Solutions · By organization

National government access and privacy, in the department's own tenant

Canada's Access to Information Act and Privacy Act on the federal 30-day clock with the Algorithmic Impact Assessments the TBS Directive makes mandatory; the United Kingdom's FOIA 2000 and EIR 2004 requests beside subject access under the UK GDPR — multilingual, audit-ready, and never leaving your Microsoft 365 environment.

Start Free Trial Request a Demo

For a national or central government department, AccessPoint runs the whole information-rights mandate in one place. In Canada, that means Access to Information Act and Privacy Act requests on the federal 30-day clock with section 9 extensions and the federal exemption catalogue, plus the Algorithmic Impact Assessments the Treasury Board Directive on Automated Decision-Making requires before an automated decision system goes into production. In the United Kingdom, it means Freedom of Information Act 2000 requests on the 20-working-day clock, Environmental Information Regulations 2004 requests routed under their own rules, and subject access requests under the UK GDPR and Data Protection Act 2018. Either way it deploys inside your department's own Microsoft 365 and Azure tenant, ships multilingual, and carries a flat published price billed through the Microsoft commercial marketplace.

The Canadian federal thread is the most developed, because the timing forced it: AccessPro Case Management was declared a Government of Canada legacy application effective June 2023, and departments migrating off it face a real decision — move to another vendor-cloud request tracker, or move the whole mandate into a system the department controls. The same ATIP office that answers requests also runs Privacy Act obligations, privacy breaches, Info Source descriptions of the department's holdings, and now AI governance; software that only logs requests leaves most of that in spreadsheets.

The UK story rhymes. A departmental information-rights team routinely holds FOIA 2000 requests, EIR 2004 requests, and subject access requests in the same queue, answering to the same Information Commissioner — and the three regimes diverge on almost everything that matters: 20 working days under section 10 against one calendar month under Article 12(3), a section 12 appropriate limit of £600 for central government against no cost limit at all under the EIR, absolute and qualified exemptions against a statutory presumption in favour of disclosure. Behind both threads sits the same structural bet: national government records should be processed where they already live. Responsive records sit in departmental SharePoint, Outlook, and Teams; AccessPoint collects them there instead of exporting them to a third-party cloud, custodians close their searches with legally-defensible digital attestations, and every action lands on a hash-chained audit ledger a commissioner can be shown without reconstruction.

What a national access and privacy program needs from its software

Whatever system your department selects — including if it isn't AccessPoint — these are the capabilities a central institution should insist on before signing.

Every regime on its own statutory clock Canada's ATIA and Privacy Act share a 30-calendar-day deadline with section 9 extensions. The UK runs 20 working days under FOIA section 10, 20 extendable to 40 under EIR regulation 7, and one calendar month for subject access. The system should compute each date on the right calendar, not offer one reminder field.
Access and personal-data rights in one office Most national departments answer both public access requests and individual rights requests, often with the same staff. If those live in two systems, the office pays the integration cost every day — one platform, two regimes, one audit trail.
Impact assessments for automated decision systems Canada's Treasury Board Directive makes an Algorithmic Impact Assessment mandatory before an automated decision system is put into production, with results published. Wherever a comparable directive binds you, that work belongs beside your PIAs, not in a standalone spreadsheet.
Search evidence, not assurances When a no-records response is challenged — before Canada's order-making Information Commissioner, or through an ICO section 50 decision notice and a First-tier Tribunal appeal — custodian emails saying "nothing found" are weak evidence. Certified digital attestations against the record are strong evidence.
Language as an obligation, not a setting For Canadian federal institutions, English and French are a legal duty. For multilingual jurisdictions generally, the same problem shows up differently. Every interface element, notice, letter, and template should already operate in the languages you are accountable in.
Sovereignty over the records under review Records in access review are sensitive by definition. Processing them in the department's own tenant — with in-country data residency and no vendor runtime access — removes an entire category of risk, and one more vendor cloud from your assessment queue.

