — Confidentiality exists only where another statute expressly makes a record confidential, or where the Donrey balancing test outweighs the presumption of openness — the Act itself lists no exemptions Oversight: Nevada district courts (judicial enforcement) — Nevada has no administrative appeals board or ombudsman; the Act is enforced in court. A requester denied access may petition the district court, which awards mandatory attorney fees to a prevailing requester and may impose a civil penalty of $1,000 to $10,000 against the governmental entity. - Response standard: The governmental entity must act by the end of the 5th business day after the request (NRS ch. 239) - Enforcement: No administrative appeal — petition the district court; mandatory attorney fees and civil penalties of $1,000 to $10,000 - Exemptions: No exemption list — confidentiality only from statutes listed at NRS 239.010(1), or the Donrey balancing test; burden is on the entity; redact, don't deny - Charges: Copies at actual direct cost only; no charge for staff time - Oversight: Nevada district courts; mandatory attorney fees for a prevailing requester - Languages: English Q: When must a Nevada governmental entity respond to a records request? A: The entity must act by the end of the 5th business day after the request — either producing the records or explaining why more time or a denial is needed. AccessPoint computes that deadline and flags any response running past it. Q: What makes Nevada different — no exemption list? A: Yes. Nevada's Public Records Act lists no exemptions of its own. A record is confidential only if another statute listed at NRS 239.010(1) makes it so, or if the Donrey balancing test weighs against disclosure — and the entity carries the burden of proving that. Even then, the entity must redact and release the non-confidential parts rather than deny the whole record. AccessPoint documents that basis for every withholding. Q: What can a Nevada entity charge for records? A: Only the actual direct cost of producing the copy — there's no charge for the staff time spent locating or reviewing the records. AccessPoint calculates the direct-cost charge and itemises it for the requester. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### New Hampshire (pack us-nh-rtk) URL: https://www.realizer.io/solutions/new-hampshire-rtk — pack content last reviewed 2026-09-03 Legislation: New Hampshire Right-to-Know Law (RSA ch. 91-A) — Public access to governmental records and proceedings held by public bodies and agencies; Right-to-Know exemptions (RSA 91-A:5) — Exempted record categories, including a privacy balancing test for personnel and similar files, construed narrowly in favor of disclosure Oversight: New Hampshire Right-to-Know Ombudsman (or superior court) — New Hampshire offers a low-cost administrative path before court: a $25 complaint to the Right-to-Know Ombudsman, who rules within 30 days and may issue binding orders. A requester may instead — or afterward — bring an action in superior court; either route must be filed within 30 days of the denial, and a public body found to have violated the law in bad faith faces a $250–$2,000 civil penalty. - Response standard: Response within 5 business days, or a written statement of the time reasonably needed for a longer request - Enforcement: The Right-to-Know Ombudsman ($25 fee, ruling within 30 days) or a superior-court action, either filed within 30 days of the denial - Exemptions: RSA 91-A:5 exemptions, construed narrowly, including a privacy balancing test for personnel and similar files - Charges: Inspection is free; copies at actual cost; $1 per e-mail beyond the first 250 e-mails produced, with waivers available - Oversight: Right-to-Know Ombudsman (may issue binding orders) or superior court; bad-faith violations carry a $250–$2,000 civil penalty - Languages: English Q: When must a New Hampshire public body respond to a Right-to-Know request? A: Within 5 business days it must provide the records or a written statement of the time reasonably needed to comply. AccessPoint computes the deadline and drafts the statement when a request can't be completed in time. Q: What makes New Hampshire different — pricing e-mail production? A: Yes. New Hampshire is one of the few states that charges by the e-mail: the first 250 e-mails produced in response to a request are free, and each additional e-mail is billed at $1, subject to waiver. AccessPoint tracks the e-mail count and computes the charge automatically. Q: How is a denial appealed? A: To the Right-to-Know Ombudsman — a $25 complaint fee, a ruling within 30 days, and the power to issue orders — or directly to superior court, either within 30 days of the denial. A public body that violates the law in bad faith faces a $250–$2,000 civil penalty. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### New Mexico (pack us-nm-ipra) URL: https://www.realizer.io/solutions/new-mexico-ipra — pack content last reviewed 2026-09-03 Legislation: Inspection of Public Records Act (IPRA) (NMSA 1978, §§ 14-2-1 to 14-2-12) — Public inspection of records of any public body in New Mexico; IPRA exceptions and redaction (NMSA 1978, § 14-2-1(A)–(H); § 14-2-1.1) — The eight enumerated exceptions to disclosure, exhaustive with no general rule-of-reason withholding, plus mandatory redaction of protected personal identifier information Oversight: New Mexico district courts (with a Department of Justice complaint option) — New Mexico has no administrative tribunal for IPRA disputes. A requester may file a complaint with the New Mexico Department of Justice or bring an enforcement action directly in district court; a prevailing requester recovers attorney fees, and a public body that fails to permit inspection can face damages of up to $100 per day from the date of a denial. - Response standard: Inspection permitted not later than 15 days after a written request; a written explanation is required if inspection isn't permitted within 3 business days, and no response by day 15 is a deemed denial - Enforcement: Complaint to the New Mexico Department of Justice or a district-court enforcement action, with mandatory attorney fees for a prevailing requester - Exemptions: The eight § 14-2-1(A)–(H) exceptions, exhaustive with no rule of reason, plus § 14-2-1.1 redaction of protected personal identifier information - Charges: Copies capped at $1.00 per page; inspection itself is free - Oversight: No administrative tribunal — district court, with damages of up to $100 per day for a late denial and mandatory attorney fees - Languages: English Q: When must a New Mexico public body permit inspection? A: Not later than 15 days after a written request. If inspection isn't permitted within 3 business days, the custodian must provide a written explanation for the delay, and a request left unanswered at 15 days is treated as a denial. AccessPoint tracks both checkpoints and drafts the explanation. Q: What makes New Mexico different — no rule of reason? A: Yes. IPRA lists only eight exceptions (§ 14-2-1(A)–(H)), and they are exhaustive — a custodian cannot withhold a record for a reason outside that list, even a plausible privacy or public-interest concern. AccessPoint tags each record to its specific statutory exception, never a general balancing test. Q: What happens if a request is denied late? A: A deemed denial at the 15-day mark can expose the public body to damages of up to $100 per day until the records are produced, and a prevailing requester in district court recovers attorney fees. There is no administrative tribunal — enforcement runs through a Department of Justice complaint or a district-court action. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### North Dakota (pack us-nd-ors) URL: https://www.realizer.io/solutions/north-dakota-ors — pack content last reviewed 2026-09-03 Legislation: North Dakota open records law (N.D.C.C. § 44-04-18 et seq.) — Public access to records of a public entity; every record is open unless closed by a specific statute; Confidential and exempt records (N.D.C.C. § 44-04-18 et seq.) — Records are closed only by a specific statute — confidential records must be withheld, exempt records may be — with mandatory segregation of the nonexempt remainder Oversight: North Dakota Attorney General's office (opinion process), then district court — North Dakota has no records tribunal. A requester may ask the Attorney General for an opinion on a denial, issued within 30 days; if the opinion finds a violation, the public entity has 7 days to comply. If it still doesn't, the requester may bring a civil action in district court. - Response standard: No fixed clock — a public entity must respond within a reasonable time, and unreasonable delay is itself a violation - Enforcement: Attorney General's opinion within 30 days of a complaint; if it finds a violation, the entity has 7 days to comply before a requester may bring civil action - Exemptions: Records are closed only by a specific statute — confidential records must be withheld, exempt records may be — with mandatory segregation - Charges: 25 cents per page (impression) and $25 per hour for locating and excising records, after the first hour free - Oversight: North Dakota Attorney General's office, then civil action in district court - Languages: English Q: How quickly must a North Dakota public entity respond? A: North Dakota's open records law sets no fixed clock. Instead, a public entity must respond within a reasonable time given the request, and an unreasonable delay is itself a violation of the law. AccessPoint benchmarks response time and flags requests approaching an unreasonable delay. Q: What makes North Dakota different — confidential versus exempt? A: Yes. North Dakota closes records in two distinct tiers: confidential records must be withheld, with no discretion, while exempt records may be withheld at the entity's choice. AccessPoint tags every record to the correct tier so it's never withheld — or released — by mistake. Q: How is a denial enforced? A: A requester may ask the Attorney General for an opinion, issued within 30 days. If the opinion finds a violation, the entity has 7 days to comply; if it doesn't, the requester may bring a civil action. AccessPoint tracks both the 30-day opinion clock and the 7-day compliance window. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Oklahoma (pack us-ok-ora) URL: https://www.realizer.io/solutions/oklahoma-ora — pack content last reviewed 2026-09-03 Legislation: Oklahoma Open Records Act (ORA) (51 O.S. §§ 24A.1–24A.40) — Prompt, reasonable access to records of Oklahoma public bodies; ORA confidentiality and exemption grounds (51 O.S. § 24A.5(1); §§ 24A.7–24A.34) — § 24A.5(1) mandatory confidentiality grounds plus the discretionary exemptions in §§ 24A.7–24A.34, with mandatory segregation of nonexempt material Oversight: Attorney General's Public Access Counselor, then Oklahoma district courts — Oklahoma created the Public Access Counselor within the Attorney General's office to review open-records disputes before litigation: a review completed within 30 days, or advisement within 60 days for more complex matters. A requester may then bring a district-court suit — after giving the public body 10 business days' written notice — and a prevailing requester recovers attorney fees. - Response standard: Prompt, reasonable access with no fixed statutory clock — delay is permitted only for record preparation or to avoid unreasonable disruption - Enforcement: Review by the Attorney General's Public Access Counselor within 30 days (advisement within 60 for complex matters), then a district-court suit after 10 business days' notice - Exemptions: § 24A.5(1) mandatory confidentiality grounds plus the discretionary §§ 24A.7–24A.34 exemptions, with mandatory segregation - Charges: 25 cents per page, $1 for certified copies, and a search/compilation fee only for commercial or unreasonably disruptive requests - Oversight: Attorney General's Public Access Counselor, then Oklahoma district courts; a prevailing requester recovers attorney fees - Languages: English Q: How quickly must an Oklahoma public body respond? A: The Open Records Act requires prompt, reasonable access, with no fixed statutory deadline. Delay is permitted only for the time it takes to prepare the records or to avoid unreasonably disrupting the body's essential functions. AccessPoint tracks preparation time so delay stays inside what the Act allows. Q: What makes Oklahoma different — the Public Access Counselor? A: Yes. Before heading to court, a requester can ask the Attorney General's Public Access Counselor to review a denial — typically within 30 days, or 60 days with advisement for more complex matters. It's a faster, lower-cost step than a district-court suit, which still requires 10 business days' notice first. Q: What can a public body charge? A: 25 cents per page, $1 for certified copies, and — for most requesters — nothing more. A search or compilation fee for staff time applies only to commercial requesters or requests that would unreasonably disrupt the body's operations. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Oregon (pack us-or-prl) URL: https://www.realizer.io/solutions/oregon-prl — pack content last reviewed 2026-09-03 Legislation: Oregon Public Records Law (ORS 192.311–192.478) — Public inspection of records of state and local public bodies; Public Records Law exemptions (ORS 192.345; ORS 192.355) — ORS 192.345 conditional exemptions, tested against the public interest, and ORS 192.355 unconditional exemptions, with mandatory segregation of exempt material Oversight: Oregon Attorney General or district attorney, with Public Records Advocate mediation — Oregon offers two pre-court paths: a petition to the Attorney General (for state-body denials) or the district attorney (for local-body denials), decided by a 7-day order, and free mediation through the Public Records Advocate. If those don't resolve the dispute, a requester may bring an action in circuit court, where a prevailing requester recovers attorney fees. - Response standard: Acknowledge within 5 business days, then complete the request — or provide a written estimate — within 10 more business days (15 business days in all) - Enforcement: Petition to the Attorney General (state bodies) or district attorney (local bodies) for a 7-day order, Public Records Advocate mediation, or a circuit-court action - Exemptions: ORS 192.345 conditional exemptions (a public-interest balancing test) and ORS 192.355 unconditional exemptions, with mandatory segregation - Charges: Actual-cost fees; a written estimate is required above $25; a public-interest fee waiver is available - Oversight: Oregon Attorney General or district attorney, the Public Records Advocate, and Oregon circuit courts - Languages: English Q: When must an Oregon public body respond? A: Within 5 business days it must acknowledge the request, and within 10 more business days — 15 in all — it must complete the request or provide a written estimate of the time and cost to do so. AccessPoint computes both checkpoints and drafts the estimate. Q: What makes Oregon different — two kinds of exemption? A: Yes. ORS 192.345 conditional exemptions apply only if the public interest in confidentiality outweighs the interest in disclosure — a documented balancing test. ORS 192.355 unconditional exemptions apply without that test. AccessPoint tags each record to the right category and, for conditional exemptions, prompts for the balancing analysis. Q: How is a denial resolved before court? A: A requester can petition the Attorney General (for state bodies) or the district attorney (for local bodies) for a 7-day order, or use free mediation through the Public Records Advocate. Only after that does a circuit-court suit — with attorney fees for a prevailing requester — come into play. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Rhode Island (pack us-ri-apra) URL: https://www.realizer.io/solutions/rhode-island-apra — pack content last reviewed 2026-09-03 Legislation: Access to Public Records Act (APRA) (R.I. Gen. Laws § 38-2-1 et seq.) — Public inspection and copying of the records of state and municipal public bodies; Records excluded from the definition of public record (R.I. Gen. Laws § 38-2-2(4)(A)–(BB)) — The lettered categories carved out of the definition of public record — applied record by record and cited on every denial; Procedures, response times, and charges (R.I. Gen. Laws §§ 38-2-3, 38-2-4) — Written procedures and a designated public records officer or unit, the ten-business-day response with the particularized up-to-twenty-day undue-burden extension, and the 15-cents-per-page and $15-per-hour charges Oversight: Rhode Island Attorney General — Open Government Unit; Superior Court — Rhode Island has no records commission. A requester denied access may petition the public body's chief administrative officer, who must decide within ten business days (§ 38-2-8(a)). The Attorney General's Open Government Unit then takes complaints — with no filing window — investigates, and may sue; or the requester may retain private counsel and go straight to the Superior Court for injunctive or declaratory relief (§ 38-2-8(b)). A prevailing plaintiff recovers reasonable attorney fees and costs, and the court may fine a public body up to $2,000 for a knowing and willful violation or up to $1,000 for a reckless one (§ 38-2-9(d)). - Response standard: Inspection or copying within 10 business days of receipt; up to 20 additional business days on a written explanation particularized to the request and showing undue burden (§ 38-2-3(e)) - Enforcement: Petition to the chief administrative officer, complaint to the Attorney General with no filing window, or injunctive or declaratory relief in the Superior Court (§ 38-2-8) - Exemptions: The § 38-2-2(4)(A)–(BB) categories excluded from the definition of public record; a written denial with specific reasons within 10 business days, and silence is a deemed denial (§ 38-2-7) - Charges: 15 cents per page; search and retrieval at $15 per hour after the first hour free (§ 38-2-4) — fees waived when records are not produced on time - Oversight: Attorney General Open Government Unit; Superior Court, with attorney fees for a prevailing plaintiff and civil fines up to $2,000 for knowing and willful violations (§ 38-2-9(d)) - Languages: English Q: When must a Rhode Island public body respond? A: Inspection or copying must be permitted within ten business days of receipt. If it cannot be, the public body must forthwith explain in writing why more time is needed — an explanation particularized to the specific request — and may take up to twenty additional business days where the volume of the request, the number of requests pending, or the difficulty of the search would otherwise impose an undue burden (§ 38-2-3(e)). Failure to comply within the ten-day period is deemed a denial (§ 38-2-7(b)). AccessPoint computes both points and drafts the extension notice. Q: What makes Rhode Island different — the enforcement track? A: A denied requester has three routes: a petition to the public body's chief administrative officer, decided within ten business days; a complaint to the Attorney General's Open Government Unit, which investigates and may sue, with no filing window; or a direct action for injunctive or declaratory relief in the Superior Court (§ 38-2-8). A prevailing plaintiff recovers attorney fees, and the court may fine the public body up to $2,000 for a knowing and willful violation or $1,000 for a reckless one (§ 38-2-9(d)). AccessPoint keeps the timestamped record of who decided what, when, and on which exemption. Q: What can a Rhode Island public body charge? A: Copies cost 15 cents per page. Search and retrieval is free for the first hour and then billed at $15 per hour (§ 38-2-4). Where a public body does not produce records within the statutory period, copying and search-and-retrieval fees are waived unless the deadline was properly extended under § 38-2-3(e). AccessPoint computes the charge, issues the estimate, and applies the waiver. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### South Dakota (pack us-sd-ora) URL: https://www.realizer.io/solutions/south-dakota-ora — pack content last reviewed 2026-09-03 Legislation: South Dakota public records law (SDCL ch. 1-27) — Public inspection and copying of the records of the state and its political subdivisions — open unless a statute expressly closes them; Records not open to inspection and copying (SDCL §§ 1-27-1.5 to 1-27-1.9) — The enumerated categories closed to inspection and copying, led by the § 1-27-1.5 list — applied record by record and cited on each denial; Written requests and review of denials (SDCL §§ 1-27-37, 1-27-38) — The ten-business-day answer to a written request, and the requester's ninety-day window to commence a civil action or file a notice of review with the Office of Hearing Examiners Oversight: South Dakota Office of Hearing Examiners; circuit court — South Dakota routes records disputes through a standing administrative tribunal. Within ninety days of a denial — or of a fee or time estimate the requester objects to — the requester may either commence a civil action or file a written notice of review with the Office of Hearing Examiners (§ 1-27-38). The public entity replies within ten business days, the hearing examiner may decide on the papers and holds a hearing only where one is needed, and the written decision binds the entity unless it is appealed within thirty days. - Response standard: A written request is answered within 10 business days — the record is produced, the request is denied with written reasons, or a time estimate is given; silence is a deemed denial (§ 1-27-37) - Enforcement: Within 90 days of a denial, a civil action or a notice of review filed with the Office of Hearing Examiners (§ 1-27-38); the decision binds unless appealed within 30 days - Exemptions: Records not open to inspection and copying under §§ 1-27-1.5 to 1-27-1.9, led by the enumerated § 1-27-1.5 categories - Charges: Actual cost of reproduction and mailing; the first hour of staff time free - Oversight: Office of Hearing Examiners — a quasi-judicial administrative tribunal — with appeal to the circuit court - Languages: English Q: When must a South Dakota public entity respond? A: A written request must be answered within ten business days. The public record officer either produces the record, denies the request with written reasons, or provides a time estimate for producing it — the statute does not cap the estimate, but it is itself reviewable if the requester objects. If no answer is given within ten business days, the request is deemed denied (§ 1-27-37). AccessPoint computes the date on receipt and tracks any estimate given as its own deadline. Q: What makes South Dakota different — the Office of Hearing Examiners? A: Yes. Within ninety days of a denial, or of a fee or time estimate the requester objects to, the requester may commence a civil action or file a notice of review with the Office of Hearing Examiners (§ 1-27-38). The entity replies within ten business days, the examiner may decide on the papers, and the written decision binds the entity unless appealed within thirty days. AccessPoint assembles the entity's reply from the request file — the record, the exemption cited, and the dates. Q: What can a South Dakota public entity charge? A: The actual cost of reproducing and mailing the record. Staff time is free for the first hour and chargeable after that. Because a fee estimate can be taken to the Office of Hearing Examiners just as a denial can, AccessPoint keeps the calculation on the file and issues the estimate in writing. