Arya Privacy — Privacy Compliance for Local Public Bodies in Ten Provinces

Start here

Ten provinces, and they do not ask for the same things.

Pick yours. The fee schedule below, the procurement rule that governs how your body is allowed to buy it, and the estimator all switch to it. Sections 01 to 05 work through Alberta in detail — they are there to show how closely each Act gets read, not because Alberta is the only province served.

§01 · Alberta · What changed

One statute became two, and the obligations moved.

Access obligations went to the Access to Information Act. Privacy obligations went to the Protection of Privacy Act, with the detail set out in the Protection of Privacy (Ministerial) Regulation, AR 143/2025.

For a municipality this has a consequence that is easy to miss. Policies, consent wording, records schedules and website privacy statements written against FOIP now cite a statute that no longer contains the provisions they rely on. The obligations did not disappear — they moved, and in places they changed shape.

Two are new in substance rather than in numbering: the duty to establish and implement a documented privacy management programme, and a Privacy Impact Assessment threshold that is considerably narrower than most summaries describe.

Who counts as a public body

ATIA s.1(m) defines a local government body, and the list is wider than most people expect: municipalities, improvement districts, special areas, regional services commissions, irrigation and drainage district boards, management bodies under the Alberta Housing Act, Metis settlements and the Metis Settlements General Council, police commissions and services, municipal and intermunicipal library boards, and any board, committee, commission, panel, agency or corporation created or owned by one of those.

That matters because shared delivery with a library board, a housing management body or a regional services commission is not a vendor relationship — it is two public bodies running a common programme, which changes the analysis entirely.

§02 · Alberta · The threshold

When an assessment is actually required.

POPA does not require a PIA for every system that touches personal information. Section 7(1) sets a threshold with two limbs — and a practice has to clear the preconditions before either limb is reached at all.

The preconditions: the practice, programme, project or service must be new, or a substantial change to an existing one, and it must involve the collection, use or disclosure of personal information. A system that has run unchanged for six years is not caught by s.7(1) merely because it holds personal information.

s.7(1)(a)Loss of, unauthorized access to, or unauthorized disclosure of the personal information could result in significant harm, as determined under s.4.
s.7(1)(b)One or more of the factors requiring submission under s.7(5) applies.

The asymmetry between them is the part worth understanding. Limb (a) stands on its own: a practice can require a completed assessment on significant-harm grounds with no obligation to file it. Anything caught by limb (b) must be both completed and submitted.

The six factors under s.7(5)

7(5)(a)Personal information deemed to be of high sensitivity
7(5)(b)Personal information of a significant percentage of the population served
7(5)(c)Data matching between two or more public bodies
7(5)(d)Part of a common or integrated programme or service
7(5)(e)Development or use of innovative technology
7(5)(f)The Commissioner requests a copy under POPA s.27(1)(j)

"High sensitivity" in (a) is a defined term, not a judgement call. Section 1 deems only three things to be of high sensitivity: biometric information, financial information, and personal information respecting a minor, senior or vulnerable individual. It is a closed list.

Three provisions that reduce the work

s.7(3) — detail must be commensurate with the complexity of the practice. For a village of two hundred people that is a statutory limit on scope, not a courtesy.

s.7(4)(a) — where a practice already has a PIA, a substantial change can be handled by amending it rather than starting again.

s.7(4)(b) — for a common or integrated programme, or data matching between two or more public bodies, those bodies may prepare one joint PIA, each adding an addendum for its own circumstances. This sits in the Regulation itself, not in guidance, and it is the single most useful provision available to small municipalities sharing a service.

What an assessment must contain — s.7(2)

(a)A summary of the purpose of the collection, use or disclosure
(b)The types of personal information involved, and the reasonable security arrangements protecting it
(c)The legal authority for the collection, use or disclosure
(d)Privacy risks identified, and the strategies mitigating them
(e)Administrative, physical and technical safeguards
(f)Procedures for accuracy, correction and retention
(g)A governance structure where two or more bodies share a programme

Seven, not six — and (b) is the one most often dropped. Under s.7(6), where submission is required and an agreement underlies the practice, the privacy-related portions of that agreement must be submitted alongside.

§03 · Alberta · Screening

Test a practice against Alberta's s.7(1).