How AccessPoint serves a national institution

Pre-configured by jurisdiction pack — Canada federal, the United Kingdom, and 70 more — and running entirely on your own Microsoft 365 and Azure footprint.

Canada: ATIA and Privacy Act requests

Two regimes, one configuration: the 30-day clock, section 9 extensions, the federal exemption and exclusion catalogue colour-coded for redaction, and deemed refusal recorded automatically when a deadline lapses.

United Kingdom: FOIA, EIR, and subject access

The 20-working-day FOIA section 10 clock with the Part II exemptions and the section 2 public-interest test; EIR requests routed separately on 20 working days extendable to 40, with regulation 12(2)'s presumption in favour of disclosure; the section 12 appropriate limit at £600 for central government; and subject access on the UK GDPR's one-calendar-month clock. Fee schedules arrive quoted in £, not converted from someone else's currency.

Parliamentary questions as their own case type

The work a national institution has that a municipality doesn't. Parliamentary questions run as a purpose-configured request type with their own intake, clocks, and reporting — the Canadian pack ships this as the Order Paper question type, and the equivalent can be configured for another parliament's process.

Mandatory Algorithmic Impact Assessments

Run the AIA the TBS Directive requires — impact scoring and tiering, sections delegated to subject-matter experts, review sign-off, and a published, audit-trailed result — on the same engine as your PIAs.

Digital attestations on every search

Custodians certify their searches and production with legally-defensible digital attestations captured against the record and backed by the audit ledger — the evidence a commissioner review actually asks for.

The statutory reports you table

Federal timeliness brackets and statutory statistical-report templates come preloaded, so annual reporting to TBS and Parliament is generated from the system of record — plus Report Studio for the operational reporting leadership asks for that the statute doesn't.

Multilingual, and bilingual where it's the law

The interface ships natively in 11 languages, with English and French out of the box for Official Languages obligations, and is built to meet public-sector accessibility standards (WCAG). Case content can additionally be translated per record, with the original always one click away.

The AccessPro migration

AccessPro is a designated legacy application. Bring your history with you.

AccessPro Case Management was declared a Government of Canada legacy application effective June 2023, and departments are selecting successors now. If you're outside Canada the designation won't apply to you — but the mechanism will, because leaving any legacy request tracker raises the same question. AccessPoint treats migration as a workbook exercise, not an ETL project, and it works in the other direction too, so you are never locked in.

A guided workbook import An Excel template generated with your tenant's own type codes, per-row validation, and a fix-and-reupload error report.
Historical by construction Imported records fire no notifications and recompute no deadlines, and every one carries Imported provenance in the audit trail.
No lock-in either way The database is yours, and a business-readable export of everything is always one click away.

Go deeper

Canada — the federal jurisdiction pack ATIA and Privacy Act deadlines, exemptions, extension reasons, and bilingual templates, preloaded for the Government of Canada. United Kingdom — FOIA 2000 The 20-working-day clock, the Part II exemptions with the public-interest test, section 12 cost limits, and ICO and Tribunal appeals. United Kingdom — UK GDPR & DPA 2018 Subject access on the one-month clock, the Schedule 2 and 3 exemptions, 72-hour breach notification, and Article 35 DPIAs. Replacing AccessPro What the June 2023 legacy designation means, how AccessPoint compares, and how to migrate your case history. AccessPoint vs. Fivium eCase The FOI, correspondence and Parliamentary Questions system used across UK central government, compared honestly — where each one wins. AI governance and AIAs How the assessment engine runs Algorithmic Impact Assessments — scored, tiered, reviewed, and published. Security and data sovereignty What deploys, where data lives, and who can see it — including the government security-controls documentation.