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Utah (pack us-ut-grama) URL: https://www.realizer.io/solutions/utah-grama — pack content last reviewed 2026-09-03 Legislation: Government Records Access and Management Act (GRAMA) (Utah Code § 63G-2-101 et seq.) — Access to the records of state and local governmental entities, each record classified as public, private, controlled, or protected; Record classifications (Utah Code §§ 63G-2-302 to 63G-2-305) — Private records (§§ 302–303), controlled records (§ 304), and protected records (§ 305) — each with its own rules on who may see it, against the default that a record is public (§ 63G-2-301); Appeals (Utah Code §§ 63G-2-401 to 63G-2-404) — Appeal to the chief administrative officer, then to the Government Records Office director within 30 days, then to the district court Oversight: Utah Government Records Office (director) — the 2025 successor to the State Records Committee; district court — Since 2025, GRAMA appeals run to a single adjudicator rather than a volunteer board. Senate Bill 277 (2025) replaced the seven-member State Records Committee with the Government Records Office, headed by a director appointed by the Governor and confirmed by the Senate. A requester denied access first appeals to the governmental entity's chief administrative officer (§ 63G-2-401), then to the Government Records Office director within 30 days (§ 63G-2-402), and finally to the district court (§ 63G-2-404). - Response standard: Response within 10 business days of receipt — 5 business days where the requester shows an expedited response benefits the public; extraordinary-circumstances extensions are enumerated and capped (§ 63G-2-204) - Enforcement: Appeal to the chief administrative officer, then to the Government Records Office director within 30 days, then to the district court (§§ 63G-2-401 to 63G-2-404) - Exemptions: Records classified private, controlled, or protected (§§ 63G-2-302 to 63G-2-305), against the default that a record is public (§ 63G-2-301) - Charges: The actual cost of providing the record; no charge for the first quarter hour of staff time (§ 63G-2-203) - Oversight: Government Records Office director, who replaced the State Records Committee in 2025; district court - Languages: English Q: When must a Utah governmental entity respond to a GRAMA request? A: As soon as reasonably possible and no later than ten business days after receiving the written request — or five business days where the requester demonstrates that an expedited response benefits the public rather than the person. Where extraordinary circumstances exist, GRAMA enumerates the permitted extensions and caps each one (§ 63G-2-204). AccessPoint computes the applicable date and drafts the extraordinary-circumstances notice. Q: What happened to the State Records Committee? A: It was replaced. Senate Bill 277 (2025) abolished the seven-member State Records Committee and created the Government Records Office, headed by a director appointed by the Governor and confirmed by the Senate. An appeal now runs from the chief administrative officer (§ 63G-2-401) to the Government Records Office director within 30 days (§ 63G-2-402) and then to the district court (§ 63G-2-404). AccessPoint's Utah pack reflects the new path. Q: How do GRAMA's classifications work? A: Every record is public unless it is properly classified otherwise. Private records (§§ 63G-2-302 and 63G-2-303) concern individuals and are generally available to the subject; controlled records (§ 63G-2-304) are medical, psychiatric, or psychological records withheld even from the subject in defined cases; protected records (§ 63G-2-305) cover the governmental interests — from trade secrets to security and deliberative material. AccessPoint tags each record to its classification so the right access rule is applied and the right subsection is cited. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Vermont (pack us-vt-pra) URL: https://www.realizer.io/solutions/vermont-pra — pack content last reviewed 2026-09-03 Legislation: Vermont Public Records Act (1 V.S.A. §§ 315–320) — Public inspection and copying of the records of state and municipal agencies, on the stated policy that officers of government are trustees and servants of the people; Exemptions (1 V.S.A. § 317(c)) — The enumerated categories of public records exempt from inspection and copying — applied by redaction, since an agency may not withhold a record in its entirety because it contains some exempt content (§ 318); Procedure, appeal, and enforcement (1 V.S.A. §§ 318–319) — The three-business-day response, the ten-business-day unusual-circumstances limit, the deemed-denial rule, appeal to the head of the agency, and Superior Court enforcement with attorney fees Oversight: Vermont Superior Court, Civil Division (judicial enforcement) — Vermont has no records ombudsman or commission. A denial is appealed to the head of the agency, who must issue a written determination within five business days (§ 318); after that, the requester's remedy is a complaint in the Civil Division of the Superior Court, which decides the matter with the burden on the agency to sustain its action (§ 319). Where the requester substantially prevails, the court shall assess reasonable attorney fees and litigation costs against the agency — with only a narrow discretionary exception where the agency promptly conceded and produced the record. - Response standard: Respond promptly — within 3 business days of receipt; up to 10 business days from receipt in unusual circumstances; a missed deadline is a deemed denial (§ 318) - Enforcement: Appeal to the head of the agency, who decides in writing within 5 business days (§ 318); then the Civil Division of the Superior Court (§ 319) - Exemptions: The § 317(c) exemptions — applied by redaction, never by withholding a record in its entirety (§ 318) - Charges: Copies at the Secretary of State's uniform schedule — 5 cents per page; staff time chargeable only after the first 30 minutes (§ 316) - Oversight: No oversight agency; the Superior Court assesses attorney fees against the agency where the requester substantially prevails (§ 319) - Languages: English Q: When must a Vermont agency respond? A: Promptly — which the Act defines as not more than three business days after receipt. In unusual circumstances, such as voluminous records, records kept at a separate facility, or the need to consult another agency, the agency may extend the limit to ten business days from receipt by written notice. A limit that passes without a response is a deemed denial (§ 318). AccessPoint computes both points and drafts the unusual-circumstances notice. Q: What makes Vermont different — the redact-never-withhold rule? A: Yes. Under § 318 an agency shall not withhold any record in its entirety on the basis that it contains some exempt content if the record is otherwise subject to disclosure. The exempt passages are redacted under § 317(c), the remainder is released, and the agency explains in writing what was redacted and why. AccessPoint routes any partially exempt record to redaction rather than withholding and keeps the explanation on the file. Q: Who reviews a Vermont denial? A: First the head of the agency, who must issue a written determination within five business days of receiving the appeal (§ 318). There is no ombudsman or commission after that — the requester's remedy is a complaint in the Civil Division of the Superior Court, where the burden is on the agency and, where the requester substantially prevails, the court shall assess reasonable attorney fees and litigation costs against the agency (§ 319). AccessPoint keeps the dated, cited file both stages need. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### West Virginia (pack us-wv-foia) URL: https://www.realizer.io/solutions/west-virginia-foia — pack content last reviewed 2026-09-03 Legislation: West Virginia Freedom of Information Act (W. Va. Code § 29B-1-1 et seq.) — Public inspection and copying of the records of state and local public bodies — every person has a right to inspect or copy any public record except as expressly provided; Exemptions (W. Va. Code § 29B-1-4(a)(1)–(23)) — The twenty-three categories exempt from disclosure — from trade secrets and personal privacy to law-enforcement and critical-infrastructure records — cited on every withholding; Enforcement (W. Va. Code §§ 29B-1-5, 29B-1-7) — Injunctive relief in the circuit court, decided de novo with the burden on the public body, and attorney fees and court costs for a requester who successfully sues Oversight: West Virginia circuit courts (judicial enforcement) — West Virginia has no FOIA commission, ombudsman, or administrative appeal. A person denied access may institute proceedings for injunctive or declaratory relief in the circuit court, which determines the matter de novo with the burden on the public body to sustain its action, may examine the records in camera, hears the case at the earliest practicable date, and may punish a non-complying custodian for contempt (§ 29B-1-5). A requester who successfully sues recovers attorney fees and court costs from the public body (§ 29B-1-7). - Response standard: Within a maximum of 5 days, not counting Saturdays, Sundays, or legal holidays — furnish copies, advise the time and place for inspection, or deny in writing with reasons (§ 29B-1-3(d)) - Enforcement: Injunctive or declaratory relief in the circuit court, decided de novo with the burden on the public body; no administrative appeal and no filing window (§ 29B-1-5) - Exemptions: The § 29B-1-4(a)(1)–(23) exemptions - Charges: Fees reasonably calculated to reimburse the actual cost of reproduction only — no search or retrieval fee and no man-hour charge (§ 29B-1-3(e)) - Oversight: Circuit courts; attorney fees and court costs to a requester who successfully sues (§ 29B-1-7) - Languages: English Q: When must a West Virginia public body respond? A: Within a maximum of five days, not counting Saturdays, Sundays, or legal holidays. In that time the custodian must furnish copies of the requested information, advise the requester of the time and place at which the materials may be inspected and copied, or deny the request stating the reasons in writing (§ 29B-1-3(d)). AccessPoint computes the date over the state holiday calendar and drafts whichever response applies. Q: What makes West Virginia different — no search fee? A: Yes. A public body may establish fees reasonably calculated to reimburse its actual cost of making reproductions, but it may not charge a search or retrieval fee or otherwise seek reimbursement on a man-hour basis (§ 29B-1-3(e)). Inspection is free. AccessPoint's West Virginia fee calculator recovers reproduction cost only. Q: Who reviews a West Virginia denial? A: The circuit court — there is no FOIA commission, ombudsman, or administrative appeal, and no filing window. The court determines the matter de novo with the burden on the public body to sustain its action, may examine the records in camera, hears the matter at the earliest practicable date, and may hold a non-complying custodian in contempt (§ 29B-1-5). A requester who successfully sues recovers attorney fees and court costs (§ 29B-1-7). AccessPoint keeps the timestamped record of who decided what, when, and on which exemption. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Wyoming (pack us-wy-pra) URL: https://www.realizer.io/solutions/wyoming-pra — pack content last reviewed 2026-09-03 Legislation: Wyoming Public Records Act (Wyo. Stat. §§ 16-4-201 to 16-4-205) — Public inspection of the records of the state, its agencies, political subdivisions, and state institutions, with every application made to a designated public records person; Grounds for denial (Wyo. Stat. § 16-4-203) — Two tiers — records the custodian may deny where disclosure would be contrary to the public interest (§ 203(b)) and records the custodian shall deny (§ 203(d)) — plus denial where a statute, federal law, or court rule forbids inspection (§ 203(a)); Timing, the ombudsman, and fees (Wyo. Stat. §§ 16-4-201(c), 16-4-202, 16-4-204) — The immediate, seven-business-day, and thirty-calendar-day release rules; the governor-designated ombudsman; and reasonable copy fees with inspection free Oversight: Wyoming Public Records Ombudsman (designated by the Governor); district courts — Wyoming's ombudsman, designated by the Governor under § 16-4-201(c), receives complaints, mediates at either party's request, may prescribe timelines for release, and may waive fees — but has no penalty power. An applicant may complain to the ombudsman at any time (§ 16-4-202(c)(v)), and where an agreed release date or an ombudsman order is not honoured, may apply to the district court for an order directing the custodian to show cause why inspection should not be permitted (§ 16-4-203(f)). A knowing or intentional violation carries a civil penalty of up to $750 (§ 16-4-205). - Response standard: Readily available records released immediately; notice within 7 business days of acknowledged receipt where records are in active use, in storage, or held by another entity; all records released within 30 calendar days unless good cause exists (§ 16-4-202) - Enforcement: Complaint to the ombudsman at any time, or a district-court order to show cause (§§ 16-4-202(c)(v), 16-4-203(f)) - Exemptions: Two tiers — may deny where contrary to the public interest (§ 16-4-203(b)) and shall deny (§ 16-4-203(d)) — with a written statement of grounds on request (§ 16-4-203(e)) - Charges: Inspection is free; copies, printouts, and photographs at a reasonable fee set by the custodian and authorized by statute, rule, resolution, or ordinance (§ 16-4-204) - Oversight: Public Records Ombudsman — mediation, timelines, and fee waivers, with no penalty power; district courts, with a civil penalty up to $750 for knowing or intentional violations (§ 16-4-205) - Languages: English Q: When must a Wyoming governmental entity release records? A: Immediately, if the record is readily available and release does not impair the entity's other duties. If the record is in active use or in storage, or is held by another governmental entity, the designated public records person must notify the applicant within seven business days of acknowledged receipt. All records must be released within thirty calendar days of acknowledged receipt unless good cause exists, in which case release is on a date mutually agreed with the applicant (§ 16-4-202). AccessPoint computes all three points and drafts each notice. Q: What makes Wyoming different — the ombudsman? A: Wyoming's Public Records Ombudsman is designated by the Governor under § 16-4-201(c). An applicant may file a complaint at any time; the ombudsman mediates at either party's request, may prescribe timelines for release, and may waive fees — but has no penalty power. Where an agreed release date or an ombudsman order is not honoured, the applicant may apply to the district court for an order directing the custodian to show cause why inspection should not be permitted (§ 16-4-203(f)). AccessPoint keeps the dated, cited file both forums rely on. Q: How do the may-deny and shall-deny tiers work? A: Section 16-4-203 has two tiers. Under § 203(b) the custodian may deny inspection of listed records — investigation files, examination data, interagency memoranda, security information, and others — only on the ground that disclosure would be contrary to the public interest. Under § 203(d) the custodian shall deny inspection of enumerated records — medical data, adoption and welfare records, personnel files, trade secrets, and others — unless another law provides otherwise. On request, the applicant receives a written statement citing the law or regulation relied on (§ 203(e)). AccessPoint tags each record to its tier so the right test is applied. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Puerto Rico (pack us-pr-lta) URL: https://www.realizer.io/solutions/puerto-rico-lta — pack content last reviewed 2026-09-03 Legislation: Ley de Transparencia y Procedimiento Expedito para el Acceso a la Información Pública (Ley 141-2019, as amended by Ley 80-2021 and Ley 156-2025) — The right of access to public information held by Puerto Rico's government entities, the response terms, and the expedited judicial remedy for a denial; Ley de Datos Abiertos del Gobierno de Puerto Rico (Ley 122-2019) — Open-data publication duties for the Executive Branch, with their own exceptions that sit alongside the confidentiality grounds recognized in case law; Recurso Especial (Ley 141-2019, Art. 9 (as amended by Ley 80-2021)) — The expedited judicial remedy before the Tribunal de Primera Instancia, filed within a strict thirty-day term, which Ley 80-2021 opened to filing in the requester's own judicial region Oversight: Tribunal de Primera Instancia (judicial enforcement through the Recurso Especial) — Puerto Rico has no information commissioner or oversight body. A requester whose request is denied — or unanswered when the term runs out — files a Recurso Especial before the Tribunal de Primera Instancia within a strict thirty-day term. The remedy is built for speed: no filing fee, the requester may appear in their own right, the entity answers within ten days, and the court resolves on an expedited basis. Since Ley 80-2021 the recourse may be filed in the requester's own judicial region rather than only in San Juan. Ley 156-2025 added the backstop: an agency that wins in court and still does not comply with the resolution can be fined up to $100 a day until it does. - Response standard: Twenty business days from receipt; thirty where the records sit in regional offices or are larger or older files; one extension of up to twenty business days — silence is a deemed denial - Enforcement: No administrative appeal — Recurso Especial before the Tribunal de Primera Instancia within a strict thirty-day term (Art. 9); an agency that then ignores the court's resolution faces a fine up to $100 a day (Art. 10, added by Ley 156-2025) - Exemptions: The confidentiality grounds recognized in Puerto Rico case law and carried into the Act, plus the Ley 122-2019 open-data exceptions - Charges: Inspection is free; copies at direct cost - Oversight: Tribunal de Primera Instancia — an expedited recourse with no filing fee that the requester may bring in their own right - Languages: Spanish and English Q: How long does a Puerto Rico government entity have to respond? A: Twenty business days from receipt under Ley 141-2019 as amended by Ley 156-2025, or thirty where the records sit in regional offices or are larger or older files. The entity may extend once, by up to twenty business days, with notice to the requester. If the term runs out without an answer, the request is deemed denied and the Recurso Especial is available. AccessPoint computes each date on receipt and drafts the extension notice in Spanish or English. Q: What is the Recurso Especial? A: The expedited judicial remedy under Art. 9 of Ley 141-2019. A requester denied information — expressly or by silence — files it before the Tribunal de Primera Instancia within a strict thirty-day term, with no filing fee and no need for counsel. The entity answers within ten days and the court resolves on an expedited basis. Since Ley 80-2021 the recourse may be filed in the requester's own judicial region, and since Ley 156-2025 an agency that loses and still does not comply with the court's resolution can be fined up to $100 a day (Art. 10). AccessPoint builds the timestamped record the entity files in answer. Q: Does AccessPoint work in Spanish? A: Yes. AccessPoint's interface is available in Spanish, and the Puerto Rico pack ships Spanish correspondence templates — acknowledgement, extension notice, release, and denial — alongside English ones. Requesters can be answered in the language they wrote in, and coordinators can work in either. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Guam (pack us-gu-sunshine) URL: https://www.realizer.io/solutions/guam-sunshine — pack content last reviewed 2026-09-03 Legislation: Sunshine Reform Act of 1999 (5 GCA § 10101 et seq.) — Public access to the records of the government of Guam — its departments, agencies, and instrumentalities — with a four-working-day duty to comply or cite the limitation relied on (§ 10103(d)–(e)); Limitations on disclosure (5 GCA § 10108(a)–(r)) — The enumerated records the Act does not require to be disclosed, each cited on the withholding; Enforcement and penalty (5 GCA § 10112) — An action in the Superior Court of Guam, a $1,000 fine assessed as the personal expense of the official responsible, and attorney fees to a prevailing plaintiff paid by the agency Oversight: Superior Court of Guam (judicial enforcement) — Guam has no records commission or ombudsman. A person denied records may bring an action in the Superior Court of Guam at any time — there is no filing window, and once the agency misses its deadline administrative remedies are treated as exhausted. Under § 10112 an official who violates the Act is fined $1,000 as a personal expense, not one the agency pays, and a prevailing plaintiff recovers attorney fees from the agency. - Response standard: Comply, or cite the § 10108 limitation relied on, within four working days of the request; up to ten more days in unusual circumstances with written notice (§ 10103(d)–(e)) - Enforcement: No administrative appeal — an action in the Superior Court of Guam at any time; no filing window - Exemptions: The § 10108(a)–(r) limitations — the records the Act does not require to be disclosed - Charges: Inspection is free; copies at direct cost - Oversight: Superior Court of Guam — a $1,000 fine assessed against the responsible official personally (§ 10112) and attorney fees to a prevailing plaintiff - Languages: English Q: How quickly must a Guam agency respond? A: Within four working days of the request, the agency must comply or cite the § 10108 limitation it relies on. In unusual circumstances it may extend by up to ten more days with written notice to the requester. Once the deadline passes without a response, administrative remedies are treated as exhausted and the requester may go to the Superior Court of Guam. AccessPoint computes both dates on receipt and drafts the notice. Q: What are the § 10108 limitations? A: Section 10108(a) through (r) lists the records the Sunshine Reform Act does not require an agency to disclose. Because the Act asks the agency to cite the limitation relied on within the same four working days it has to comply, AccessPoint ships each lettered limitation as a citable ground carried onto the redaction and into the response. Q: Who pays the penalty for a Sunshine Reform Act violation? A: The official responsible. Under § 10112 the $1,000 fine is assessed as the personal expense of the official who violated the Act, while the agency pays the prevailing plaintiff's attorney fees. AccessPoint's contemporaneous, timestamped trail — who did what, when, and on which limitation — is the practical protection for the people on the file. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### U.S. Virgin Islands (pack us-vi-pra) URL: https://www.realizer.io/solutions/us-virgin-islands-pra — pack content last reviewed 2026-09-03 Legislation: Virgin Islands Public Records Act (3 V.I.C. § 881 et seq.) — The right of every citizen of the Territory to examine and copy the public records of the Government of the Virgin Islands, its departments, agencies, and instrumentalities; Confidential records (3 V.I.C. § 881(g)) — The categories held confidential — student records, medical records, trade secrets, attorney work product, and police investigative reports Oversight: Virgin Islands courts (judicial enforcement) — The Virgin Islands has no records commission or ombudsman, and the Act sets no administrative appeal. A citizen refused access may seek a writ of mandamus or an injunction in court to compel examination and copying, and an official who refuses access in violation of the Act commits a misdemeanor punishable by a $100 fine. Because the Act sets no response deadline, the record of when a request arrived and how it was handled is the custodian's own best evidence of good faith. - Response standard: No statutory deadline — records are open to examination and copying by citizens of the Territory; AccessPoint applies a ten-business-day operational target you can tune - Enforcement: No administrative appeal — mandamus or injunction in court to compel access - Exemptions: The § 881(g) confidential categories — student records, medical records, trade secrets, attorney work product, and police investigative reports - Charges: Inspection is free; the requester pays the expense of copying - Oversight: Virgin Islands courts; refusal of access in violation of the Act is a misdemeanor carrying a $100 fine - Languages: English Q: Is there a response deadline under the Virgin Islands Public Records Act? A: No. The Act grants a right to examine and copy public records but attaches no statutory deadline, extension mechanism, or deemed denial. AccessPoint applies a ten-business-day operational target by default, which you can tune to your own service standard, and tracks every request against it so the file shows a consistent process. Q: Who may request records in the Virgin Islands? A: The statute grants the right to examine and copy public records to citizens of the Territory — a residency-based restriction almost no other U.S. public records law imposes. AccessPoint records how eligibility was determined on each request so the standard is applied evenly and the decision is documented. Q: How is the Act enforced? A: Through the courts. A citizen refused access may seek a writ of mandamus or an injunction to compel examination and copying, and an official who refuses access in violation of the Act commits a misdemeanor punishable by a $100 fine. There is no records commission or ombudsman. AccessPoint's timestamped trail — receipt, search, category cited, release — is the record a court would review. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Northern Mariana Islands (pack us-mp-oga) URL: https://www.realizer.io/solutions/northern-mariana-islands-oga — pack content last reviewed 2026-09-03 Legislation: Open Government Act of 1992 (1 CMC § 9901 et seq.) — Public access to the records and meetings of the government of the Commonwealth of the Northern Mariana Islands and its agencies, with records to be made available for inspection within ten days; Exemptions (1 CMC § 9918) — The enumerated categories of records exempt from public inspection, together with the privacy carve-out for personal information; Judicial enforcement (1 CMC § 9916) — Mandamus or injunction in the Superior Court, which gives the matter an immediate hearing and priority and orders compliance within forty-eight hours Oversight: CNMI Superior Court (judicial enforcement) — The Commonwealth has no records commission or ombudsman, and the Act provides no administrative appeal. A person denied a record may seek mandamus or an injunction in the Superior Court, which must hear the matter immediately and with priority and, where the denial is unlawful, order compliance within forty-eight hours; a prevailing requester recovers attorney fees. - Response standard: Records made available for inspection within ten days of the request — the Act sets no extension and does not limit the count to working days - Enforcement: No administrative appeal — mandamus or injunction in the Superior Court, heard immediately and with priority (§ 9916) - Exemptions: The § 9918 exemptions plus the privacy carve-out for personal information - Charges: Inspection is free; copies at actual cost - Oversight: CNMI Superior Court — a forty-eight-hour compliance order and attorney fees to a prevailing requester - Languages: English Q: How long does a CNMI agency have to produce records? A: Ten days from the request, with no statutory extension. The Act counts days, not working days. AccessPoint computes the date on receipt over the Commonwealth's holiday calendar and escalates as it approaches, because there is no second deadline to fall back on. Q: What happens in court if a record is wrongly withheld? A: Under § 9916 the requester may seek mandamus or an injunction in the Superior Court, which must give the matter an immediate hearing and priority. Where the denial is unlawful the court orders compliance within forty-eight hours, the custodian may not alter or destroy the record at issue once the petition is filed, and a prevailing requester recovers attorney fees. AccessPoint's timestamped file is built to be put before that court on short notice. Q: What can be withheld, and what can be charged? A: Only the records within the enumerated § 9918 exemptions, or protected by the Act's privacy carve-out for personal information, may be withheld — and the category relied on should be cited on each withholding. Inspection is free; copies are charged at actual cost. AccessPoint ships each exemption as a citable ground and itemizes the copy charge on the file. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### United States — Other States (pack us-state-records) URL: https://www.realizer.io/solutions/us-state-records — pack content last reviewed 2026-07-13 Legislation: State Public Records Law (Rebindable to your state's statute) — A single configurable authority you bind to your Open Records Act, Public Records Act, Right-to-Know Law, or Sunshine Law; Configurable deadline (Fixed days or reasonable-time mode) — Set a statutory day count, or a reasonable-time rule for the states that fix no hard response deadline; State exemptions and fees (Rebindable catalogue and fee schedule) — Load your state's exemption catalogue and copy, labor, and search fee rules as the redaction and cost basis Oversight: Configurable — courts, an ombudsman or public-access counselor, or attorney-general opinions, per your state — Bind the oversight model your state uses — judicial enforcement, an ombudsman or public-access counselor, or advisory attorney-general opinions — so appeals and reviews follow the right path. - Coverage: The roughly 44 states without a dedicated AccessPoint pack - Legal authority: One rebindable State Public Records Law - Response deadline: Configurable — a fixed day count or a reasonable-time mode - Exemptions and fees: Load your state's exemption catalogue and fee schedule - Oversight: Configurable — courts, ombudsman, or attorney-general opinions - Languages: English Q: Which states is this pack for? A: The roughly 44 states that don't yet ship as a dedicated AccessPoint configuration. An administrator rebinds the baseline to their own state's public-records statute, deadline, exemptions, and fees, so you get a working program without waiting for a state-specific pack. Q: What if my state sets no fixed response deadline? A: Use the reasonable-time mode. Several states require only a "prompt" or "reasonable" response rather than a fixed number of days; AccessPoint can track that standard with review milestones instead of a hard due date, or you can set a fixed day count where your state specifies one. Q: Can I load my state's own exemptions and fees? A: Yes. The exemption catalogue and the copy, labor, and search fee rules are configurable, so every withholding carries a citation from your state's statute and every fee estimate follows your state's schedule. Q: Where does our data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### California — CCPA/CPRA (pack us-ca-ccpa) URL: https://www.realizer.io/solutions/california-ccpa — pack content last reviewed 2026-08-10 Legislation: California Consumer Privacy Act, as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.) — California's consumer privacy regime — the rights to know, delete, correct, port, and to opt out of sale, sharing, and certain uses of sensitive personal information; Breach notification (Cal. Civ. Code § 1798.82) — The duty to notify California residents of a breach of unencrypted personal information in the most expedient time possible; California Privacy Protection Agency (Cal. Civ. Code § 1798.199.10 et seq.) — The dedicated regulator with rulemaking, audit, and enforcement authority over the California regime Oversight: California Privacy Protection Agency (CPPA), with the Attorney General — California is the only US state with a dedicated privacy regulator. The CPPA holds rulemaking, investigative, audit, and administrative enforcement powers over the CCPA, and the Attorney General retains civil enforcement — so a California program faces a supervisory relationship closer to a European one than to the rest of the United States. - Rights deadline: 45 days, extendable once by a further 45 days on notice - Acknowledgment: Within 10 business days of receiving a request - Rights covered: Know, delete, correct, port, opt out of sale/sharing, limit sensitive personal information - Breach notice: § 1798.82 — the most expedient time possible and without unreasonable delay - Oversight: California Privacy Protection Agency and the Attorney General - Languages: English Q: Who is subject to the CCPA? A: The Act applies to for-profit businesses doing business in California that meet its thresholds for revenue, volume of consumers' personal information, or revenue derived from selling or sharing personal information, and it reaches service providers and contractors through required contract terms. Whether a particular organization is covered is a legal question for its own counsel — AccessPoint runs the regime for organizations that are. Q: How long do we have to respond? A: 45 days from receipt, extendable once by a further 45 days where reasonably necessary with notice to the consumer, and a request must be acknowledged within 10 business days. AccessPoint computes all three dates and shows whichever falls next. Q: Can privacy consultancies run this for clients? A: Yes. A consultancy can host AccessPoint in its own tenant, tag each case with a Customer field, and use case-matched roles so a client sees exactly its own cases and reports and nothing else. See the managed service provider page for how that model works in practice. Q: Where does consumer personal information reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, the personal information gathered to answer them, and the audit history never leave your control — no third-party cloud and no vendor access. ### United States — State Consumer Privacy (pack us-state-privacy) URL: https://www.realizer.io/solutions/us-state-consumer-privacy — pack content last reviewed 2026-08-10 Legislation: State consumer privacy acts (VA, CO, CT, UT, TX, OR, MT, IA, DE, NH, NJ, NE, TN, MN, FL, IN, KY, RI and others) — The comprehensive state privacy laws sharing a common structure of consumer rights, controller duties, and assessment obligations; Consumer rights (Access, deletion, correction, portability, and opt-out) — The rights common across the state acts, including opt-out of targeted advertising, sale, and profiling with legal or similarly significant effects; The appeal step (Consumer appeal provisions) — The distinctive right to appeal a controller's refusal internally, with a route to the Attorney General where the appeal is denied Oversight: State Attorneys General — Outside California, these acts are enforced by the state Attorney General rather than a dedicated agency, most with a cure period before enforcement. Because a denied appeal typically comes with a route for the consumer to complain to the AG, the appeal record is usually the first thing an enforcement inquiry looks at. - Rights deadline: 45 days, extendable once by a further 45 days on notice - Appeal: An internal appeal of a refusal, answered within the statutory window - Rights covered: Access, deletion, correction, portability, and opt-out of targeted advertising, sale, and profiling - Assessments: Data protection assessments for higher-risk processing - Enforcement: State Attorneys General, most with a cure period - Languages: English Q: Which states does this pack cover? A: The comprehensive state consumer privacy acts that share the Virginia-derived structure — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Florida, Indiana, Kentucky and Rhode Island. It is one configuration of the common shape, with the governing state recorded per request; California is a separate pack because its regime genuinely differs. Q: Why is California separate? A: Because California is the outlier rather than the template. It has a dedicated regulator in the CPPA, a different rights vocabulary, and no consumer appeal step. Folding it into a generic multi-state configuration would mean approximating both, so AccessPoint ships a California pack and a multi-state pack and lets an organization install either or both. Q: How are the differences between states handled? A: The pack ships the common structure, and the governing state is recorded on each request so responses, exceptions, and reporting reflect it. Where a state's threshold, cure period, or assessment trigger differs, that is a configuration matter within the pack rather than a separate deployment. Q: Where does consumer personal information reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, the personal information gathered to answer them, and the audit history never leave your control — no third-party cloud and no vendor access. ### Maryland — MODPA (pack us-md-mmdpa) URL: https://www.realizer.io/solutions/maryland-mmdpa — pack content last reviewed 2026-08-10 Legislation: Maryland Online Data Privacy Act (MODPA) — Maryland's comprehensive consumer privacy statute, imposing substantive limits on collection and use rather than only procedural duties; Consumer rights (MODPA rights provisions) — Access, deletion, correction, portability, and opt-out on the 45-day clock with an internal appeal of a refusal; Data protection assessments (MODPA assessment provisions) — Assessments required for higher-risk processing, including targeted advertising, sale, sensitive data, and profiling Oversight: Maryland Attorney General — MODPA is enforced by the Maryland Attorney General. Because the statute imposes substantive limits on what may be collected at all — rather than only requiring disclosure and choice — an enforcement inquiry tends to ask what the organization decided it needed and why, not merely what it told consumers. - Rights deadline: 45 days, extendable once by a further 45 days on notice - Appeal: An internal appeal of a refusal, answered within the statutory window - Minimization: Collection limited to what is reasonably necessary — consent does not cure an excess - Sensitive data: Sale prohibited; processing limited to what is strictly necessary - Minors: Heightened protections on targeted advertising and sale - Languages: English Q: What makes MODPA stricter than the other state acts? A: Three things. Data minimization is a substantive limit rather than a disclosure duty — collection must be reasonably necessary and proportionate to the product or service requested, and consent does not cure an excess. Selling sensitive data is prohibited outright rather than gated behind consent. And minors receive protections beyond what other states adopted. Q: Can we run MODPA alongside the other state acts? A: Yes. Most organizations install the multi-state consumer privacy pack for the Virginia-derived states and add MODPA for Maryland, since Maryland's substantive limits genuinely differ. Both run on one platform, with the governing law recorded on each request. Q: How does AccessPoint evidence data minimization? A: Through a register of purposes and the data categories each one relies on, with the necessity and proportionality justification recorded against it and linked to the assessment that approved the processing. That converts minimization from a claim into a dated record showing what was decided and on what basis. Q: Where does consumer personal information reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, the personal information gathered to answer them, and the audit history never leave your control — no third-party cloud and no vendor access. ### United States — Privacy Act (pack us-privacy-act) URL: https://www.realizer.io/solutions/united-states-privacy-act — pack content last reviewed 2026-07-24 Legislation: Privacy Act of 1974 (5 U.S.C. § 552a) — An individual's right to access and request amendment of records about themselves held in a federal "system of records", and limits on how agencies disclose those records; Access, amendment, and review (5 U.S.C. § 552a(d)) — Access to your record (d)(1); a written amendment request acknowledged within 10 working days (d)(2); review of a refusal within 30 working days (d)(3); and a statement of disagreement noted on the record and provided to prior and future recipients (d)(4) Oversight: US Department of Justice, Office of Privacy and Civil Liberties (OPCL) — OPCL provides legal advice, policy guidance, and training to federal agencies on the Privacy Act, but it does not decide individual requests. The Act is ultimately enforced by the individual: under § 552a(g) a person may bring a civil action in US district court, where access and amendment are reviewed de novo, with actual damages of at least $1,000 plus costs and attorney fees for intentional or wilful violations. - Access & amendment: Access records about yourself and request amendment (5 U.S.C. § 552a(d)(1)-(2)) - Amendment acknowledgment: Acknowledged in writing within 10 working days; review of a refusal within 30 working days (§ 552a(d)(2)-(3)) - If amendment is refused: File a statement of disagreement, noted on the record and disclosed with it (§ 552a(d)(3)-(4)) - Exemptions: General exemptions (§ 552a(j)) and specific exemptions (§ 552a(k)) - Charges: Copying costs only — no fee to search for or review the record (§ 552a(f)(5)) - Oversight & remedies: DOJ Office of Privacy and Civil Liberties (OPCL) guidance; civil action in US district court (§ 552a(g)) - Languages: English Q: How quickly must a federal agency act on a Privacy Act amendment request? A: The agency must acknowledge the amendment request in writing within 10 working days of receipt and promptly make the correction or refuse it (§ 552a(d)(2)). If it refuses, the individual may seek review, which the agency must complete within 30 working days (extendable for good cause) (§ 552a(d)(3)). AccessPoint computes both clocks from intake and drives the workflow to a defensible close. Q: What makes the Privacy Act different — the statement of disagreement? A: Yes. When an agency refuses to amend after review, the individual may file a concise statement of disagreement, and § 552a(d)(4) requires the agency to note the disputed portion of the record and provide that statement to anyone the record is disclosed to thereafter. Because § 552a(t) also bars relying on a FOIA exemption to deny Privacy Act access — and the reverse — AccessPoint processes each first-party request under both statutes. Q: What can an agency charge? A: For a Privacy Act request the agency may charge only the direct cost of making the copies provided to the individual — there is no fee to search for or review the record (§ 552a(f)(5)). AccessPoint computes the copying charge and keeps it separate from any parallel FOIA fee. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### United States — HIPAA (pack us-hipaa) URL: https://www.realizer.io/solutions/us-hipaa — pack content last reviewed 2026-07-13 Legislation: HIPAA Privacy Rule — Access (45 CFR 164.524) — An individual's right to inspect and obtain a copy of their protected health information held in a designated record set; HIPAA Privacy Rule — Amendment (45 CFR 164.526) — An individual's right to request amendment of their PHI, with defined grounds for denial and a statement-of-disagreement process; HIPAA Breach Notification Rule (45 CFR 164.400–414) — Notification to affected individuals, the HHS Secretary, and in some cases the media after a breach of unsecured PHI Oversight: HHS Office for Civil Rights (OCR) — OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules — investigating complaints, imposing civil money penalties, and running an ongoing Right of Access enforcement initiative. - Access deadline: 30 calendar days, with one 30-day extension (45 CFR 164.524) - Access fee: A reasonable, cost-based fee only - Amendment deadline: 60 days to act, with one 30-day extension (45 CFR 164.526) - Breach notification: Without unreasonable delay, no later than 60 calendar days (45 CFR 164.404) - Oversight: HHS Office for Civil Rights (civil money penalties) - Languages: English Q: Who is this HIPAA configuration for? A: Public-sector covered entities — public hospitals, county and state health departments, Medicaid agencies, and public university health services — handling individuals' requests to access and amend their own protected health information. It is not a public records or FOI tool; it runs the HIPAA Privacy Rule rights and the Breach Notification Rule. Q: How long do we have to respond to a right-of-access request? A: No later than 30 calendar days after receipt, with one 30-day extension on written notice to the individual (45 CFR 164.524). You may charge only a reasonable, cost-based fee. AccessPoint tracks the clock, the extension, the requested format, and the fee basis on every request. Q: Does it handle amendment requests and breach notification? A: Yes. AccessPoint runs 164.526 amendments — the 60-day clock, the single 30-day extension, the grounds for denial, and the individual's statement of disagreement — and the Breach Notification Rule (164.400–414), including the 60-day individual-notice deadline and reporting to the HHS Secretary. Q: Where does protected health information reside? A: Entirely within your own Microsoft 365 and Azure tenant. PHI, requests, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### United States — FERPA (pack us-ferpa) URL: https://www.realizer.io/solutions/us-ferpa — pack content last reviewed 2026-07-13 Legislation: FERPA (20 U.S.C. § 1232g) — Parent and eligible-student rights to inspect, review, and seek amendment of education records at agencies and institutions receiving federal funds; FERPA Regulations (34 CFR Part 99) — The 45-day inspection right (§ 99.10), the amendment and hearing process (§§ 99.20–99.22), and the rules on disclosure and consent; PPRA (20 U.S.C. § 1232h) — The Protection of Pupil Rights Amendment, administered alongside FERPA by the same Department of Education office Oversight: US Department of Education — Student Privacy Policy Office (SPPO) — SPPO administers and enforces FERPA and PPRA — investigating complaints and providing technical assistance; the ultimate sanction for non-compliance is the withdrawal of federal funding. - Inspection deadline: Within 45 days of the request (34 CFR 99.10) - Who may request: A parent, or an eligible student (age 18 or attending a postsecondary institution) - Amendment: Request amendment; a hearing if the school declines (§§ 99.20–99.21) - After a hearing: If not amended, the individual may place a statement in the record (§ 99.21) - Oversight: US Department of Education, Student Privacy Policy Office (SPPO) - Languages: English Q: Who is this FERPA configuration for? A: Schools and educational agencies and institutions that receive US Department of Education funding — K-12 districts, colleges, and universities — handling parent and eligible-student requests to inspect and amend education records. It is not a public records or FOI tool; it runs the FERPA rights end to end. Q: How long do we have to let a parent or student inspect records? A: No more than 45 days after