Ontario · MFIPPA & Bill 97

Access and privacy for Ontario municipalities, in one platform

AccessPoint manages MFIPPA freedom-of-information requests and the privacy duties Bill 97 now brings to municipalities and local boards — pre-configured for Ontario's municipal sector and running inside your own Microsoft 365 tenant.

Start Free Trial Request a Demo

Ontario (Municipal) at a glance

Response deadline
45 business days (Bill 97, in force July 1, 2026)
Extensions
Section 20, plus a staged access plan under Bill 97
Application fee
$5, plus search and preparation fees per the MFIPPA schedule
Municipal privacy impact assessments
Mandatory before collecting personal information (Bill 97, from January 1, 2027)
Oversight
Information and Privacy Commissioner of Ontario (order-making, appeals)
Languages
English, with French-language services

Built for Ontario (Municipal)

One platform for the whole access-and-privacy mandate, pre-configured for this regime and running in your own Microsoft 365 tenant.

MFIPPA request lifecycle

Intake to disclosure on the municipal clock — the 45-business-day timeline under Bill 97 — with section 20 extensions, staged access plans, the MFIPPA exemption and exclusion catalogue, fee estimates, and IPC-ready records, all built on Microsoft 365.

Municipal privacy impact assessments

Run the privacy impact assessment Bill 97 now requires before a municipality or local board collects personal information — from January 1, 2027 — a guided questionnaire, an embedded risk register, and a defensible, exportable record.

Breach reporting to the IPC

Log a municipal privacy breach, assess real risk of significant harm, and get a live checklist of what Bill 97 requires you to report to the Commissioner and to affected individuals, and by when.

IPC appeals and complaints

Track appeals to the Information and Privacy Commissioner with their own statutory clocks, an investigation workspace, and a guided path from representations to a binding order.

In your own municipal tenant

Every request, assessment, and record stays inside your own Microsoft 365 and Azure tenant — no third-party cloud, no cross-border transfers, no per-user fees.

Municipal statistical reporting

Generate the MFIPPA annual statistics your institution reports, from timeliness brackets and templates configured for the municipal regime.

The Bill 97 municipal mandate

Bill 194 modernized the province. Bill 97 brings the same privacy duties to municipalities.

Ontario's Bill 194 added mandatory privacy impact assessments and breach reporting for provincial FIPPA institutions, effective July 1, 2025 — but did not extend them to the municipal sector. Bill 97, the Plan to Protect Ontario Act (Budget Measures), 2026, closes that gap. Municipalities and local boards must now complete a privacy impact assessment before collecting personal information, report privacy breaches to the Information and Privacy Commissioner where there is a real risk of significant harm, and meet expanded safeguard duties — while the response clock moves to 45 business days. The changes phase in through July 1, 2026 and January 1, 2027. AccessPoint runs municipal access and municipal privacy on one platform, in your own tenant.

Mandatory municipal PIAs Required before collecting personal information, from January 1, 2027.
Breach reporting Notification to the IPC and affected individuals, computed for you.
45-business-day clock The new municipal response time, tracked in business days.

Configured out of the box

Installing the ca-on-mfippa configuration pack seeds your tenant with everything this regime needs — a starting point you can adjust, not a lock-in.

Related guide: Ontario FOI in Transition
  • MFIPPA (and its regulations) as the legal-authority and citation spine
  • Ontario statutory-holiday calendar and Bill 97 business-day due-date rules
  • The MFIPPA exemption and exclusion catalogue, colour-coded for redaction
  • Section 20 extension reasons and Bill 97 staged-access-plan options
  • Requestor fee categories and the MFIPPA fee schedule
  • IPC appeal and privacy-complaint grounds and dispositions
  • Ontario municipal timeliness brackets and the statutory statistical-report template
  • MFIPPA correspondence templates with statutory wording

Ontario (Municipal) Questions

Does AccessPoint reflect Bill 97's new municipal timelines?
Yes. Bill 97 extends the MFIPPA response time from 30 days to 45 business days, effective July 1, 2026, and lets institutions propose a staged access plan in prescribed cases. AccessPoint runs the business-day clock, the Ontario holiday calendar, and the extension and staged-access rules for you.

Does Bill 97 really require municipal PIAs and breach reporting?
Yes. The privacy amendments Bill 194 made to FIPPA in force July 1, 2025 did not extend to the municipal sector. Bill 97 changes that: from January 1, 2027, municipalities and local boards must complete privacy impact assessments before collecting personal information and report breaches to the IPC where there is a real risk of significant harm. AccessPoint runs both.

We're a provincial institution under FIPPA, not municipal — is that covered?
Yes. AccessPoint ships a separate Ontario FIPPA configuration for provincial ministries, agencies, and universities, including the Bill 194 privacy obligations. See the Ontario FIPPA page at /solutions/ontario-fippa.

Where does municipal data reside?
Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers.

Run MFIPPA and Bill 97 in One Platform

Try AccessPoint free for 30 days, pre-configured for Ontario municipalities. No credit card required.

Start Free Trial