This applies the statutory test and nothing else — the same sequence I work through system by system in a screening engagement. It answers two separate questions: whether an assessment is required, and whether it must be submitted. This instrument applies Alberta's Regulation only. British Columbia has no equivalent threshold to screen against: Directions 2-21 call for an assessment of every new initiative and before any significant change, so a "not required" result here says nothing about a B.C. body. The B.C. schedule is in §06.

Screening · Alberta · AR 143/2025 s.7 Loaded with a worked example

—

§04 · Alberta · Corrections

Seven things in circulation that are wrong.

These come from summaries, vendor material and secondhand briefing notes, and several are in wide use. Every correction can be checked against the section cited in a couple of minutes — the sources are linked at the foot of this page. All seven are Alberta law: POPA, the Access to Information Act and AR 143/2025. British Columbia works the other way round on the first of them, since an assessment there is required for every new initiative.

Commonly said

A PIA is required for any system that handles personal information.

What Alberta's law says

Only for a practice that is new or substantially changed, involves personal information, and then meets limb (a) or limb (b). Long-standing systems running unchanged sit outside s.7(1) entirely.AR 143/2025 s.7(1)

Commonly said

Section 7(1) sets out six triggers for a PIA.

What Alberta's law says

Section 7(1) has two limbs. Five of the six factors live in s.7(5), which governs submission to the Commissioner — a different obligation from preparation.AR 143/2025 s.7(1), s.7(5)

Commonly said

There are five factors requiring submission.

What Alberta's law says

Six. High sensitivity, a significant percentage of the population served, data matching between public bodies, a common or integrated programme, innovative technology, and a request from the Commissioner.AR 143/2025 s.7(5)(a)–(f)

Commonly said

Health and medical information is high sensitivity.

What Alberta's law says

Section 1 defines high sensitivity as a closed list: biometric information, financial information, and information respecting a minor, senior or vulnerable individual. Health information usually qualifies through the third — and an assessment should say so rather than assert sensitivity.AR 143/2025 s.1

Commonly said

Section 7(2) sets six content requirements.

What Alberta's law says

Seven, (a) through (g). The one most often omitted is (b) — the types of personal information involved together with the reasonable security arrangements protecting it.AR 143/2025 s.7(2)

Commonly said

Joint PIAs are a Government of Alberta recommendation.

What Alberta's law says

They are in the Regulation. Section 7(4)(b) permits a joint assessment for a common or integrated programme or for data matching, with each participating body preparing an addendum. That is an entitlement, not guidance.AR 143/2025 s.7(4)(b)

Commonly said

Metis settlements are not public bodies under the legislation.

What Alberta's law says

ATIA s.1(m) expressly lists Metis settlements and the Metis Settlements General Council among local government bodies. First Nations are not listed and are not public bodies under the Act — that distinction is real, but it applies only to First Nations.ATIA, SA 2024 c A-1.4, s.1(m)

§05 · Scope of work

Four pieces of work, each with a defined output.

I take them on singly. Nothing here depends on buying the rest.

01 · POPA s.25 · AR 143/2025 s.6

Privacy Management Program — review, or built from scratch

Where a programme exists: a written review against the five matters s.6(1) requires, the additional requirements s.6(2) imposes where volume or sensitivity is high — including for automated and AI-assisted systems — and the publication duty under s.6(3). Programmes written in-house are the common case, and the hardest thing to check from inside the office that wrote them. Output is a marked-up review with each gap identified by section and the wording needed to close it.

Where none exists: the programme itself — policies, procedures, roles, an information inventory, staff training, breach response, and a version fit to publish under s.6(3). The 11 June 2026 deadline has passed, so this is now a remediation job rather than a preparation one, and it is the work most small municipalities still have outstanding.

02 · AR 143/2025 s.7(1), s.7(5)

PIA screening across a municipality's systems

A system-by-system determination of what s.7(1) actually catches and what it does not, and for anything caught, whether s.7(5) makes submission mandatory. Output is a written screening record — the document to point at when someone asks why no assessment was prepared for a given system.

03 · AR 143/2025 s.7(4)(b)

Joint Privacy Impact Assessment

For a shared service, commission or mutual-aid arrangement: one assessment on the Commissioner's template covering the common programme, with a short addendum for each participating body. Costs are split across the bodies rather than carried by each. This is the only structure in which a full assessment is economically sensible for municipalities under a thousand people.

04 · POPA s.26 · OIPC template

Single-body Privacy Impact Assessment

A complete assessment against the OIPC POPA PIA Template, Sections A through H with appendices, meeting all seven content requirements in s.7(2) and, where submission is required, assembled with the privacy-related portions of any underlying agreement as s.7(6) requires.