the request is received (34 CFR 99.10). AccessPoint tracks the clock from intake, scopes the education record, and logs the disclosure, with reminders before the deadline. Q: What happens if we decline to amend a record? A: FERPA requires you to notify the parent or eligible student and offer a hearing (§ 99.21). If the record still isn't amended after the hearing, they may place a statement of disagreement in the record that is kept with it and disclosed alongside it (§ 99.21(c)). AccessPoint runs that full chain and records each step. Q: Where do education records reside? A: Entirely within your own Microsoft 365 and Azure tenant. Education records, requests, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### United Kingdom — FOIA (pack uk-foia) URL: https://www.realizer.io/solutions/united-kingdom-foia — pack content last reviewed 2026-07-24 Legislation: Freedom of Information Act 2000 (Freedom of Information Act 2000, c. 36) — Public access to recorded information held by UK public authorities — a 20-working-day response (section 10); ICO decision notices and Tribunal appeals (FOIA 2000, ss. 50, 57–58) — After internal review, a requester may apply to the Information Commissioner, who issues a binding decision notice (s.50); either party may appeal to the First-tier Tribunal (General Regulatory Chamber) (ss.57–58) Oversight: Information Commissioner's Office (ICO) — The ICO is the independent regulator for FOIA. After an authority's internal review, a requester may apply to the Commissioner, who investigates and issues a binding decision notice under section 50 — ordering disclosure or upholding the refusal. Either party may appeal that notice to the First-tier Tribunal (General Regulatory Chamber) under sections 57–58, and onward on a point of law to the Upper Tribunal. - Response standard: 20 working days from receipt (section 10) - Appeal route: Internal review → ICO decision notice (s.50) → First-tier Tribunal (ss.57–58) - Exemptions: Part II absolute and qualified exemptions (ss.21–44); qualified ones subject to the public-interest test (s.2) - Charges: No fee for standard requests; refuse over the section 12 appropriate limit — £600 central government, £450 other authorities - Oversight: Information Commissioner's Office (ICO); appeals to the First-tier Tribunal - Languages: English, with Welsh and other languages configurable Q: When must a UK public authority respond to an FOI request? A: Section 10 requires a public authority to respond promptly and in any event within 20 working days of receipt. Where it needs more time to weigh the public interest on a qualified exemption, the Act allows a reasonable extension. AccessPoint computes the 20-working-day date on a UK working-day calendar and tracks any public-interest-test extension. Q: What makes FOIA distinctive — the public-interest test and the appeal chain? A: Many Part II exemptions are qualified, so the authority may withhold only if the public interest in maintaining the exemption outweighs the public interest in disclosure (section 2). A dissatisfied requester goes to internal review, then to the ICO for a binding section 50 decision notice, with appeal to the First-tier Tribunal (General Regulatory Chamber). AccessPoint records the balance and manages the escalation. Q: What can a public authority charge? A: There is normally no fee for a standard FOI request. If the authority estimates that compliance would exceed the appropriate limit — £600 for central government or £450 for other authorities, calculated at £25 per hour under the Fees Regulations 2004 — it may refuse under section 12 or charge in limited cases. AccessPoint estimates the cost and issues the section 12 notice. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### United Kingdom — DPA / UK GDPR (pack uk-dpa) URL: https://www.realizer.io/solutions/united-kingdom-dpa — pack content last reviewed 2026-09-07 Legislation: UK GDPR (Retained Regulation (EU) 2016/679 (UK GDPR)) — Data-subject rights — access (Art 15), rectification (Art 16), erasure (Art 17) — and controller obligations for personal data, on a one calendar-month clock; Data Protection Act 2018 (Data Protection Act 2018, c. 12) — The UK's data protection framework — the Schedule 2 and 3 exemptions from subject access and other rights, law-enforcement processing, and ICO enforcement Oversight: Information Commissioner's Office (ICO) — The ICO is the UK's independent data protection authority. It investigates complaints from data subjects, issues assessment, information, and enforcement notices, and can impose monetary penalties for infringements of the UK GDPR and DPA 2018. Controllers must report a qualifying personal data breach to the ICO within 72 hours, and individuals may also seek a remedy in court under section 167. - Response standard: One month from the relevant time under Article 12A (Data (Use and Access) Act 2025, in force 5 February 2026): the latest of receipt, receipt of requested identity or clarification information, and any fee - Extension: Up to two further months for complex or numerous requests, with notice within the first month - Exemptions: DPA 2018 Schedule 2 and 3 restrictions — crime and taxation, legal professional privilege, immigration, management forecasts, and more - Fee: First copy free; a reasonable fee for further copies or manifestly unfounded or excessive requests (Article 12(5)) - Oversight: Information Commissioner's Office (ICO); breach notification within 72 hours (Article 33) - Languages: English, with Welsh and other languages configurable Q: How quickly must you answer a UK subject access request? A: Article 12A, inserted by the Data (Use and Access) Act 2025 and in force since 5 February 2026, sets the applicable time period: one month from the relevant time — receipt, or the later receipt of identity or clarification information the controller asked for — with those clarification days not counted, and Article 15(1A) confirms the search need only be reasonable and proportionate. The period may be extended by up to two further months for complex or numerous requests, provided the individual is told within the first month. AccessPoint computes the one-month date, tracks any extension, and drives the Article 15 workflow to a defensible close. Q: What can you withhold — the DPA 2018 exemptions? A: What you may hold back is set by the Data Protection Act 2018, not by discretion. The Schedule 2 and 3 restrictions cover crime and taxation, legal professional privilege, immigration, management information, and more, and each applies only so far as necessary and proportionate. AccessPoint records every exemption relied on against the specific data, with a full audit trail. Q: Can you charge for a subject access request? A: The first copy of an individual's personal data is provided free. A reasonable fee based on administrative costs may be charged for further copies, or where a request is manifestly unfounded or excessive (Article 12(5)) — and the same test can support a refusal. AccessPoint applies the fee rule and records the justification. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud, no vendor access, and no offshore processing. ### United Kingdom — EIR (pack uk-eir) URL: https://www.realizer.io/solutions/united-kingdom-eir — pack content last reviewed 2026-07-24 Legislation: Environmental Information Regulations 2004 (Environmental Information Regulations 2004, SI 2004/3391) — Public access to environmental information held by public authorities — a 20-working-day response (regulation 5), extendable to 40 (regulation 7); Regulation 12 exceptions and appeals (EIR 2004, regs 11, 12, 18; FOIA 2000 ss. 50, 57–58) — Every exception is qualified and subject to the public-interest test and the presumption in favour of disclosure; refusals go to reconsideration, then an ICO decision notice and the First-tier Tribunal Oversight: Information Commissioner's Office (ICO) — The ICO regulates the EIR alongside FOIA. After an authority's reconsideration (regulation 11), a requester may complain to the Commissioner, who issues a binding decision notice, applying the regulation 12(2) presumption in favour of disclosure. Either party may appeal to the First-tier Tribunal (General Regulatory Chamber) and onward to the Upper Tribunal on a point of law. - Response standard: 20 working days from receipt (regulation 5); extendable to 40 for complex and voluminous requests (regulation 7) - Presumption: A statutory presumption in favour of disclosure applies to every exception (regulation 12(2)) - Exceptions: Regulation 12(4) and 12(5) exceptions — all qualified and subject to the public-interest test (regulation 12(1)(b)) - Charges: A reasonable charge may be made (regulation 8); inspection in situ and public registers are free — but there is no section 12 cost-limit refusal - Oversight: Information Commissioner's Office (ICO); appeals to the First-tier Tribunal - Languages: English, with Welsh and other languages configurable Q: How long does a public authority have to answer an EIR request? A: Regulation 5 sets 20 working days from receipt. Where a request is complex and voluminous, regulation 7 allows an extension to 40 working days, with the requester told within the first 20. AccessPoint computes both dates on a UK working-day calendar and tracks the extension. Q: How is EIR different from FOIA? A: The EIR tilts further toward disclosure. Regulation 12(2) imposes a presumption in favour of disclosure, every exception is qualified and subject to the public-interest test, and there is no section 12 cost limit — a request can be refused only if it is manifestly unreasonable. AccessPoint routes environmental requests through EIR and records the balance on each exception. Q: What can a public authority charge? A: Under regulation 8 an authority may make a reasonable charge for making environmental information available, though access to a public register and inspection in situ must be free. There is no appropriate-limit cost refusal as under FOIA section 12. AccessPoint applies the charge rule and records it. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### United Kingdom — DPA 2018 Part 3 (pack uk-dpa-le) URL: https://www.realizer.io/solutions/united-kingdom-dpa-law-enforcement — pack content last reviewed 2026-09-07 Legislation: Data Protection Act 2018, Part 3 (DPA 2018, ss. 29–81) — The law-enforcement processing regime applying to competent authorities processing for law-enforcement purposes — distinct from UK GDPR; Right of access (DPA 2018, s. 45) — The data subject's right of access under Part 3, with the s.45(4) restrictions applied case by case rather than as blanket exemptions; Logging (DPA 2018, s. 62) — The duty to keep logs of specified processing operations in automated systems, including consultation and disclosure Oversight: Information Commissioner's Office (ICO) — The ICO oversees Part 3 alongside UK GDPR and FOIA. Part 3 carries duties the general regime does not — the appropriate policy document for sensitive processing, s.62 logging, and restrictions that must be justified per request — and the ICO has been explicit that a blanket approach to s.45(4) is not compliance. - Access deadline: One month under s. 54, with the s. 54(3A) two-month extension for complex or numerous requests and the s. 54(3C) clarification stop (both in force since 5 February 2026) - Restrictions: s.45(4) applied case by case, with the reason recorded and the data subject informed unless that would prejudice the purpose - NCND: Neither confirm nor deny, where confirming would itself prejudice a law-enforcement purpose - Sensitive processing: An appropriate policy document in place and reviewed - Breach: 72 hours to the ICO where the duty is engaged - Languages: English Q: Who processes under Part 3 rather than UK GDPR? A: Competent authorities — police forces, prosecutors, and other bodies with statutory law-enforcement functions — when they process for law-enforcement purposes. The same organization's HR and corporate processing generally falls under UK GDPR, which is why AccessPoint ships the two as separate packs that can run side by side in one tenant. Q: How are s.45(4) restrictions different from FOIA exemptions? A: They are applied case by case to specific information, for a reason that must be recorded, and the data subject must generally be informed that a restriction was applied and of their right to complain to the ICO — unless providing that information would itself prejudice the purpose. They are not categories to be claimed across a whole file, and the ICO has been clear that blanket application is not compliance. Q: Does AccessPoint satisfy the s.62 logging duty? A: It records consultation and disclosure of the records it holds in a hash-chained, append-only audit ledger with server-side integrity verification, which is the evidence s.62 contemplates for the processing within AccessPoint. Logging obligations across your other operational systems remain those systems' responsibility. Q: Where does law-enforcement data reside? A: Entirely within your own Microsoft 365 and Azure tenant, under your existing security controls and your own conditional access — no third-party cloud, no vendor access, and no cross-border transfers. ### United Kingdom — Access to Health Records Act 1990 (pack uk-health-records) URL: https://www.realizer.io/solutions/united-kingdom-health-records — pack content last reviewed 2026-08-10 Legislation: Access to Health Records Act 1990 (1990 c. 23) — Access to the health records of a deceased patient by their personal representative and by a person with a claim arising from the death; Limits on access (AHRA 1990, s. 5) — The grounds for withholding — serious harm, third-party identification, the patient's recorded objection, and information not relevant to a claim; Timescales (AHRA 1990, access provisions) — 21 days where the record was added to in the preceding 40 days, and 40 days otherwise Oversight: The organisation's complaints procedure, with the ICO and the courts — The 1990 Act does not sit under the ICO's usual subject-access jurisdiction in the way UK GDPR does. Disputes typically run through the provider's own complaints procedure and, if unresolved, to the relevant ombudsman or the courts — which puts unusual weight on how carefully the original decision was recorded. - Who may apply: The patient's personal representative, and any person with a claim arising from the death - Deadline: 21 days where the record was added to in the last 40 days; otherwise 40 days - Scope for claimants: Only information relevant to the claim - Limits: s.5 — serious harm, third-party identification, the patient's recorded objection - Fees: No fee for access itself; charges limited to what the Act permits - Languages: English Q: Why isn't this just a subject access request? A: Because data protection rights do not survive the data subject. Once a patient has died, UK GDPR no longer provides a right of access to their records; the Access to Health Records Act 1990 does, on different terms — a narrower class of applicants, different deadlines, a claim-relevance limit, and its own withholding grounds. Running it as a SAR applies the wrong clock and usually the wrong scope. Q: Which deadline applies, 21 days or 40? A: 21 days where the record was added to during the 40 days preceding the application, and 40 days otherwise. AccessPoint puts the question at intake and sets the clock from the answer, so the shorter deadline is not missed by defaulting. Q: How is a claimant's access limited? A: A person applying because they have a claim arising from the patient's death is entitled only to information relevant to that claim — not to the whole record. AccessPoint scopes the release accordingly and records what was excluded as not relevant, so the basis of the response is documented if it is later questioned. Q: Where do patient records reside? A: Entirely within your own Microsoft 365 and Azure tenant. Records, requests, clinical review opinions, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border transfers. ### Scotland (pack sco-foi-dp) URL: https://www.realizer.io/solutions/scotland-foi-dp — pack content last reviewed 2026-07-13 Legislation: FOISA (Freedom of Information (Scotland) Act 2002 (asp 13)) — Public access to information held by Scottish public authorities — 20 working days, in force since 1 January 2005; UK GDPR (Retained Regulation (EU) 2016/679 as applied by the Data Protection Act 2018) — Data-subject rights over personal data — access, rectification, erasure; DPA 2018 (Data Protection Act 2018) — The UK-wide data protection framework for personal data, enforced by the ICO Oversight: Scottish Information Commissioner (and the ICO for data protection) — The Scottish Information Commissioner enforces FOISA independently of the UK regime — investigating applications and issuing decision notices that are legally enforceable, with appeal to the Court of Session on a point of law. Personal data is regulated UK-wide by the Information Commissioner's Office (ICO). - FOI response deadline: 20 working days (FOISA section 10) - DSAR response deadline: One month, extendable by two further months for complex or numerous requests - FOI fees: No fee where projected costs are £100 or under; authorities may charge above £100 and need not comply above the £600 upper limit - Breach notification: To the ICO within 72 hours where feasible (Article 33 UK GDPR) - Impact assessments: DPIA required for high-risk processing (Article 35 UK GDPR) - Oversight: Scottish Information Commissioner (FOISA); ICO (data protection) - Languages: English, with Gaelic and other languages configurable Q: Is FOISA the same as the UK Freedom of Information Act? A: No. The Freedom of Information (Scotland) Act 2002 is a separate statute covering Scottish public authorities, enforced by the Scottish Information Commissioner, with its own exemptions and fee rules. AccessPoint ships the Scottish configuration — not the UK FOIA 2000 — while personal data is handled under the UK-wide UK GDPR and DPA 2018. Q: What is the FOISA response deadline? A: 20 working days (section 10). AccessPoint calculates it on the Scottish working-day calendar, tracks the fee position against the £100 lower and £600 upper cost limits, and applies the exemptions with the public-interest test. Q: How are the two regulators handled? A: FOISA applications go to the Scottish Information Commissioner, whose decision notices are enforceable and appealable to the Court of Session on a point of law; data-protection complaints go to the ICO. AccessPoint tracks each on its own clock with an investigation workspace and a guided disposition. Q: Where does Scottish data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud, no vendor access, and no offshore processing. ### Ireland (pack ie-foi-dp) URL: https://www.realizer.io/solutions/ireland-foi-dp — pack content last reviewed 2026-07-13 Legislation: FOI Act 2014 (Freedom of Information Act 2014 (No. 30 of 2014)) — Public access to records held by FOI bodies — a four-week response, overseen by the Information Commissioner; GDPR (Regulation (EU) 2016/679) — Data-subject rights over personal data — access, rectification, erasure — applicable since 25 May 2018; Data Protection Act 2018 (Data Protection Act 2018 (No. 7 of 2018)) — Ireland's implementation of the GDPR and the Law Enforcement Directive, enforced by the Data Protection Commission Oversight: Office of the Information Commissioner (OIC) and Data Protection Commission (DPC) — The Information Commissioner reviews FOI decisions after internal review, with binding decisions appealable to the High Court on a point of law. The Data Protection Commission is Ireland's GDPR supervisory authority, investigating complaints and enforcing data-subject rights and breach obligations. - FOI response deadline: Four weeks from receipt (section 13) - Extensions: Up to a further four weeks for a large number of records (section 14) - FOI fees: No application fee; search, retrieval and copying at €20/hour, with no charge below a €101 threshold and an overall cap; personal-records requests are generally exempt - Review fees: Internal review €30 (€10 reduced); review by the Information Commissioner €50 (€15 reduced) - Breach notification: To the DPC without undue delay, within 72 hours where feasible (Article 33) - Impact assessments: DPIA required for high-risk processing (Article 35) - Oversight: Office of the Information Commissioner; Data Protection Commission - Languages: English and Irish Q: What is the FOI response deadline in Ireland? A: Four weeks from receipt of a valid request, with an extension of up to a further four weeks where the request covers a large number of records or would require a large volume of searching (section 14). AccessPoint calculates both on the Irish working-day calendar and drives the decision to a defensible close. Q: How do FOI fees work? A: There is no application fee. Search, retrieval and copying is charged at €20 per hour, with no charge below a €101 threshold and an overall cap; requests for your own personal records are generally not subject to these fees. Internal review costs €30 (€10 reduced) and a review by the Information Commissioner €50 (€15 reduced). AccessPoint generates the estimates and notices. Q: Does it cover data protection as well as FOI? A: Yes. The same pack runs GDPR data subject access and rectification on the one-month clock, DPIAs under Article 35, and breach notification to the Data Protection Commission — the FOI and data-protection sides in one system, with one audit trail. Q: Where does Irish data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border transfer of your data. ### European Union — GDPR (pack eu-gdpr) URL: https://www.realizer.io/solutions/eu-gdpr — pack content last reviewed 2026-07-13 Legislation: GDPR (Regulation (EU) 2016/679 (General Data Protection Regulation)) — Rights of data subjects and obligations of controllers and processors handling personal data — applicable since 25 May 2018; EU AI Act (Regulation (EU) 2024/1689) — Risk-based rules for AI systems — in force since 1 August 2024, with prohibited-practice rules applying from 2 February 2025, general-purpose AI model rules from 2 August 2025, and most high-risk obligations from 2 December 2027 Oversight: Your national supervisory authority (data protection authority), coordinated by the European Data Protection Board — Each EU member state designates one or more independent supervisory authorities with the investigative and corrective powers of Article 58 — including administrative fines up to €20 million or 4% of total worldwide annual turnover under Article 83. The European Data Protection Board ensures the Regulation is applied consistently across the Union. - Response deadline: One month from receipt (Article 12(3)) - Extensions: Up to two further months for complex or numerous requests, with notice to the data subject within the first month - Fee: First copy free; a reasonable fee for further copies or manifestly unfounded or excessive requests (Articles 12(5), 15(3)) - Breach notification: To the supervisory authority without undue delay, within 72 hours where feasible (Article 33) - Impact assessments: DPIA required for processing likely to result in a high risk (Article 35) - Oversight: Your national supervisory authority (tenant-configured); European Data Protection Board coordination - Languages: Configurable to any EU official language Q: How does AccessPoint handle the GDPR one-month response deadline? A: Article 12(3) requires controllers to respond to a data-subject request without undue delay and in any event within one month of receipt, extendable by two further months for complex or numerous requests provided the data subject is told within the first