Federal & National Government Questions

What is replacing AccessPro for ATIP case management?
There is no single mandated successor. AccessPro Case Management was declared a Government of Canada legacy application effective June 2023, and departments are evaluating replacements individually — some moving to the incumbent vendor-cloud tracker, others reconsidering the model entirely. AccessPoint is the tenant-native option: the full ATIP and privacy mandate running inside the department's own Microsoft 365 and Azure environment, with a guided workbook import for AccessPro history. The AccessPro comparison page walks through the decision in detail.

Does AccessPoint handle both Access to Information Act and Privacy Act requests?
Yes. The Canadian federal jurisdiction pack ships both regimes in one configuration — the shared 30-calendar-day clock, section 9 extensions for large volumes, consultations, and third-party notice, the federal exemption and exclusion catalogue, and complaint workflows reflecting the order-making Information Commissioner and the Privacy Commissioner of Canada.

Can a UK central government department run FOIA, EIR, and subject access in one system?
Yes, and that is how most information-rights teams are already organized. AccessPoint ships UK jurisdiction packs covering all three: Freedom of Information Act 2000 requests on the 20-working-day clock under section 10, with the Part II absolute and qualified exemptions and the section 2 public-interest test recorded on every qualified one; Environmental Information Regulations 2004 requests routed separately by an environmental-scope screener, on 20 working days extendable to 40 under regulation 7, with regulation 12(2)'s presumption in favour of disclosure applied to every exception and no section 12 cost-limit refusal available; and subject access under the UK GDPR on the one-calendar-month clock in Article 12(3), extendable by two further months for complex or numerous requests, with the Data Protection Act 2018 Schedule 2 and 3 exemptions. Internal review, ICO section 50 decision notices, and First-tier Tribunal appeals run on the complaints and appeals module. Scottish public authorities use the separate Scotland pack, because FOISA and the Scottish Information Commissioner are their own regime.

Can US federal agencies use AccessPoint, and what about FedRAMP?
Yes, and the FedRAMP question works differently than it does for a hosted product. FedRAMP authorizes cloud services agencies consume from a provider — AccessPoint isn't one. It deploys into your own cloud environment, so for a federal agency that means your own government-cloud tenancy, whose platform authorizations you already inherit from Microsoft, with AccessPoint assessed inside your existing system boundary under your normal authorization process rather than as a separate vendor service. Deployment artifacts are published outside AppSource with a scripted installer precisely so sovereign and government clouds are supported. Purchasing adapts too: we can set up a private offer targeted to your tenant, or you can buy through your existing cloud solution provider, so the licence follows the procurement route your agency already uses. Even the optional AI Assist components have a government-cloud path — Microsoft offers Azure OpenAI in Azure Government's US Gov Virginia and US Gov Arizona regions, approved within the FedRAMP High authorization for Azure Government and DISA's DoD Impact Level 4 and 5 provisional authorization — though model and feature availability differs from commercial regions. What's worth confirming early with us is the specifics of your environment: which cloud you run, which optional components you want, and what your security team needs for the assessment. US state, county, city, and special-district agencies are served by the same platform, with 27 US public-records packs — see /solutions/industries/state-government.

Can it run the Algorithmic Impact Assessment required by the Directive on Automated Decision-Making?
Yes. The Treasury Board Directive requires federal institutions to complete an Algorithmic Impact Assessment and publish the results before an automated decision system goes into production. AccessPoint runs the AIA end to end — impact scoring and tiering, section delegation to experts, review, and a published result — on the same governed engine as your Privacy Impact Assessments, with a full audit trail. The same engine assesses automated decision systems against your own responsible-AI framework where no directive applies.

Is AccessPoint multilingual, and bilingual for Official Languages requirements?
Yes. The entire interface ships natively in 11 languages, with English and French out of the box — every notice, letter, and template operates in either official language, which is what Canadian federal institutions need, and the same capability serves multilingual jurisdictions generally. Case content such as scope, correspondence, and closure summaries can also be translated per record, with the original always one click away.

Your Department's Mandate. Your Department's Tenant.

Try AccessPoint free for 30 days, pre-configured for your national regime. No credit card required.

Start Free Trial