§06 · Fees

Flat, and published.

Quoted before anything starts, and set out here so a CAO can work out the cost of a decision without having to ask for a proposal first. Almost nobody in this market publishes rates; there is no good reason for that. The estimator below prices a specific engagement.

Work	Fee (CAD)
Privacy Management Program — review of an existing programme, one public body	$2,500
Each additional body sharing the same administration	$900
Privacy Management Program — built from scratch, POPA s.25 and s.6	from $6,500
Each additional body sharing the same administration	$1,500
PIA screening across a municipality's systems	$1,900
Joint Privacy Impact Assessment under s.7(4)(b) — shared assessment	from $4,900
Addendum for each participating body	$750
Single-body Privacy Impact Assessment, OIPC template A–H	from $5,200
Ongoing privacy support — s.25(3) requests, breach questions, annual review	$350 / month
Work outside these scopes, hourly	$165
Privacy management program — review against Direction 02/2022, one public body	$2,400
Each additional body sharing the same administration	$1,200
Privacy management program — built for a small body: village, library board, police board, created commission	$4,800
Privacy management program — built for a district, city, school district or regional district	from $6,500
Each additional body sharing the same administration	$1,200
Initiative screening — one initiative, documented conclusion and reasons	$850
Privacy Impact Assessment — one initiative, Directions 2-21 D1 to D13	$2,200
Complex assessment — new core system, camera or biometric deployment, data-linking	from $3,400
Supplementary assessment where sensitive information is stored outside Canada	$650
Amendment of an existing assessment ahead of a significant change	$950
Initiative inventory and triage — everything adopted since 26 November 2021	$2,200
Common or integrated programme — the Regulation s.12 agreement, the joint assessment, and the s.69(5.4) notification	from $7,500
Addendum for each participating body	$650
Assessment retainer — small body, up to four assessments a year	$250 / month
Standard body, up to eight, with amendments	$450 / month
Work outside these scopes, hourly	$165
Review against the duty to protect, the service-provider agreements and the notification procedure	$1,600
Each additional local authority sharing the same administration	$800
Policies and procedures built for a small body: village, resort village, RM, library board, council-appointed commission	$3,900
Policies and procedures built for a town, city, board of education or police service	from $5,200
Each additional local authority sharing the same administration	$800
Service-provider inventory and audit — every provider checked against the three contents in Reg. s.8.2, with the addendum	$1,800
Each provider beyond twelve	$150
Addendum taken to signature with each provider, if you would rather not chase them	$220 each
Breach procedure under s.28.1 — included with a policies build	$950
Ongoing support — questions, an addendum for each new provider, one annual review	$200 / month
Work outside these scopes, hourly	$165
Head and coordinator check — the s.80 designation by by-law or resolution and the Reg. s.2 appointment, with model wording	$450
Review of what the office already has against the retention policy, safeguards, breach notification, information-manager and head duties	$1,700
Breach-response kit — the decision record, the notice carrying the nine prescribed contents, the Ombudsman's report and a breach log	$1,100
Information-manager inventory and agreements — every provider listed and checked against s.44.1(3), with the addendum that supplies what is missing	$1,700
Retention policy and safeguards set built for a small body: rural municipality, village, watershed district, planning district, police board	$3,600
Retention policy and safeguards set built for a town, city or school division	from $4,900
Health information set under PHIA — the written security policy and procedures, authorised-access list, training, confidentiality pledges and the first two-yearly audit	from $2,200
Each additional public body sharing the same administration — a planning district, watershed district or police board	$850
Each information manager beyond twelve	$150
Addendum taken to signature with each information manager, if you would rather not chase them	$220 each
PHIA security audit repeated at the two-year point, Reg 245/97 s.8(1)	$900
Ongoing support — questions as they arise, an agreement for each new information manager, the first call on any suspected breach — the assessment and the report to the Ombudsman — and one annual review	$225 / month
Work outside these scopes, hourly	$165
Collection inventory and readiness review, ss.28(3), 30(5) and 30.1	$1,800
Assessment kit built, small institution (township, village, library board, police board, planning board)	$2,900
Assessment kit built, standard institution (town, city, school board, board of health, DSSAB, conservation authority, transit commission)	from $4,200
Written assessment for one collection, all ten s.28(3) items	$1,600
Breach kit: decision record, register, report to the Commissioner, notice to the individual	$1,250
Access procedure updated to the 1 July 2026 amendments	$950
Each additional institution sharing one administration	+$850
Complex collection — a camera or licence-plate reader, biometrics, data-linking, a new core system	from $2,900
Update to an existing assessment on a significant change of purpose, s.28(5)	$650
School-board variant added to a kit: the O. Reg. 52/26 parent notice, and the O. Reg. 51/26 point of contact and maturity calendar	+$1,400
Ongoing support — up to four written assessments or recorded screening decisions a year, the breach register and the annual count, one review of the kit, and questions as they arise	$275 / month
Work outside these scopes, hourly	$165
Compliance review against ss.63.3, 63.4, 63.5, 63.11, 67.2 and 70.1, with the two published documents checked from outside first	$2,200