month. AccessPoint calculates the clock, tracks the extension, and drives the access (Article 15) and rectification (Article 16) workflow to a defensible close with a full audit trail. Q: Can it run DPIAs and EU AI Act assessments? A: Yes. The assessment engine runs Article 35 DPIAs for high-risk processing and assesses AI systems against the risk tiers of the EU AI Act (Regulation (EU) 2024/1689) — the same screeners, embedded risk register, review, and audit trail, on one platform. Q: Which supervisory authority does it use? A: The GDPR is enforced by each member state's own independent supervisory authority, coordinated by the European Data Protection Board. AccessPoint is configured to your authority, and its complaint and breach workflows reflect that authority's process — set once per tenant. Q: Where does personal data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud, no vendor access, and no onward transfer of your data. ### European Union — Institutions (pack eu-institutions-foi) URL: https://www.realizer.io/solutions/eu-institutions-access — pack content last reviewed 2026-07-13 Legislation: Regulation 1049/2001 (Regulation (EC) No 1049/2001 of 30 May 2001) — Public access to European Parliament, Council and Commission documents — in force since 3 December 2001; Treaty and Charter basis (Article 15(3) TFEU; Article 42, Charter of Fundamental Rights) — The Treaty and Charter right of access to documents of Union institutions, bodies, offices and agencies Oversight: European Ombudsman and the Court of Justice of the European Union — After a confirmatory refusal, an applicant may complain to the European Ombudsman for maladministration or bring an action before the General Court of the Court of Justice of the EU. The Ombudsman investigates and issues findings and recommendations; the Court can annul a refusal. - Response deadline: 15 working days from registration of the application (Article 7) - Extensions: A further 15 working days in exceptional cases — very long or very numerous documents (Article 7(3)) - Confirmatory application: Within 15 working days of a refusal; the institution replies within 15 working days, extendable by 15 (Article 8) - Exceptions: The Article 4 exceptions, most subject to an overriding-public-interest test - Fee: On-site consultation and copies below a threshold are free; a charge only for larger copy volumes (Article 10) - Oversight: European Ombudsman and the General Court (CJEU) - Languages: Any EU official language; ships English and French Q: What deadline does Regulation 1049/2001 set? A: An institution must handle an initial application within 15 working days of registration, either granting access or stating the reasons for refusal; in exceptional cases — a very long document or a very large number of documents — the limit may be extended by a further 15 working days (Article 7). AccessPoint calculates both on the working-day calendar. Q: How does the confirmatory application work? A: If access is refused, the applicant has 15 working days to make a confirmatory application asking the institution to reconsider; the institution then has 15 working days, extendable by 15, to reply (Article 8). AccessPoint tracks the two stages as linked records, each on its own clock, so nothing falls between them. Q: Which exceptions can justify a refusal? A: Article 4 sets out the exceptions — public security, defence and military matters, international relations, financial, monetary or economic policy, personal privacy and integrity, commercial interests, court proceedings and legal advice, inspections and investigations, and internal decision-making — most of them weighed against an overriding public interest. AccessPoint ships the catalogue for tagging and redaction. Q: Where does document data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and decisions never leave your control — no third-party cloud, no vendor access, and no onward transfer of your data. ### European Union — Institutions (2018/1725) (pack eu-edps-1725) URL: https://www.realizer.io/solutions/eu-institutions-data-protection — pack content last reviewed 2026-08-10 Legislation: Regulation (EU) 2018/1725 (Regulation (EU) 2018/1725) — Data protection for Union institutions, bodies, offices, and agencies — the GDPR's counterpart for the EU's own administration; Data subject rights (Arts. 17–20) — Access, rectification, erasure, and restriction of processing, on the one-month clock with extension where justified; Restrictions (Art. 25) — Restrictions on data subject rights, available only where the institution has adopted internal rules providing for them Oversight: European Data Protection Supervisor (EDPS) — The EDPS supervises how EU institutions and bodies process personal data — receiving breach notifications, handling complaints from data subjects, conducting investigations and inspections, and issuing decisions and corrective measures. It is the institutions' own supervisory authority, playing the role a national DPA plays for member-state bodies. - Rights deadline: One month, extendable by two further months where justified by complexity or volume - Restrictions: Art. 25 — available only where internal rules provide for them - Breach: 72 hours to the EDPS; communication to data subjects where the risk is high - DPIA: Art. 39, before processing likely to result in a high risk - Oversight: European Data Protection Supervisor - Languages: English, French Q: How does 2018/1725 differ from the GDPR? A: It is the equivalent regime for the EU's own institutions, bodies, offices, and agencies rather than for controllers in the member states. The structure closely tracks the GDPR, but the supervisory authority is the EDPS, restrictions on rights operate through Article 25 internal rules rather than member-state law, and the surrounding obligations are framed for Union administration. Q: Can we run it alongside the institutions access regime? A: Yes, and most institutions should. AccessPoint ships a separate pack for public access to documents under Regulation 1049/2001, and the two run in one tenant on one audit ledger — which is what keeps decisions about the same document consistent across the two regimes. Q: How are Article 25 restrictions handled? A: Each restriction is linked to the internal rule the institution has adopted to provide for it, and the reason is recorded against the specific information restricted. Because Article 25 makes the internal rule a precondition, tying the two together in the record is what makes a restriction defensible before the EDPS. Q: Where does personal data reside? A: Entirely within the institution's own Microsoft 365 and Azure tenant, in the region you choose. Requests, records, assessments, and audit history never leave your control — no third-party cloud and no vendor access. ### European Union — AI Act (deployers) (pack eu-ai-act) URL: https://www.realizer.io/solutions/eu-ai-act — pack content last reviewed 2026-08-10 Legislation: EU Artificial Intelligence Act (Regulation (EU) 2024/1689) — The Union's risk-based AI regulation, with distinct obligations for providers and for deployers of AI systems; Fundamental rights impact assessment (Art. 27) — The assessment deployers that are public bodies or that provide public services must perform before putting a high-risk AI system into use; Deployer obligations (Arts. 26, 49, 50) — Use in accordance with instructions, human oversight, input data relevance, monitoring and incident reporting, registration, and transparency to affected persons Oversight: National market surveillance authorities, with the European AI Office — Enforcement runs through national market surveillance authorities designated by each member state, coordinated at Union level by the AI Office and the AI Board. For a public-sector deployer, the practical consequence is that the record behind each deployed system — what it does, who oversees it, and what was assessed before it went live — is what an authority asks to see. - Who this is for: Deployers — organizations using AI systems, not building them - FRIA: Art. 27 — required of public bodies and public-service providers before using a high-risk system - Core duties: Art. 26 — instructions for use, human oversight, input data, monitoring, logs, incident reporting - Registration: Art. 49 — public-authority deployers register their use of high-risk systems - Transparency: Art. 50 — informing affected persons where the Act requires it - Languages: English Q: Is this pack for AI providers or deployers? A: Deployers — organizations that use AI systems rather than develop and place them on the market. That is where most public-sector bodies sit, and it is the side of the Act least well served by generic compliance tooling. Provider-side conformity assessment and technical documentation are outside this pack's scope. Q: Who has to do a fundamental rights impact assessment? A: Article 27 requires it of deployers that are bodies governed by public law, and of private entities providing public services, before putting a high-risk AI system into use — with some further categories the Act specifies. AccessPoint ships the FRIA as an assessment type with the questions the Article actually asks, and records it as dated and signed off before deployment. Q: How does this relate to Canada's AIA or Ontario's Bill 194? A: They are separate regimes with overlapping subject matter, and AccessPoint ships each as its own assessment type on a shared AI systems register. An organization operating across jurisdictions assesses a system once per applicable regime, with each assessment carrying its own questionnaire and citing its own authority, rather than maintaining parallel spreadsheets. Q: Does this pack replace our GDPR obligations? A: No. It installs alongside the GDPR pack, or a national pack, rather than replacing it. A system can require both a DPIA under the GDPR and a FRIA under the AI Act, and the two ask different questions — AccessPoint runs both against the same register entry so the answers stay consistent. ### Austria — Informationsfreiheitsgesetz (pack at-ifg) URL: https://www.realizer.io/solutions/austria-ifg — pack content last reviewed 2026-08-10 Legislation: Informationsfreiheitsgesetz (IFG, in force 1 September 2025) — Austria's freedom of information law — a general right of access to information held by public bodies, replacing the former constitutional duty of official secrecy; Proactive publication (IFG, Informationsregister provisions) — The duty on covered bodies to publish information of general interest proactively in the Informationsregister; Refusal by formal decision (IFG, Bescheid provisions) — Where access is refused, the applicant may require a formal administrative decision, issued within two months and appealable Oversight: The Verwaltungsgerichte (administrative courts) — Austria did not create an information commissioner. Where access is refused, the applicant may demand a Bescheid — a formal, reasoned administrative decision — and challenge it before the competent Verwaltungsgericht, with further recourse to the higher courts. Review is therefore judicial from the outset, and it turns on the reasons the authority put in writing. - Response deadline: Four weeks, extendable by a further four weeks where justified - Refusal: A formal Bescheid on request, within two months - Review: Beschwerde to the Verwaltungsgericht - Proactive duty: Publication of information of general interest in the Informationsregister - Fees: Access to information is generally free of charge - Languages: English, Deutsch Q: When did Austria's IFG take effect? A: 1 September 2025. It replaced the former constitutional duty of official secrecy with a right of access to information and a proactive publication duty, making Austria one of the most recent European states to adopt a general freedom of information regime. Q: Is there an information commissioner to appeal to? A: No. Austria did not create one. Where access is refused, the applicant may require a formal administrative decision — a Bescheid — which must be issued within two months and can be challenged by Beschwerde before the competent Verwaltungsgericht. Review is judicial from the outset, which is why the written reasons matter so much. Q: Does the pack cover the Informationsregister? A: It covers the tracking side: what has been published proactively, when, by whom, and under which category, so the duty is managed and evidenced. Publication itself happens in the register; AccessPoint keeps the record of the obligation being met. Q: Is the platform available in German? A: Yes. AccessPoint's interface ships natively in German, and this pack carries German statutory wording, correspondence templates, and vocabulary, with English available alongside. ### Germany (pack de-ifg) URL: https://www.realizer.io/solutions/germany-ifg — pack content last reviewed 2026-07-24 Legislation: Freedom of Information Act (IFG) (Informationsfreiheitsgesetz of 5 September 2005) — A right of access to official information held by federal authorities — in force since 1 January 2006; Objection and judicial review (§ 9 IFG) — A refusal is challenged first by objection (Widerspruch) to the authority, then by an action to compel access (Verpflichtungsklage) before the administrative court (Verwaltungsgericht) Oversight: Federal Commissioner for Data Protection and Freedom of Information (BfDI) — The BfDI can be called upon by anyone who considers their right of access under the IFG has been infringed (§ 12). The Commissioner advises and mediates as an ombudsman — issuing recommendations rather than binding orders — while a refusal is ultimately decided by the administrative court. - Response standard: Access should be provided within one month (§ 7 IFG) - Advisory review: Call upon the BfDI, the Federal Commissioner, as an ombudsman — advisory, not binding (§ 12) - Exemptions: The §§ 3–6 protections — public interests, the decision-making process, personal data, and IP and trade secrets - Charges: Fees under the IFGGebV — from €15 up to a €500 cap, plus expenses; basic information is free (§ 10) - Oversight: Federal Commissioner for Data Protection and Freedom of Information (BfDI) - Languages: English and German Q: When must a German federal authority respond to an IFG request? A: Access should be made available within one month of the request (§ 7 IFG); where third parties must be consulted or the request is complex, the timeline can extend. AccessPoint computes the one-month point and reminds you before it lapses. Q: What makes the German regime distinctive? A: Two things. Oversight is advisory: anyone refused access can call upon the Federal Commissioner (BfDI), who mediates and recommends as an ombudsman under § 12 — a Widerspruch and the administrative court decide with binding force. And the IFG binds federal bodies only; each of the sixteen Länder runs its own information-freedom or transparency law. AccessPoint runs both. Q: What can a federal authority charge? A: Fees follow the Information Fees Ordinance (IFGGebV) — from €15 up to a €500 cap, plus expenses — while basic information is provided free (§ 10). AccessPoint computes the fee to the ordinance and issues the notice with the decision. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### France (pack fr-cada) URL: https://www.realizer.io/solutions/france-cada — pack content last reviewed 2026-07-24 Legislation: Access to administrative documents (CRPA) (Code des relations entre le public et l'administration, art. L300-1 et seq.) — The right of access to administrative documents held by public bodies — codifying the loi n° 78-753 of 17 July 1978; Prior referral to the CADA (CRPA art. L342-1 and R343-1 et seq.) — Before any appeal to the administrative court, the applicant must seek the advisory opinion of the Commission d'accès aux documents administratifs within two months of a refusal Oversight: Commission d'accès aux documents administratifs (CADA) — The CADA is an independent advisory authority. A referral to it is a mandatory step before the tribunal administratif: within two months of a refusal the applicant seizes the CADA, which issues an advisory opinion (avis) — not a binding order — generally within one month, and the administration then confirms or reconsiders. - Response standard: One month to respond; silence for one month is an implied refusal (refus tacite) - Mandatory CADA opinion: Seize the CADA within two months of a refusal; its advisory opinion follows within one month (art. L342-1) - Exemptions: The L311-5 non-communicable documents and the L311-6 documents released only to the interested party - Charges: Reproduction at cost — €0.18 per A4 black-and-white page; delivery by email is free (art. L311-9) - Oversight: Commission d'accès aux documents administratifs (CADA) - Languages: French, with English available Q: When must a French administration respond to a request? A: It has one month from receipt to communicate the document; if it stays silent for a month, that silence is an implied refusal (refus tacite) that opens the CADA route. AccessPoint computes the one-month deadline and flags the implied-refusal point. Q: What makes France different — the CADA opinion? A: Yes. A requester cannot take a refusal straight to court: they must first seize the Commission d'accès aux documents administratifs within two months, and the CADA issues an advisory opinion (avis) — generally within a month — before any appeal to the tribunal administratif. The opinion is not binding, but the referral is mandatory. AccessPoint manages the window, the referral, and the avis. Q: What can be charged? A: Access on site and delivery by email are free; for copies the administration may charge reproduction at cost under art. L311-9 — €0.18 per A4 black-and-white page, €2.75 per CD-ROM. AccessPoint computes the charge and itemises it for the requester. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Netherlands (pack nl-woo) URL: https://www.realizer.io/solutions/netherlands-woo — pack content last reviewed 2026-07-24 Legislation: Wet open overheid (Woo) (Wet open overheid, in force 1 May 2022) — The right of public access to government information — replacing the Wet openbaarheid van bestuur (Wob); Objection and appeal (bezwaar; beroep (Awb); hoger beroep to the Raad van State) — A refusal is challenged by objection (bezwaar), then appeal (beroep) to the administrative court, and higher appeal to the Administrative Jurisdiction Division of the Council of State Oversight: Adviescollege Openbaarheid en Informatiehuishouding (ACOI) — The ACOI is an independent advisory board on public access and information management. It advises government on implementing the Woo and can handle complaints from journalists and researchers, issuing advice rather than binding orders; a refusal is decided on appeal by the administrative court and, on higher appeal, the Council of State. - Response standard: As soon as possible, within four weeks; extendable by two weeks (art. 4.4) - Active disclosure: Seventeen categories must be published proactively (art. 3.1, 3.3) — not only on request - Exemptions: Absolute grounds (art. 5.1(1)) apply automatically; relative grounds (art. 5.1(2), 5.2) are weighed against the public interest - Charges: Handling a Woo request is free; at most the cost price of copies - Oversight: Adviescollege Openbaarheid en Informatiehuishouding (ACOI); appeals to the Council of State - Languages: Dutch, with English available Q: How long does a Dutch authority have to decide a Woo request? A: It must decide as soon as possible and in any event within four weeks of receipt, extendable by two weeks where the request is large or complex (art. 4.4). AccessPoint computes both the four-week point and the extension and reminds you before either lapses. Q: What makes the Woo distinctive? A: It obliges active disclosure — seventeen categories of information must be published on the government's own initiative, not only on request (art. 3.1, 3.3) — and it splits its exceptions into absolute grounds that apply automatically and relative grounds weighed against the public interest (art. 5.1, 5.2). AccessPoint runs the publication programme and both exception tests. Q: What can be charged? A: Handling a Woo request is free; at most the cost price of providing copies may be recovered. AccessPoint records any copy charge and itemises it for the requester. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Belgium — Publicité / Openbaarheid (pack be-openbaarheid) URL: https://www.realizer.io/solutions/belgium-openbaarheid — pack content last reviewed 2026-08-10 Legislation: Federal law of 11 April 1994 (Loi du 11 avril 1994 relative à la publicité de l'administration / Wet van 11 april 1994 betreffende de openbaarheid van bestuur) — Access to administrative documents held by federal authorities — 30 days to decide, extendable by 15; Flemish Bestuursdecreet (Bestuursdecreet van 7 december 2018) — The Flemish access regime for Flemish authorities and local government in the Flemish Region, with its own beroepsinstantie; Walloon and Brussels regimes (Regional access legislation) — The Walloon and Brussels access rules, each with its own commission de recours / CADA for review Oversight: The federal CADA and the regional review bodies — Belgium has no single information commissioner. The federal Commission d'accès aux documents administratifs reviews federal decisions, while the Flemish beroepsinstantie and the Walloon and Brussels commissions handle their own regimes — so which body reviews a refusal depends entirely on which authority received the request. - Federal deadline: 30 days to decide, extendable by 15 days - Regional deadlines: Per the Flemish, Walloon, or Brussels regime that applies - Review: The federal CADA or the competent regional beroepsinstantie / commission de recours - Scope: Administrative documents held by the authority - Fees: Access generally free; reproduction charges as the regime allows - Languages: English, Nederlands, Français Q: Which Belgian regime applies to my authority? A: It follows from the level of government you belong to. Federal authorities apply the law of 11 April 1994; Flemish authorities and local government in the Flemish Region apply the Bestuursdecreet of 7 December 2018; Walloon and Brussels bodies apply their own regional rules. The pack ships all four and is configured to the one that governs your tenant. Q: Does the platform work in Dutch and French? A: Yes — AccessPoint's interface ships natively in both, alongside nine other languages, and this pack carries statutory wording and correspondence templates in Dutch and French. A bilingual authority can run both without maintaining a parallel set of documents. Q: Where do appeals go? A: To the review body for the applicable regime — the federal Commission d'accès aux documents administratifs, the Flemish beroepsinstantie, or the Walloon or Brussels commission. AccessPoint tracks the review as a matter linked to the originating request, with the correct body, filing window, and outcome. Q: Where do documents reside? A: Entirely within your own Microsoft 365 and Azure tenant, in the region you choose. Requests, documents, redactions, and audit history never leave your control — no third-party cloud and no vendor access. ### Spain (pack es-transparencia) URL: https://www.realizer.io/solutions/spain-transparencia — pack content last reviewed 2026-07-24 Legislation: Ley 19/2013 de transparencia (Ley 19/2013, de 9 de diciembre (BOE-A-2013-12887)) — Access to public information held or produced by the public sector, subject to the Article 14 límites and the Article 15 data-protection weighting; Reclamación before the CTBG (Ley 19/2013, arts. 23–24) — An optional but binding claim to the Consejo de Transparencia y Buen Gobierno, substituting for an administrative appeal and prior to the contentious-administrative court Oversight: Consejo de Transparencia y Buen Gobierno (CTBG) — The CTBG is the independent oversight body created by Ley 19/2013. On a reclamación its resolution is binding on the public administration (de obligado cumplimiento) — it can order the information released — and either party may then take the matter only to the contentious-administrative court. - Response deadline: One month from receipt by the competent body; extendable by a further month for volume or complexity (art. 20) - Reclamación: Binding claim to the CTBG within one month; resolved within three months, silence being a dismissal (arts. 23–24) - Limits: The Article 14 límites, applied proportionately, and the Article 15 personal-data weighting - Charges: Access is free; a charge only for issuing copies or format conversion (art. 22.4) - Oversight: Consejo de Transparencia y Buen Gobierno; then the contentious-administrative court - Languages: Spanish (Castilian); ships Spanish and English Q: When must a Spanish body respond to an access request? A: The resolution granting or refusing access must be notified within one month of the request reaching the body competent to decide; where the volume or complexity of the information requires it, the period may be extended by a further month with prior notice to the applicant. If that period passes without an express, notified resolution, the request is understood to be refused (art. 20). AccessPoint computes both clocks and flags the silence point. Q: What makes Spain different — the CTBG reclamación? A: Yes. In place of an ordinary administrative appeal, a requester may bring a reclamación to the Consejo de Transparencia y Buen Gobierno within one month of the decision or the silence; the CTBG must resolve within three months, and its resolution is binding on the administration (arts. 23–24). Only the contentious-administrative court can then set it aside. AccessPoint tracks the filing window, assembles the file, and manages it to the binding resolution. Q: What can a body charge? A: Access to the information itself is free, and electronic delivery is preferred; a charge may apply only to issuing copies or converting the information to a different format, under the Tasas y Precios Públicos legislation or the applicable regional or local rules (art. 22.4). AccessPoint computes the charge and issues an estimate on request. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Portugal — LADA (pack pt-lada) URL: https://www.realizer.io/solutions/portugal-lada — pack content last reviewed 2026-08-10 Legislation: Lei de Acesso aos Documentos Administrativos (Lei n.º 26/2016, de 22 de agosto) — Portugal's right of access to administrative documents and to environmental information, built on the principle of administração aberta; Complaint to the CADA (Lei 26/2016, complaint provisions) — The applicant's complaint to the Comissão de Acesso aos Documentos Administrativos within 20 days of a refusal or of the deadline expiring; Judicial enforcement (Administrative court proceedings) — Intimação for access before the administrative courts where the body maintains its refusal Oversight: Comissão de Acesso aos Documentos Administrativos (CADA) — The CADA issues opinions on complaints about refusals and non-responses. Its opinions are not binding orders, but a body that declines to follow one must explain itself, and the applicant's route to the administrative courts runs straight through the record the body built. - Response deadline: 10 working days - Complaint window: 20 days to complain to the CADA after a refusal or the deadline lapsing - Principle: Administração aberta — access is the rule, restriction the exception - Fees: Access is free; reproduction charged at cost - Enforcement: CADA opinions, then intimação before the administrative courts - Languages: English, Português Q: How long does a Portuguese body have to respond? A: 10 working days. AccessPoint computes the deadline on receipt over Portugal's public-holiday calendar, assigns the request immediately, and ages it visibly — which matters because the deadline lapsing is itself a ground for complaint to the CADA, independently of any refusal. Q: Are CADA opinions binding? A: They are opinions rather than binding orders, but they carry real weight: a body that declines to follow one must justify that position, and the applicant may then seek intimação for access before the administrative courts. AccessPoint tracks the complaint, the opinion, and the body's subsequent decision as one linked sequence. Q: Is the platform available in Portuguese? A: Yes. AccessPoint's interface ships natively in Portuguese, alongside ten other languages, and this pack carries Portuguese statutory wording, correspondence templates, and vocabulary. Q: Where do documents reside? A: Entirely within your own Microsoft 365 and Azure tenant, in the region you choose. Requests, documents, redactions, and audit history never leave your control — no third-party cloud and no vendor access. ### Italy (pack it-foia) URL: https://www.realizer.io/solutions/italy-foia — pack content last reviewed 2026-07-24 Legislation: Accesso civico generalizzato (FOIA) (D.Lgs. 33/2013, art. 5, comma 2, as amended by D.Lgs. 97/2016) — A right for anyone to access data and documents held by the public administration, beyond those subject to mandatory publication, without stating a reason; Esclusioni e limiti all'accesso civico (D.Lgs. 33/2013, art. 5-bis) — The absolute limits and the relative public- and private-interest limits, the latter refused only to avoid a concrete harm (pregiudizio concreto) Oversight: ANAC (Autorità Nazionale Anticorruzione), with the Garante per la protezione dei dati personali — ANAC, in agreement with the Garante, issues the FOIA guidelines (linee guida) on the exclusions and limits. A refusal is reviewed internally by the RPCT within 20 days, and then by the regional administrative court (TAR); for regional and local bodies a Difensore civico route is also available. - Response deadline: Express, reasoned decision within 30 days of the request (art. 5, comma 6) - Controinteressati: 10-day notice to counter-interested parties suspends the clock (art. 5, comma 5) - Limits: The Article 5-bis absolute limits and the relative concrete-harm limits - Charges: Free; reimbursement only of the actual reproduction cost on physical media (art. 5, comma 4) - Oversight: ANAC guidelines with the Garante; riesame by the RPCT, then the TAR (art. 5, commi 7–8) - Languages: Italian; ships Italian and English Q: When must an Italian administration respond to a FOIA request? A: The procedure must conclude with an express, reasoned decision within 30 days of the request, communicated to the applicant and to any counter-interested parties (art. 5, comma 6). Where controinteressati are notified, the clock is suspended for up to 10 days while they may object (art. 5, comma 5). AccessPoint computes the 30-day deadline and the suspension on the working calendar. Q: What makes Italy different — generalised access and controinteressati? A: Accesso civico generalizzato gives anyone the right to any data or document the administration holds, beyond mandatory publication, without stating a reason. Before releasing, the administration must find any controinteressati and give them 10 days to oppose, suspending the clock; a refusal is reviewed by the RPCT within 20 days and then by the TAR (art. 5). AccessPoint runs the third-party notice, the riesame, and the court referral as linked records. Q: What can an administration charge? A: Access is free. The administration may recover only the actual, documented cost of reproducing the material on physical media — there is no charge for processing the request (art. 5, comma 4). AccessPoint computes any reproduction cost and issues it with the decision. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Poland — UDIP (pack pl-udip) URL: https://www.realizer.io/solutions/poland-udip — pack content last reviewed 2026-08-10 Legislation: Ustawa o dostępie do informacji publicznej (Ustawa z dnia 6 września 2001 r. (UDIP)) — Poland's right of access to public information held by public authorities and other obliged entities; Biuletyn Informacji Publicznej (UDIP, BIP provisions) — The duty to publish defined categories of public information in the Public Information Bulletin; Refusal by administrative decision (UDIP, refusal provisions) — Refusal issued as an administrative decision under the Code of Administrative Procedure, appealable and subject to judicial review Oversight: The administrative courts (wojewódzkie sądy administracyjne and the NSA) — Poland has no information commissioner. A refusal takes the form of an administrative decision, is challenged through the administrative procedure, and ends before the voivodeship administrative court with further recourse to the Supreme Administrative Court — so the reasons written into the decision are the whole of the authority's case. - Response deadline: Without undue delay, and no later than 14 days - Extension: Up to 2 months, with notice of the reason and the new date given within the original 14 days - Refusal: By administrative decision, with reasons - Proactive duty: Publication in the Biuletyn Informacji Publicznej - Review: Administrative procedure, then the administrative courts - Languages: English, Polski Q: What is the UDIP deadline? A: Information must be provided without undue delay and no later than 14 days. Where that is not possible, the authority may take up to two months — but must notify the applicant within the original 14 days of the reason for the delay and the date the information will be provided. AccessPoint tracks both dates and prompts the notice inside the window that makes the extension valid. Q: How is a refusal issued? A: As an administrative decision under the Code of Administrative Procedure, with reasons, rather than as an ordinary letter. That decision is what gets appealed and, ultimately, reviewed by the administrative courts. AccessPoint drafts it from the grounds already recorded against the withheld information so the decision matches the file behind it. Q: Is there an information commissioner? A: No. Poland routes disputes through the administrative procedure and then to the voivodeship administrative courts, with further recourse to the Supreme Administrative Court. Because review is judicial from the outset, the quality of the written reasons carries the whole weight of the authority's position. Q: Is the platform available in Polish? A: Yes. AccessPoint's interface ships natively in Polish, alongside ten other languages, and this pack carries Polish statutory wording, correspondence templates, and vocabulary. ### Sweden (pack se-foi) URL: https://www.realizer.io/solutions/sweden-foi — pack content last reviewed 2026-07-24 Legislation: Freedom of the Press Act (Tryckfrihetsförordningen (SFS 1949:105), ch. 2) — The constitutional principle of public access to official documents (offentlighetsprincipen) — in force since 1766, the world's oldest; a document is released immediately or as soon as possible, with no name and no reason required; Public Access to Information and Secrecy Act (Offentlighets- och sekretesslag (2009:400) (OSL)) — Supplements the Freedom of the Press Act — the grounds on which an official document may be kept secret, each applied only where the assumed harm from disclosure meets the statutory threshold; a refusal is appealed to the administrative court of appeal (kammarrätt) Oversight: The administrative courts, with the Parliamentary Ombudsman (JO) and Chancellor of Justice (JK) — There is no single access regulator. A refusal to release an official document is appealed to the administrative court of appeal (kammarrätt), and onward to the Supreme Administrative Court; the Parliamentary Ombudsman (JO) and the Chancellor of Justice (JK) supervise whether authorities honour the constitutional right of access. - Response standard: Immediately or as soon as possible — an official document is released on request without undue delay (Freedom of the Press Act, ch. 2) - Anonymous requests: No name, no reason — a requester may stay anonymous and need not explain why (ch. 2) - Secrecy framework: The secrecy grounds in the OSL (2009:400), each applied under a harm test - Charges: On-site inspection is free; copies of official documents may carry a statutory fee under the fees ordinance - Oversight: Administrative courts (kammarrätt), with the Parliamentary Ombudsman (JO) and Chancellor of Justice - Languages: Swedish and English Q: How quickly must a Swedish authority respond to a request? A: An official document must be made available immediately or as soon as possible on request; there is no fixed number of days, but any delay must be justified by the work of retrieving and reviewing the document. AccessPoint tracks each request against that promptness standard and flags any that stalls. Q: What makes Sweden different — the constitutional right of access? A: Yes. Access is a constitutional right under the Freedom of the Press Act, in force since 1766: every official document is public by default, requesters may stay anonymous and need give no reason, and a document may be withheld only on a ground in the OSL (2009:400) where the assumed harm can be shown. AccessPoint runs each request to that standard. Q: What can an authority charge? A: Inspecting an official document on site is free. For copies, an authority may charge a fee set by the fees ordinance. AccessPoint computes the charge and issues the estimate before copies are produced. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Finland (pack fi-foi) URL: https://www.realizer.io/solutions/finland-foi — pack content last reviewed 2026-07-24 Legislation: Act on the Openness of Government Activities (Julkisuuslaki (621/1999)) — Openness by default — official documents are in the public domain unless secrecy is specifically provided by law; anyone may obtain information without giving a reason, without delay and at the latest within two weeks (one month for large or complex cases, § 14); Secrecy grounds and appeals (Julkisuuslaki §§ 22–24, 33) — Section 24 sets out the categories of secret official documents; a refusal is appealed to the regional administrative court (hallinto-oikeus) and onward to the Supreme Administrative Court Oversight: The administrative courts, with the Parliamentary Ombudsman and Chancellor of Justice — A refusal to release a document is appealed to the regional administrative court (hallinto-oikeus), with onward appeal to the Supreme Administrative Court; certain top-level bodies' decisions go straight to the Supreme Administrative Court. The Parliamentary Ombudsman and the Chancellor of Justice supervise whether authorities uphold the openness principle. - Response standard: Without delay, and at the latest within two weeks; one month for large or complex requests (§ 14) - Access principle: Openness by default — official documents are public unless secrecy is specifically provided by law - Secrecy framework: The secrecy grounds listed in § 24 of the Openness Act, applied where the law provides - Charges: Oral information and on-site inspection are free; copies may carry a statutory fee - Oversight: Administrative courts and the Supreme Administrative Court; Parliamentary Ombudsman and Chancellor of Justice - Languages: Finnish and English Q: How quickly must a Finnish authority respond to a request? A: Information from a public document must be given without delay, and at the latest within two weeks of the request. Where the documents are numerous, contain secret parts, or otherwise require exceptional work, the limit is one month (§ 14). AccessPoint computes both deadlines and reminds you before they fall. Q: What makes Finland different — openness by default? A: Yes. Under the Act on the Openness of Government Activities, official documents are in the public domain unless secrecy is specifically provided by law, and a requester need give no reason. Secrecy must be grounded — most often in the Section 24 catalogue — and refusals are appealed to the administrative court. AccessPoint treats disclosure as the default and records the basis for anything withheld. Q: What can an authority charge? A: Oral information, and inspecting a document on site, are free. For copies it produces, the authority may charge a fee set under the state fee criteria. AccessPoint computes the charge and issues the estimate before copies are produced. Q: Where does data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Denmark — Offentlighedsloven (pack dk-offentlighed) URL: https://www.realizer.io/solutions/denmark-offentlighed — pack content last reviewed 2026-08-10 Legislation: Offentlighedsloven (Lov om offentlighed i forvaltningen) — Denmark's Access to Public Administration Files Act — the right of access to documents held by the public administration; Exceptions (Offentlighedsloven §§ 19–35) — The catalogue of documents and information excepted from access, applied to specific material rather than whole cases; Complaint route (Klage provisions) — Complaint to the authority, then to the supervisory authority, with recourse to the Parliamentary Ombudsman Oversight: The supervisory authority, with the Folketingets Ombudsmand — Denmark routes access complaints upward through the administrative hierarchy and, ultimately, to the Parliamentary Ombudsman. The Ombudsman's statements are not binding orders, but they are published, widely read, and rarely ignored — which gives an authority's written reasoning an audience beyond the applicant. - Handling time: Seven working days as the expectation, with notice where more time is required - Exceptions: The §§ 19–35 catalogue, applied to specific documents and information - Complaint: To the authority, then the supervisory authority, then the Ombudsman - Fees: Access generally free; copying charges as the rules permit - Oversight: Folketingets Ombudsmand — published statements - Languages: English, Dansk Q: How quickly must a Danish authority deal with a request? A: The expectation is seven working days, and where a request cannot be dealt with in that time the applicant should be told why and when an answer can be expected. AccessPoint computes the date over the Danish holiday calendar and prompts that notice rather than letting a request go quiet. Q: What is meroffentlighed and does the pack handle it? A: It is the principle that an authority should consider granting access beyond what the Act strictly requires, where nothing prevents it. AccessPoint records that the consideration was made and its outcome on each partially refused request, so the question is visibly asked rather than silently skipped. Q: Are Ombudsman statements binding? A: They are not binding orders, but they are published and carry considerable weight, and authorities generally follow them. AccessPoint tracks a complaint through each stage — the authority, the supervisory authority, and the Ombudsman — with the correspondence and outcome kept against the originating request. Q: Is the platform available in Danish? A: Yes. AccessPoint's interface ships natively in Danish, alongside ten other languages, and this pack carries Danish statutory wording, correspondence templates, and vocabulary. ### Norway — Offentleglova (pack no-offentleglova) URL: https://www.realizer.io/solutions/norway-offentleglova — pack content last reviewed 2026-08-10 Legislation: Offentleglova (Lov om rett til innsyn i dokument i offentleg verksemd) — Norway's right of access to documents held by public bodies, built on a presumption of openness; Exceptions (Offentleglova §§ 13–26) — The grounds on which access may be refused, most requiring an assessment rather than operating automatically; Complaint (Klage provisions) — Complaint to the superior administrative body, with recourse to the Parliamentary Ombud (Sivilombudet) Oversight: The superior administrative body, with Sivilombudet — A refusal is complained about to the body immediately superior to the one that decided, and from there to Sivilombudet — the Parliamentary Ombud — whose statements are published and generally followed. Norway's deemed-refusal rule means a body that simply does not answer has, in effect, decided; the complaint proceeds without it. - Handling: Without undue delay — as a rule, within one to three working days - Deemed refusal: No answer within five working days is treated as a refusal that may be complained about - Exceptions: The §§ 13–26 grounds, most requiring an assessment - Meirinnsyn: A duty to consider granting access beyond the minimum required - Complaint: To the superior body, then Sivilombudet - Languages: English, Norsk bokmål Q: What does "without undue delay" mean in practice? A: Norwegian practice expects most requests to be answered within one to three working days, and the Act attaches a consequence to prolonged silence: once the statutory point passes with no answer, the request is treated as refused and may be complained about on that basis. AccessPoint ages requests from receipt and escalates before that threshold. Q: What is meirinnsyn? A: The duty to consider whether to grant access beyond what the Act strictly requires, even where an exception would permit refusal. It is a genuine obligation rather than a courtesy, and Sivilombudet has criticised bodies for skipping it. AccessPoint records the consideration and its outcome on each partially refused request. Q: Where do complaints go? A: To the administrative body immediately superior to the one that made the decision, and from there to Sivilombudet, the Parliamentary Ombud, whose statements are published and generally followed. AccessPoint tracks each stage with its filing date, correspondence, and outcome against the originating request. Q: Where do documents reside? A: Entirely within your own Microsoft 365 and Azure tenant, in the region you choose. Requests, documents, redactions, and audit history never leave your control — no third-party cloud and no vendor access. ### Switzerland (pack ch-transparency-dp) URL: https://www.realizer.io/solutions/switzerland-transparency-dp — pack content last reviewed 2026-07-13 Legislation: Transparency Act (FoIA) (Federal Act on Freedom of Information in the Administration, SR 152.3) — A presumption of access to official documents of the Federal Administration — in force since 1 July 2006; revised FADP (nFADP) (Federal Act on Data Protection, SR 235.1) — The revised Swiss data protection law — right of access, DPIA, and breach notification — in force since 1 September 2023 Oversight: Federal Data Protection and Information Commissioner (FDPIC) — The FDPIC oversees both regimes. Under the Transparency Act it conducts free mediation when access is refused and issues a written recommendation; the authority then rules, with appeal to the Federal Administrative Court. Under the nFADP it supervises data protection, receives breach notifications, and can investigate and order corrective measures. - Response deadline: 20 days for the authority's position, extendable by 20 for complex or voluminous requests (FoIA Article 12) - Mediation: Request to the FDPIC within 20 days of a refusal; a written recommendation follows within 30 days - Access fees: Generally free; small requests are waived, with a capped fee only where a request requires significant effort - Breach notification: To the FDPIC as soon as possible (nFADP Article 24) — no fixed 72-hour rule - Impact assessments: Data protection impact assessment required for high-risk processing (nFADP Article 22) - Oversight: Federal Data Protection and Information Commissioner (FDPIC) - Languages: German, French and Italian Q: What deadline does the Swiss Transparency Act