Ontario · Child, Youth and Family Services Act, Part X

Run Part X access, correction, and breach duties in one platform

For children's aid societies, licensees, and other service providers under the CYFSA — AccessPoint manages access and correction requests about a person's own records, the Part X privacy rules, and breach notification to the IPC, all inside your own Microsoft 365 tenant.

Start Free Trial Request a Demo

Ontario — CYFSA Part X at a glance

Access deadline
30 days, with a permitted extension on notice
Correction
Correction or a statement of disagreement where refused
Who is covered
Service providers under the CYFSA — including children's aid societies and licensees
Breach duty
Notice to the individual, and reporting to the IPC in prescribed circumstances
Oversight
IPC Ontario — binding orders
Languages
English, French

Built for Ontario — CYFSA Part X

One platform for the whole access-and-privacy mandate, pre-configured for this regime and running in your own Microsoft 365 tenant.

Access requests on the Part X clock

Take a request for a person's own record from intake to release on the 30-day clock, with the permitted extension tracked and the Part X exceptions applied and cited on every withheld passage.

Correction and statements of disagreement

Run correction requests end to end — the decision, the correction itself or the refusal with reasons, and the individual's statement of disagreement attached to the record where correction is not made.

Records about more than one person

Child welfare records rarely concern only one person. Sever third-party information, apply the Part X exceptions, and keep a defensible line-by-line record of what was withheld and why.

Privacy breaches and IPC reporting

Log an unauthorized collection, use, or disclosure, assess it, notify the individual, and report to the Commissioner where Part X requires it — on a live checklist rather than a memo.

Assessments for new services and systems

Run privacy impact assessments for new programs, information systems, and data-sharing arrangements, with the risks tracked to closure in an embedded register.

In your own tenant

Case files about children, youth, and families stay inside your own Microsoft 365 and Azure tenant — no third-party cloud, no vendor access, and no cross-border transfers.

A regime of its own

Part X is not PHIPA and it is not FIPPA. It has its own rules, and its own Commissioner's orders.

Before 2020, access to child, youth and family services records in Ontario sat in an uneasy gap. Part X of the CYFSA closed it — giving individuals a statutory right of access to and correction of their own personal information held by service providers, with the IPC empowered to review and to order. The regime borrows its shape from PHIPA but not its detail: different exceptions, different actors, and records that frequently concern a child, a parent, a foster family, and a worker all at once. Running Part X inside a general-purpose FOI tool means re-deriving those distinctions by hand on every file. AccessPoint ships Part X as its own configuration — the clock, the exceptions, the correction path, and the breach duties — so a service provider works the regime it is actually subject to.

The 30-day clock Computed on receipt, with the permitted extension tracked.
Multi-party records Severing built for files about several people at once.
Order-ready A timestamped trail built for an IPC review.

Configured out of the box

Installing the ca-on-cyfsa jurisdiction pack seeds your tenant with everything this regime needs — a starting point you can adjust, not a lock-in.

Related guide: FOI Workflow Quick Check
  • Part X of the CYFSA as the legal-authority spine, with the access and correction rights as the workflow
  • The 30-day access clock with the permitted extension and Ontario's statutory-holiday calendar
  • The Part X exceptions to access, colour-coded for redaction and citable line by line
  • Correction requests, refusals with reasons, and statement-of-disagreement handling
  • Third-party severing for records concerning more than one individual
  • Privacy breach intake, assessment, individual notice, and IPC reporting where required
  • IPC complaint and review tracking, with grounds and dispositions
  • Bilingual correspondence templates carrying the statutory wording

Ontario — CYFSA Part X Questions

Who is subject to Part X of the CYFSA?
Service providers under the Child, Youth and Family Services Act, 2017 — including children's aid societies and licensees delivering services under the Act. Part X governs how they collect, use, and disclose personal information, and gives individuals the right to access and correct their own information. It has been in force since 1 January 2020.

How is Part X different from PHIPA or FIPPA?
It is a separate regime with its own exceptions and its own actors, even though the IPC of Ontario oversees all three. PHIPA covers health information custodians; FIPPA and MFIPPA cover provincial and municipal institutions; Part X covers CYFSA service providers. AccessPoint ships each as its own jurisdiction pack, so an organization subject to more than one runs each on its correct rules rather than approximating.

Does it handle breach notification?
Yes. Log an unauthorized collection, use, disclosure, or loss, run the assessment, notify the affected individual, and report to the Information and Privacy Commissioner where Part X requires it — with the whole sequence timestamped for a later review.

Where does the information reside?
Entirely within your own Microsoft 365 and Azure tenant. Case files, requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers.

Run CYFSA Part X in Your Own Tenant

Try AccessPoint free for 30 days, configured for Ontario service providers. No credit card required.

Start Free Trial