Governance rules and confidentiality policy written, small body (municipality under 5,000, régie intermunicipale, office d’habitation, para-municipal body)	$4,200
Same, standard body (ville, MRC, communauté métropolitaine, centre de services scolaire, corps de police municipal)	from $6,200
Suppliers and anything hosted outside Québec: the s.67.2 clauses, the confidentiality undertakings, and a s.70.1 assessment with its written agreement for each transfer	$2,600
Confidentiality incident register and notification procedure, ss.63.8–63.11 with the regulation’s eight prescribed contents	$1,100
Privacy impact assessment for one project, s.63.5	$2,200
Shared collection through an MRC or a régie, s.64: the assessment, the agreement with its prescribed contents, and the thirty-day clock to the Commission	from $6,800
Each additional public body under the same administration	+$1,100
Complex assessment — new core system, video surveillance, biometrics, file matching	from $3,400
Amendment after a significant change to the project	$950
Each supplier beyond eight, or each transfer outside Québec beyond three	+$400
Each participating body added to a s.64 agreement	+$700
Ongoing support — up to four s.63.5 assessments a year, a s.70.1 assessment and written agreement for each new supplier or platform, the s.67.2 clauses in each new contract, and the register kept current	$300 / month
Work outside these scopes, hourly	$165
Readiness review against the new Act, with the 2027 launch inventory	$2,200
Privacy policy, public complaint procedure and breach protocol, built — small body	$4,400
Privacy policy, public complaint procedure and breach protocol, built — standard body	from $6,200
Privacy assessment, one project, programme, system or activity	$1,900
Offshore register and the annual report to the Minister	$1,200
Shared-service package: one assessment for a common or integrated programme or activity	from $5,400
Each additional body sharing one administration	+$850
Each participating body added to a shared-service package	+$600
Complex assessment — new core system, camera deployment, shared service or change of hosting	from $3,100
Amendment of an assessment after a substantial change, s.53(1)(b)	$750
Breach protocol on its own, s.78	$950, or included with a policy build
Revision of anything I wrote, once the s.143 regulations are made	no charge
Assessment retainer — up to four privacy assessments a year, the amendments a substantial change needs, one annual review of the policy, and questions as they arise	$250 / month
Work outside these scopes, hourly	$165
Review of information practices against s.48.1 and Reg. 4.2 — village, rural community or local board	$1,200
Review of information practices — town, city, regional municipality, regional service commission or police force	$1,900
Designated officer under s.48.1(4), the head designation, and the information practices published for the public	$950
Information practices built for a small body: village, rural community, council-appointed board or commission	$3,400
Information practices built for a town, city, regional municipality, regional service commission or police force	from $4,600
Common or integrated service — every shared service inventoried, then the s.46.2 written agreement with the six contents Reg. 4.1 prescribes	from $2,800
Breach registry and procedure under Reg. 4.2(4) — included with a build	$850
Each additional public body sharing the same administration	$650
Each participating body on a shared-service agreement	$650
Bilingual delivery — every deliverable in French and English; a full policy set or shared-service package is quoted on its word count	from $650
Ongoing support — questions as they arise, the periodic test and evaluation Reg. 4.2(3) requires, a new agreement when a shared service is added, and one annual review of the practices	$225 / month
Work outside these scopes, hourly	$165
Access and privacy bylaw checked against the 2020 regulation, one municipality	$850
Bylaw drafted or brought into conformance — rural municipality	$1,900
Bylaw drafted or brought into conformance — town	from $2,600
Coordinator appointment package — the resolution, the role description, the eligibility check and the annual report template	$650
New-council training session — council and staff, with a written record for the annual report	$750
Security arrangements and head designation reviewed — Charlottetown, Summerside, Cornwall or Stratford	from $2,200
Each additional municipality sharing the same administration	$450
Breach response procedure — voluntary, no Act requires one; included with a bylaw drafted	$650
The Coordinator's written annual report to council, prepared in later years	$250
Ongoing support — questions as they arise, the Coordinator's annual report, one bylaw check a year — questions as they arise, the Coordinator's written annual report to council, and one check of the bylaw against the regulation each year	$150 / month
Work outside these scopes, hourly	$165
Breach procedure and reporting pack — the report to the Commissioner, the harm assessment for the individual, and the misdirected-email controls	$850
Collection notices on town forms — every form that takes personal information listed, and the three-line notice drafted for each	$650
Staff session and training record — 45 minutes for the staff who are not the coordinator, with the record and the slides	$900
Head and coordinator designation set — the resolution, the letter advising the minister, and a head named for each town-created entity	$550
ATIPPA duties review — what the office has now against the provisions of ATIPPA, 2015 that bind a town	$1,200
The whole set, done together — the breach procedure, the form notices, the designations and the staff session	from $2,400
Each additional town-created entity or board sharing the same office	$350
A breach handled with you when one happens — containment, the Commissioner's form drafted, the harm assessment written	$450 each
Repeat staff session later in the same year	$450
Ongoing support — a breach handled with you when one happens, questions as they arise, and one annual look at the forms and the procedure	$150 / month
Work outside these scopes, hourly	$165