set? A: The authority must state its position within 20 days of receiving an access request, extendable by a further 20 days for complex or voluminous requests (Article 12). If access is refused, the applicant can request free mediation from the FDPIC within 20 days. AccessPoint calculates the clocks and tracks the mediation through to the authority's ruling. Q: How does the nFADP differ from the GDPR on breaches? A: The revised FADP requires notifying the FDPIC of a data security breach 'as soon as possible' (Article 24) rather than within a fixed 72 hours as under the GDPR. AccessPoint's breach calculator applies the Swiss standard and produces the FDPIC notification, with a full audit trail. Q: Is the platform multilingual? A: Yes. AccessPoint ships in German, French and Italian — Switzerland's federal languages — so every interface element, notice, letter, and template can be presented in any of the three. Q: Where does Swiss data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border transfer of your data. ### Australia — Federal (pack au-federal-foi) URL: https://www.realizer.io/solutions/australia-federal-foi — pack content last reviewed 2026-07-13 Legislation: FOI Act (Freedom of Information Act 1982 (Cth)) — A legally enforceable right of access to documents of Australian Government agencies and departments, and to ministers' official documents; Privacy Act (Privacy Act 1988 (Cth)) — The Australian Privacy Principles, personal-information access (APP 12) and correction (APP 13), and the Notifiable Data Breaches scheme; Privacy and Other Legislation Amendment Act 2024 (Commonwealth of Australia, assented 10 December 2024) — The first tranche of privacy reform — a statutory tort for serious invasions of privacy (in force June 2025), tiered civil penalties, and automated-decision transparency from December 2026 Oversight: Office of the Australian Information Commissioner (OAIC) — The independent regulator for both freedom of information and privacy — conducts Information Commissioner review of FOI decisions, investigates complaints, makes determinations, and brings civil penalty proceedings. Restored to a three-commissioner model in 2024, with separate Australian Information, Privacy, and FOI Commissioners. - Response deadline: 30 days to decide an FOI request (s 15) - Extensions: By agreement (s 15AA), for complex requests with OAIC approval (s 15AB), or an automatic 30 days for third-party consultation (s 15(6)) - Fees: No application fee; your own personal information is free; processing charges otherwise, with the first 5 hours of decision-making free - Data breaches: Notifiable Data Breaches scheme — assess a suspected breach within 30 days, then notify the OAIC and affected individuals - Oversight: Office of the Australian Information Commissioner — IC review, determinations, and civil penalties - Languages: English Q: Does AccessPoint cover both the FOI Act and the Privacy Act? A: Yes. The Australian federal configuration ships both regimes in one pack — FOI Act 1982 access requests and Privacy Act 1988 obligations — with the 30-day FOI clock, the section 15AA, 15AB, and 15(6) extensions, the exemption catalogue, APP 12 access and APP 13 correction, and the Information Commissioner reflected in the review workflows. Q: Does it run the Notifiable Data Breaches scheme? A: Yes. Log a suspected eligible data breach and AccessPoint runs the assessment on the scheme's 30-day clock, then produces a live checklist of what is required — a statement to the OAIC and notification to affected individuals as soon as practicable — with a full audit trail. Q: How does it handle Information Commissioner review? A: AccessPoint's complaints and appeals module tracks internal review and IC review by the Office of the Australian Information Commissioner, each with its own statutory clock, an investigation workspace, and a guided path from representations to closure — including onward review by the Administrative Review Tribunal, which replaced the AAT in October 2024. Q: Where does Australian data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Australia — Privacy (APPs) (pack au-privacy) URL: https://www.realizer.io/solutions/australia-privacy — pack content last reviewed 2026-07-13 Legislation: Privacy Act (Privacy Act 1988 (Cth)) — Binds APP entities — organisations, generally those with annual turnover above $3 million, plus health providers and others — handling personal information; Australian Privacy Principles (Schedule 1, Privacy Act 1988 (Cth)) — The 13 APPs governing collection, use, disclosure, access (APP 12), correction (APP 13), and security of personal information; Privacy and Other Legislation Amendment Act 2024 (Commonwealth of Australia, assented 10 December 2024) — A statutory tort for serious invasions of privacy (in force June 2025), tiered OAIC civil penalties, and automated-decision transparency from December 2026 Oversight: Office of the Australian Information Commissioner (OAIC) — The independent privacy regulator — investigates complaints and data breaches, makes determinations, accepts enforceable undertakings, and brings civil penalty proceedings, now on a tiered scale that for serious interferences reaches up to $50 million. - Access requests: APP 12 — give access within a reasonable period - Correction: APP 13 — correct on request, at no charge - Charges: No charge to make a request; any access charge must not be excessive - Data breaches: Notifiable Data Breaches — assess within 30 days; notify the OAIC and affected individuals - Oversight: Office of the Australian Information Commissioner — determinations and civil penalties - Languages: English Q: Who does the Privacy Act 1988 apply to? A: It binds 'APP entities' — Australian Government agencies and private-sector organisations. Most businesses with annual turnover above $3 million are covered, along with health-service providers, credit reporting bodies, and others regardless of size. AccessPoint's Australian privacy pack is configured for private-sector organisations meeting the Australian Privacy Principles. Q: Does it run the Notifiable Data Breaches scheme? A: Yes. Log a suspected eligible data breach and AccessPoint runs the assessment on the scheme's 30-day clock against the likely-serious-harm test, then produces a live checklist of what is required — a statement to the OAIC and notification to affected individuals as soon as practicable — with a full audit trail. Q: Can it handle Privacy Impact Assessments? A: Yes. AccessPoint's assessment engine runs PIAs end to end — preliminary screeners, a typed questionnaire, section delegation to subject-matter experts, an embedded risk register, review, and a regulator-ready summary export — and the same engine assesses automated decision-making systems as the 2024 reforms phase in. Q: Where does our data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, assessments, incidents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### Australia — New South Wales (pack au-nsw) URL: https://www.realizer.io/solutions/australia-new-south-wales — pack content last reviewed 2026-08-10 Legislation: Government Information (Public Access) Act 2009 (GIPA Act 2009 (NSW)) — The NSW right to government information, built on a presumption in favour of disclosure rebutted only by an overriding public interest against it; Privacy and Personal Information Protection Act 1998 (PPIP Act 1998 (NSW)) — NSW public-sector privacy — the information protection principles, and the Part 6A mandatory notification of data breaches scheme; Health Records and Information Privacy Act 2002 (HRIP Act 2002 (NSW)) — Health privacy principles applying to health information held by NSW public sector agencies and private sector organisations Oversight: Information and Privacy Commission NSW (IPC) — The IPC houses both the Information Commissioner and the Privacy Commissioner, so GIPA reviews and privacy complaints reach the same body. External review of a GIPA decision may go to the Information Commissioner or directly to NCAT, and the review examines the agency's recorded public interest reasoning. - Decision deadline: 20 working days, extendable in the circumstances the GIPA Act allows - Application fee: $30 for a formal access application, with processing charges beyond the included hours - Test: The public interest test — a presumption of disclosure rebutted by overriding considerations against - Privacy: PPIP and HRIP, including the Part 6A mandatory data breach scheme - Review: Internal review, IPC review, or NCAT - Languages: English Q: How is GIPA different from other Australian access laws? A: It has no conventional exemption schedule. NSW built the Act around a presumption in favour of disclosure that can only be displaced where the public interest considerations against release outweigh those in favour, assessed for the specific information. That makes the recorded reasoning the substance of the decision rather than a formality attached to it. Q: Does the pack cover the Part 6A data breach scheme? A: Yes. The mandatory notification of data breaches scheme applies to NSW public sector agencies under the PPIP Act. AccessPoint runs the eligible-data-breach assessment, the notifications to the Privacy Commissioner and affected individuals, and the public notification register the scheme requires. Q: Can we track informal releases as well as formal applications? A: Yes, and NSW agencies should. GIPA expects information to be released informally where it can be, and an agency that only records formal applications systematically understates what it discloses. AccessPoint logs both, so reporting reflects the agency's actual openness. Q: Where does the information reside? A: Entirely within your own Microsoft 365 and Azure tenant, in the Australian region you choose. Applications, records, redactions, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Australia — Victoria (pack au-vic) URL: https://www.realizer.io/solutions/australia-victoria — pack content last reviewed 2026-08-10 Legislation: Freedom of Information Act 1982 (FOI Act 1982 (Vic)) — The Victorian right of access to documents held by agencies and ministers, with a 30-day decision period; Privacy and Data Protection Act 2014 (PDP Act 2014 (Vic)) — Victorian public sector privacy — the Information Privacy Principles and the Victorian Protective Data Security Framework; Health Records Act 2001 (Health Records Act 2001 (Vic)) — Health privacy principles governing health information held in the Victorian public and private sectors Oversight: Office of the Victorian Information Commissioner (OVIC) — OVIC combines freedom of information, privacy, and data security oversight in one office, and reviews FOI decisions with the power to make binding decisions. It also issues professional standards binding on agency FOI officers — an unusual feature that makes process compliance, not just outcomes, directly enforceable. - Decision deadline: 30 days, extendable where the Act permits - Application fee: The statutory application fee, with access charges beyond it - Review: OVIC review, then VCAT - Professional standards: OVIC standards binding on agency FOI practice - Privacy: PDP Act IPPs and the Health Records Act health privacy principles - Languages: English Q: What is the Victorian FOI deadline? A: 30 days from receipt of a valid request, with extensions available where the Act permits, including by agreement with the applicant. AccessPoint computes the date over the Victorian public-holiday calendar and records any extension with its ground and the notice given. Q: How does the pack support OVIC's professional standards? A: By making the steps the standards govern into tracked workflow stages — acknowledgement, applicant contact, third-party consultation, decision-making, and notification — each with its own date and record. That converts process compliance from something an agency asserts into something it can show. Q: Does it handle privacy and health records as well as FOI? A: Yes. The pack covers the PDP Act information privacy principles and the Health Records Act 2001 health privacy principles alongside FOI, which suits Victorian agencies where the same small team carries all three responsibilities and OVIC oversees them together. Q: Where do documents reside? A: Entirely within your own Microsoft 365 and Azure tenant, in the Australian region you choose. Requests, documents, redactions, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Australia — Queensland (pack au-qld) URL: https://www.realizer.io/solutions/australia-queensland — pack content last reviewed 2026-08-10 Legislation: Right to Information Act 2009 (RTI Act 2009 (Qld)) — The Queensland right to government information, built on a push model in which formal application is the last resort; Information Privacy Act 2009 (IP Act 2009 (Qld)) — Queensland public sector privacy under the Queensland Privacy Principles, and access to and amendment of one's own personal information; Mandatory notification of data breaches (IP Act 2009, Chapter 3A) — The mandatory data breach notification scheme, extending to local government from 1 July 2026 Oversight: Office of the Information Commissioner Queensland (OIC) — The OIC conducts external review of RTI and IP Act decisions and can make binding decisions. It also oversees the privacy regime, monitors agency compliance, and administers aspects of the mandatory data breach scheme — so access and privacy both answer to the same office. - Decision deadline: 25 business days, extendable where the Act allows - Model: Push model — administrative access first, formal application as a last resort - Application fee: The statutory RTI application fee; personal-information applications under the IP Act are free - Breach scheme: Chapter 3A, reaching local government from 1 July 2026 - Review: Internal review, OIC external review, then QCAT - Languages: English Q: What is the Queensland RTI deadline? A: 25 business days from receipt of a compliant application, with extensions available where the Act allows, including by agreement with the applicant and for third-party consultation. AccessPoint computes the processing period over the Queensland public-holiday calendar and records extensions with their ground. Q: When does the data breach scheme apply to councils? A: Chapter 3A of the IP Act extends the mandatory notification of data breaches scheme to Queensland local government from 1 July 2026. AccessPoint ships the eligible-breach assessment, the notifications to the Information Commissioner and affected individuals, and the register the scheme requires. Q: How do RTI and IP Act applications differ? A: An application for access to your own personal information is made under the IP Act and is free; other applications for government information are made under the RTI Act and attract the statutory application fee. The scope and vocabulary differ too, so AccessPoint runs them as distinct request types rather than one generic queue. Q: Where do documents reside? A: Entirely within your own Microsoft 365 and Azure tenant, in the Australian region you choose. Applications, documents, redactions, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Australia — Western Australia (pack au-wa) URL: https://www.realizer.io/solutions/australia-western-australia — pack content last reviewed 2026-08-10 Legislation: Freedom of Information Act 1992 (FOI Act 1992 (WA)) — The Western Australian right of access to documents held by agencies, with a 45-day permitted period; Privacy and Responsible Information Sharing Act 2024 (PRIS Act 2024 (WA)) — Western Australia's first comprehensive public sector privacy regime, phasing in from 2026; Notifiable information breaches (PRIS Act 2024, breach provisions) — The notifiable information breach scheme, commencing 1 January 2027 Oversight: Information Commissioner of Western Australia, and the Privacy and Information Commissioner — The Information Commissioner conducts external review of FOI decisions. The PRIS Act establishes privacy oversight for the WA public sector for the first time, so agencies that have only ever answered for access decisions will shortly answer for privacy practice as well. - FOI deadline: 45 days as the permitted period, extendable by agreement - FOI review: Internal review, then the Information Commissioner - IPPs: Information Privacy Principles commencing 1 July 2026 - Breach scheme: Notifiable information breaches from 1 January 2027 - Application fee: The statutory fee for non-personal applications; personal applications free - Languages: English Q: What is the WA FOI deadline? A: 45 days is the permitted period for dealing with an access application, extendable by agreement with the applicant. AccessPoint computes it over the Western Australian public-holiday calendar and tracks third-party consultation inside the period, with any agreed extension recorded. Q: When does WA privacy law commence? A: The Privacy and Responsible Information Sharing Act 2024 phases in — the Information Privacy Principles commence 1 July 2026, and the notifiable information breach scheme commences 1 January 2027. The pack ships the framework now so agencies can populate registers and stand up assessments before the obligations bite. Q: Can we use the privacy features before commencement? A: Yes, and that is the point of shipping them early. A personal information register, privacy assessments for new collections, and a complaints process are all useful practice before they are legal duties — and an agency that arrives at 1 July 2026 with a populated register is in a materially better position than one starting that day. Q: Where do documents reside? A: Entirely within your own Microsoft 365 and Azure tenant, in the Australian region you choose. Applications, documents, redactions, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Australia — South Australia (pack au-sa) URL: https://www.realizer.io/solutions/australia-south-australia — pack content last reviewed 2026-08-10 Legislation: Freedom of Information Act 1991 (FOI Act 1991 (SA)) — The South Australian right of access to documents held by agencies, with a 30-day period to determine an application; Exempt documents (FOI Act 1991, Schedule 1) — The exemption clauses, most subject to a public interest test, cited on each determination; Information Privacy Principles (SA Cabinet Administrative Instruction (IPPS)) — South Australia governs public sector privacy by administrative instruction rather than by statute Oversight: Ombudsman SA — External review of a South Australian FOI determination is conducted by the Ombudsman, who may confirm, vary, or reverse the agency's determination. South Australia does not have a dedicated information commissioner, so the Ombudsman's office carries both the review function and much of the guidance role. - Determination deadline: 30 days, extendable where the Act permits - Application fee: The statutory fee, with processing charges beyond it; concessions available - Exemptions: Schedule 1 clauses, most subject to a public interest test - Review: Internal review, then external review by Ombudsman SA - Privacy: Information Privacy Principles by administrative instruction, not statute - Languages: English Q: What is the South Australian FOI deadline? A: 30 days to determine an application, extendable where the Act permits. AccessPoint computes the date over the South Australian public-holiday calendar and records extensions with the notice given to the applicant. Q: Does South Australia have privacy legislation? A: Not a comprehensive public sector privacy statute. South Australia governs public sector privacy through the Information Privacy Principles issued as a Cabinet administrative instruction. The pack supports handling personal information and complaints under that framework, so practice is documented even though the source is administrative rather than statutory. Q: Who reviews an FOI determination? A: After internal review, external review is conducted by Ombudsman SA, which may confirm, vary, or reverse the determination. South Australia has no separate information commissioner. AccessPoint tracks both review stages against the originating application. Q: Where do documents reside? A: Entirely within your own Microsoft 365 and Azure tenant, in the Australian region you choose. Applications, documents, redactions, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Australia — Tasmania (pack au-tas) URL: https://www.realizer.io/solutions/australia-tasmania — pack content last reviewed 2026-08-10 Legislation: Right to Information Act 2009 (RTI Act 2009 (Tas)) — The Tasmanian right to information, with required, routine, active, and assessed disclosure as its four routes; Exempt information (RTI Act 2009, Part 3) — The exemptions, most subject to a public interest test, cited on each decision; Personal Information Protection Act 2004 (PIP Act 2004 (Tas)) — Tasmania's personal information protection principles governing public sector custodians Oversight: Tasmanian Ombudsman — The Ombudsman conducts external review of RTI decisions and may make binding decisions, and also has functions under the PIP Act. Tasmania has no separate information commissioner, so access and privacy oversight both sit with the Ombudsman's office. - Decision deadline: 20 working days, extendable where the Act allows - Disclosure routes: Required, routine, active, and assessed disclosure - Application fee: The statutory fee for assessed disclosure; personal information applications free - Exemptions: Part 3, most subject to a public interest test - Review: Internal review, then Ombudsman external review - Languages: English Q: What is the Tasmanian RTI deadline? A: 20 working days from receipt of a valid application for assessed disclosure, extendable where the Act allows, including for third-party consultation and by agreement. AccessPoint computes the date over the Tasmanian public-holiday calendar and records extensions with their ground. Q: What are the four disclosure routes? A: Required disclosure, routine disclosure, active disclosure, and assessed disclosure. The Act intends information to reach the public through the first three wherever possible, with a formal assessed-disclosure application as the last resort. AccessPoint logs releases under each route so the faster paths are visible and measurable. Q: Who reviews an RTI decision? A: After internal review, external review is conducted by the Tasmanian Ombudsman, who may make a binding decision. The Ombudsman also has functions under the PIP Act, so access and privacy oversight sit in the same office. AccessPoint tracks both review stages against the originating application. Q: Where does the information reside? A: Entirely within your own Microsoft 365 and Azure tenant, in the Australian region you choose. Applications, documents, redactions, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Australia — ACT (pack au-act) URL: https://www.realizer.io/solutions/australia-act — pack content last reviewed 2026-09-07 Legislation: Freedom of Information Act 2016 (FOI Act 2016 (ACT)) — The ACT's push-model access law — proactive open access publication, with access applications decided in 30 working days (s. 40(1), as amended in 2023), no application fee, and Part 10 processing charges only where a charge is determined; Information Privacy Act 2014 (Information Privacy Act 2014 (ACT)) — The Territory Privacy Principles governing ACT public sector agencies; Health Records (Privacy and Access) Act 1997 (Health Records (Privacy and Access) Act 1997 (ACT)) — Access to and privacy of health records in the ACT, including a consumer's right to their own record Oversight: ACT Ombudsman, with the ACT Civil and Administrative Tribunal — The ACT Ombudsman conducts Ombudsman review of access decisions and may make binding decisions, with further appeal to ACAT. Privacy complaints under the Information Privacy Act are handled under arrangements with the Australian Information Commissioner. - Decision deadline: 30 working days under s. 40(1) (as amended in 2023), plus 15 working days where a third party is consulted; extendable by agreement - Fees: No application fee and no processing charges - Model: Push model — an open access information scheme with proactive publication - Test: A public interest test with a presumption in favour of disclosure - Review: Ombudsman review, then ACAT - Languages: English Q: Does the ACT really charge nothing for FOI? A: The FOI Act 2016 operates without an application fee or processing charges, which is unusual among Australian jurisdictions. It removes cost as a barrier for applicants and, from the agency side, removes charging as a way of managing scope — so timeliness rests entirely on how well the process runs. Q: What is the open access information scheme? A: The push-model element of the ACT Act: agencies are expected to publish defined categories of government information proactively, so that far less needs to be applied for. AccessPoint tracks what has been published, when, and under which category, so the obligation is managed as a register rather than an intention. Q: Who reviews an ACT access decision? A: The ACT Ombudsman conducts Ombudsman review and may make a binding decision, with further appeal available to the ACT Civil and Administrative Tribunal. AccessPoint tracks each stage with its filing window, correspondence, and outcome against the originating application. Q: Where does the information reside? A: Entirely within your own Microsoft 365 and Azure tenant, in the Australian region you choose. Applications, documents, redactions, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Australia — Northern Territory (pack au-nt) URL: https://www.realizer.io/solutions/australia-northern-territory — pack content last reviewed 2026-08-10 Legislation: Information Act 2002 (Information Act 2002 (NT)) — The Northern Territory's unified statute covering access to government information, information privacy, and records management; Information Privacy Principles (Information Act 2002, Schedule) — The IPPs governing how NT public sector organisations handle personal information; Records and archives management (Information Act 2002, records provisions) — The duty to make and keep records and to dispose of them only under an approved disposal schedule Oversight: Northern Territory Information Commissioner, with NTCAT — The NT Information Commissioner handles complaints about access decisions and privacy under the same Act, and matters may proceed to the Northern Territory Civil and Administrative Tribunal for hearing. One regulator, one statute, and one tribunal cover ground that most jurisdictions split across three. - Decision deadline: 30 days, extendable where the Act allows - Scope: Access, correction, privacy, and records management in one Act - Correction: A right to correct personal information held about you - Records: Disposal only under an approved records disposal schedule - Review: Information Commissioner complaint, then NTCAT - Languages: English Q: What makes the NT Information Act unusual? A: It combines freedom of information, information privacy, and records management in a single statute overseen by a single Information Commissioner, where most Australian jurisdictions split those functions across separate Acts and often separate regulators. That makes an integrated platform a natural fit rather than a convenience. Q: Does it handle correction requests? A: Yes, as a distinct request type. The Act gives a right to correct personal information held about you, with its own decision and outcome — including annotation where correction is declined. Treating correction as a variant of an access request loses that distinction, so AccessPoint models it separately. Q: How does the records management side work? A: Records may be disposed of only under an approved disposal schedule. AccessPoint applies retention periods across five registers — requests, assessments, incidents, complaints, and risks — so a closed case becomes eligible for disposition on a defined basis, with the disposition recorded rather than left to a manual clean-up. Q: Where does the information reside? A: Entirely within your own Microsoft 365 and Azure tenant, in the Australian region you choose. Applications, documents, redactions, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### New Zealand (pack nz-oia-privacy) URL: https://www.realizer.io/solutions/new-zealand-oia-privacy — pack content last reviewed 2026-07-13 Legislation: OIA (Official Information Act 1982) — Access to official information held by government departments, ministers, and specified agencies — local government is covered by the parallel LGOIMA 1987; Privacy Act 2020 (Privacy Act 2020) — The Information Privacy Principles, personal-information access (IPP 6) and correction (IPP 7), and the notifiable privacy breach scheme (in force since 1 December 2020); Privacy Amendment Act 2025 (New Zealand) — Adds IPP 3A, requiring agencies to tell people when their personal information is collected indirectly — in force 1 May 2026 Oversight: Office of the Ombudsman & Office of the Privacy Commissioner — The Ombudsman investigates complaints about official-information decisions and makes recommendations that agencies have a statutory duty to observe; the Privacy Commissioner oversees the Privacy Act, can issue compliance notices, and can make binding access directions on IPP 6 complaints. - Response deadline: As soon as reasonably practicable, and no later than 20 working days (OIA and IPP 6) - Extensions: A reasonable extension for large or consultation-heavy requests (OIA s 15A) - Fees: No fixed application fee; agencies may make a reasonable charge for supplying official information - Privacy data-subject rights: IPP 6 access and IPP 7 correction, on the same 20-working-day clock - Breach notification: Notify the Privacy Commissioner and affected individuals of a breach likely to cause serious harm - Oversight: The Ombudsman (official information) and the Privacy Commissioner (privacy) Q: Does AccessPoint cover both the OIA and the Privacy Act 2020? A: Yes. The New Zealand configuration ships both regimes in one pack — Official Information Act requests and Privacy Act 2020 obligations — with the shared 20-working-day clock, OIA withholding grounds and extensions, IPP 6 access and IPP 7 correction, the notifiable-breach scheme, and both the Ombudsman and the Privacy Commissioner reflected in the workflows. Q: Does it handle local government under LGOIMA? A: Yes. Local authorities are covered by the Local Government Official Information and Meetings Act 1987, which mirrors the OIA — the same 20-working-day rule and the same Ombudsman oversight. AccessPoint runs central-government OIA requests and local-government LGOIMA requests on the same platform. Q: How does it handle a notifiable privacy breach? A: Log a privacy breach and AccessPoint assesses it against the serious-harm test and produces a live checklist of what the Privacy Act 2020 requires — notice to the Privacy Commissioner and to affected individuals as soon as practicable — with a full audit trail. Q: Where does New Zealand data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### New Zealand — LGOIMA (pack nz-lgoima) URL: https://www.realizer.io/solutions/new-zealand-lgoima — pack content last reviewed 2026-08-10 Legislation: Local Government Official Information and Meetings Act 1987 (LGOIMA 1987) — The right of access to official information held by local authorities, and the rules governing open meetings; Withholding grounds (LGOIMA ss. 6, 7 and 17) — Conclusive and non-conclusive grounds for withholding, most subject to a public interest balance; Meetings (LGOIMA Part 7) — The open-meetings regime — public notice, agendas, and the grounds for excluding the public from part of a meeting Oversight: Office of the Ombudsman — The Ombudsman investigates complaints about LGOIMA decisions and forms opinions with recommendations, which local authorities almost invariably follow. The Ombudsman also publishes guidance and conducts practice investigations into individual councils' handling of requests. - Decision deadline: As soon as reasonably practicable, and no later than 20 working days - Extension: Permitted where the request is large or consultation is necessary, with notice within the original 20 days - Withholding: Sections 6, 7 and 17, most subject to a public interest balance - Charging: Permitted under the Ombudsman's charging guidelines - Meetings: Public notice, agendas, and grounds for excluding the public - Languages: English Q: How does LGOIMA differ from the OIA? A: LGOIMA applies to local authorities and council-controlled organisations, while the Official Information Act applies to central government. The access provisions are closely parallel — the same 20-working-day clock and substantially the same withholding grounds — but LGOIMA also carries the open-meetings regime, which the OIA does not. AccessPoint ships them as separate packs. Q: How are extensions handled? A: An extension must be notified to the requester within the original 20 working days, stating the period of the extension and the reasons for it. AccessPoint tracks the original and extended dates and surfaces the notice inside the window, because an extension taken without timely notice is not a valid extension. Q: Can we track meeting obligations too? A: Yes. Public-excluded resolutions are recorded with the ground relied on, using the same grounds vocabulary as the request side — which makes it possible to see when a council has excluded the public from discussing material it has released, or is withholding material it discussed in open session. Q: Where does the information reside? A: Entirely within your own Microsoft 365 and Azure tenant, in the region you choose. Requests, documents, redactions, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### New Zealand — Health Information Privacy Code (pack nz-hipc) URL: https://www.realizer.io/solutions/new-zealand-hipc — pack content last reviewed 2026-08-10 Legislation: Health Information Privacy Code 2020 (HIPC 2020) — The code issued under the Privacy Act 2020 that modifies the information privacy principles for health agencies, expressed as thirteen rules; Access and correction (HIPC rules 6 and 7) — An individual's right of access to health information about themselves, and to request correction with a statement of correction sought where declined; Notifiable privacy breaches (Privacy Act 2020, Part 6) — The duty to notify the Privacy Commissioner and affected individuals of a privacy breach that has caused or is likely to cause serious harm Oversight: Office of the Privacy Commissioner — The Privacy Commissioner administers the Privacy Act and the codes issued under it, investigates complaints, and receives notifiable privacy breach notifications. Under the Privacy Act 2020 the Commissioner can issue compliance notices and make binding access directions — a materially stronger toolkit than the previous regime. - Access deadline: As soon as reasonably practicable, and no later than 20 working days - Correction: Correction, or a statement of correction sought attached to the record where declined - Breach duty: Notify the Commissioner and affected individuals where serious harm is caused or likely - Structure: Thirteen rules modifying the Privacy Act principles for health agencies - Enforcement: Compliance notices and binding access directions - Languages: English Q: Who does the HIPC apply to? A: Health agencies as the Code defines them — a broad category covering health service providers and others handling health information in New Zealand. The Code modifies the Privacy Act's information privacy principles for that sector, expressing them as thirteen rules tailored to health information. Q: How long do we have to answer an access request? A: As soon as reasonably practicable, and no later than 20 working days after receipt. AccessPoint computes the date over the New Zealand public-holiday calendar and tracks any extension with its ground and the notice given to the individual. Q: What happens if we decline a correction request? A: The individual may require that a statement of the correction sought be attached to the information. AccessPoint records that as an outcome linked to the record, so the statement travels with the health information rather than being filed and forgotten. Q: Where does health information reside? A: Entirely within your own Microsoft 365 and Azure tenant, in the region you choose. Requests, records, assessments, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers. ### New Zealand — Public Records Act (pack nz-public-records) URL: https://www.realizer.io/solutions/new-zealand-public-records — pack content last reviewed 2026-08-10 Legislation: Public Records Act 2005 (Public Records Act 2005) — New Zealand's recordkeeping statute — duties to create and maintain full and accurate records, and to dispose of them only with authority; Disposal authority (PRA 2005, disposal provisions) — Disposal of public records only in accordance with an authority granted by the Chief Archivist; Transfer of records (PRA 2005, transfer provisions) — The duty to transfer records of long-term value to Archives New Zealand, generally at 25 years Oversight: Chief Archivist, Archives New Zealand — The Chief Archivist sets recordkeeping standards, grants disposal authorities, and audits public offices' recordkeeping. Audits examine whether an organisation can demonstrate its practice — not whether it has a policy saying it does the right thing. - Core duty: Create and maintain full and accurate records of affairs, in accordance with normal, prudent business practice - Disposal: Only under an authority granted by the Chief Archivist - Retention floors: Minimum periods applied to casework before disposal is possible - Transfer: Records of long-term value transferred, generally at 25 years - Oversight: Chief Archivist audit of public offices - Languages: English Q: Is this a full records management system? A: No, and it should not be mistaken for one. It applies the Public Records Act's duties to the casework AccessPoint holds — access requests, assessments, incidents, complaints, and risks — with retention, disposition, and audit evidence for those records. Your wider corporate recordkeeping across the organisation remains the domain of your EDRMS and Microsoft 365 retention policies. Q: How does disposal work? A: Retention periods come from each case type, and a closed case becomes eligible for disposition once its period has run. Disposition is then a reviewed action tied to the disposal authority relied on, with what was disposed of, when, and by whom recorded — because the Act permits disposal only under an authority granted by the Chief Archivist. Q: Why install this alongside an access pack? A: Because the two obligations are halves of the same thing. The OIA and LGOIMA give a right to information the office holds; the Public Records Act determines what it must still hold and for how long. Running both against the same cases means a retention decision and an access decision are made about the same record, on the same ledger. Q: Where do the records reside? A: Entirely within your own Microsoft 365 and Azure tenant, in the region you choose. Records, disposition history, and the audit ledger never leave your control — no third-party cloud and no cross-border data transfers. ### India (pack in-rti-dpdp) URL: https://www.realizer.io/solutions/india-rti-dpdp — pack content last reviewed 2026-07-13 Legislation: RTI Act (Right to Information Act, 2005) — A citizen's right to information from public authorities and bodies substantially financed by government; DPDP Act (Digital Personal Data Protection Act, 2023) — Data-principal rights and controller duties for digital personal data — enacted in 2023, with rules finalised in 2025 and obligations phasing in through 2027; DPDP Rules (Digital Personal Data Protection Rules, 2025) — The operational rules finalised in November 2025, setting how consent, data-principal requests, and breach notification work as the Act commences Oversight: Central and State Information Commissions (CIC/SICs) & Data Protection Board of India — The Central and State Information Commissions hear RTI second appeals and complaints and can order disclosure and impose penalties on information officers; the Data Protection Board of India adjudicates data breaches and can impose penalties as the DPDP Act comes into force. - Response deadline: 30 days from receipt by the Public Information Officer (RTI Act) - Expedited: 48 hours where the request concerns a person's life or liberty - Fees: A nominal application fee (e.g. Rs 10 for central-government bodies; state fees vary), with BPL applicants exempt - DPDP data-principal rights: Access (s 11), correction and erasure (s 12), and grievance redressal (s 13) - Breach notification: Notify the Data Protection Board and affected data principals of a personal-data breach - Oversight: Information Commissions (RTI) and the Data Protection Board of India (DPDP) Q: Does AccessPoint cover both the RTI Act and the DPDP Act? A: Yes. The India configuration ships both regimes in one pack — Right to Information Act requests and Digital Personal Data Protection Act obligations — with the RTI 30-day clock, the section 8 exemptions, CIC and SIC appeals, DPDP data-principal rights (access, correction, erasure, and grievance redressal), and breach notification to the Data Protection Board reflected in the workflows. Q: Is the DPDP Act in force yet? A: The Act was enacted in 2023 and its rules were finalised in November 2025, with obligations phasing in — institutional provisions first, and the core duties, including data-principal rights and breach reporting, taking effect through 2027. AccessPoint ships the DPDP workflows now, so your team is ready as each obligation commences. Q: How does it handle RTI appeals? A: AccessPoint's complaints and appeals module tracks first appeals to the appellate authority and second appeals to the Central or State Information Commission, each with its own statutory clock, an investigation workspace, and a guided path to a disclosure order, penalty, or other disposition. Q: Where does Indian data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### South Africa (pack za-paia-popia) URL: https://www.realizer.io/solutions/south-africa-paia-popia — pack content last reviewed 2026-07-13 Legislation: PAIA (Promotion of Access to Information Act 2 of 2000) — Access to records held by public bodies, and by private bodies where a record is required to exercise or protect a right; POPIA (Protection of Personal Information Act 4 of 2013) — Lawful processing of personal information — data-subject access and correction, security-compromise notification, and the eight conditions for lawful processing (enforcement from 1 July 2021) Oversight: Information Regulator (South Africa) — Independent oversight of both PAIA and POPIA — investigates complaints, conducts assessments, issues enforcement notices, and can impose administrative fines of up to R10 million. - Response deadline: 30 days to decide a PAIA request - Extensions: A single extension of up to 30 more days — large volume, wide search, or third-party consultation - Fees: A request fee plus prescribed access fees; personal requesters are exempt from the request fee - POPIA data-subject rights: Access (s 23) and correction or deletion (s 24) - Oversight: Information Regulator — both PAIA and POPIA; administrative fines up to R10 million - Languages: English Q: Does AccessPoint cover both PAIA and POPIA? A: Yes. The South African configuration ships both regimes in one pack — PAIA access-to-information requests and POPIA data-subject requests — with PAIA's 30-day clock and its up-to-30-day extension, POPIA's access (s 23) and correction (s 24) rights, the section 22 breach-notification rules, and the Information Regulator reflected in the complaint workflows. Q: Does it handle requests to private bodies, not just public ones? A: Yes. PAIA is unusual in reaching records held by private bodies where an applicant needs them to exercise or protect a right. AccessPoint ships both the public-body and private-body request types, each with the section numbers and routes that apply to it — including that private bodies have no internal appeal, so requesters go directly to the Regulator or a court. Q: Does it manage POPIA security-compromise notifications? A: Yes. Log a security compromise and AccessPoint assesses it and produces a live checklist of what section 22 requires — notice to the Information Regulator and to affected data subjects, as soon as reasonably possible after there are reasonable grounds to believe a compromise occurred — with a full audit trail. Q: Where does South African data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. ### Brazil (pack br-lai-lgpd) URL: https://www.realizer.io/solutions/brazil-lai-lgpd — pack content last reviewed 2026-07-13 Legislation: LAI (Lei de Acesso à Informação, Lei nº 12.527/2011) — Access to information held by public bodies across the Executive, Legislative and Judicial branches at the federal, state, Federal District and municipal levels; LGPD (Lei Geral de Proteção de Dados, Lei nº 13.709/2018) — Processing of personal data — data-subject access and correction, security-incident notification, and the legal bases for processing (administrative sanctions in force since August 2021) Oversight: Controladoria-Geral da União (CGU) & Autoridade Nacional de Proteção de Dados (ANPD) — The CGU decides federal LAI appeals and monitors compliance; the ANPD is Brazil's independent data-protection authority, issuing regulations and applying sanctions of up to 2% of Brazilian revenue, capped at R$50 million per infraction. - Response deadline: Immediate where possible, otherwise 20 days (LAI, art. 11) - Extensions: A further 10 days with express written justification - Fees: Access is free — only the cost of reproduction may be charged - LGPD data-subject rights: Access and correction (art. 18), with a full declaration within 15 days (art. 19) - Oversight: CGU for LAI appeals; the ANPD for data protection (fines up to R$50 million per infraction) - Languages: Portuguese, extensible to other languages Q: Does AccessPoint cover both the LAI and the LGPD? A: Yes. The Brazilian configuration ships both regimes in one pack — LAI access-to-information requests and LGPD data-subject requests — with the LAI's 20-day clock and justified 10-day extension, the LGPD's access and correction rights (art. 18) and 15-day full-declaration window (art. 19), the ANPD security-incident notification rules, and the CGU appeal ladder reflected in the workflows. Q: Is the platform available in Portuguese? A: Yes. The Brazilian pack is Portuguese-first — every interface element, notice, letter, and template is available in Portuguese out of the box — and AccessPoint extends to other languages for organisations that operate in more than one. Q: Does it handle LGPD breach notification to the ANPD? A: Yes. Log a security incident and AccessPoint assesses the risk of relevant harm and produces a live checklist of what must be reported to the ANPD and to affected data subjects — within three business days of becoming aware, under Resolution CD/ANPD nº 15/2024 — with a full audit trail. Q: Where does Brazilian data reside? A: Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers. --- Generated from the site's content system. Curated index: https://www.realizer.io/llms.txt