Direct award, no tender

Manitoba is a New West Partnership party, and its municipalities, school boards and publicly funded bodies came under the agreement's procurement obligations on 1 January 2019. Everything here sits well below the $75,000 services threshold, so a public body may direct-award without a public tender — subject only to the procurement policy every council must adopt under s.251.1 of The Municipal Act.

The schedule is smaller than Alberta's and British Columbia's because The Freedom of Information and Protection of Privacy Act asks for less. It has no privacy management programme and no deadline. Where it does have a hard edge is section 41.1: since 1 January 2022 the head of a public body must notify the affected people and the Manitoba Ombudsman where a breach could reasonably be expected to create a real risk of significant harm, the regulation sets the factors for that decision and nine things the notice has to contain, and wilfully failing to notify is an offence carrying a fine of up to $50,000. That is why the breach kit leads.

What is not owed matters as much. There is no privacy impact assessment requirement in Manitoba — the Ombudsman's own guidance says so in terms — nothing is filed with anyone, and no rule restricts where information is stored. And while a planning district, a watershed district or a police board is a public body in its own right even when the same administrator runs it, a municipal library board or recreation commission is not, so it is never charged as one.

Direct award, with one exception

Ontario is not a New West Partnership party, so the $75,000 line that governs the western provinces does not apply here. A municipality or local board awards this under its own procurement by-law (Municipal Act, 2001 s.270); the trade-agreement ceiling above that is the CFTA threshold of $139,000 for services, in force to 31 December 2027, and everything on this page sits well below it. The exception is a school board: the Broader Public Sector Procurement Directive says consulting services must be competitively procured irrespective of value, so a board cannot direct-award any of this — under $121,200 that means inviting at least three suppliers, and I am glad to be one of the three. Fees are exclusive of 13% HST.

The schedule is built around one date. From 1 January 2027, s.28(3) requires a written assessment before personal information is collected, and lists ten things it must contain. The trigger is every collection, with no harm threshold and no sensitivity test — wider than Alberta's, and at least as wide as British Columbia's. A duty shaped like that is not met by buying assessments one at a time, so the product is the template whose headings are the ten statutory items and the discipline of filling it. The section is written "unless the regulations provide otherwise" and no regulation has been made; if one narrows the duty before January, I will say so here.

Ontario asks for less than Alberta or British Columbia in every other respect, and this page does not pretend otherwise. There is no privacy management programme — s.30(5) is a standard of conduct. There is no privacy officer; s.3 makes the council the head unless it designates one. Nothing is filed: s.28(6) gives an assessment to the Commissioner only on request. There is no written service-provider agreement duty, no data-residency rule and no training interval. And the cyber-security regulation people are being emailed about, O. Reg. 51/26, names school boards, hospitals, colleges and children's aid societies — not municipalities, library boards, police boards or conservation authorities.

Below the line, and two dates already behind you

Québec is not a New West Partnership party, so the $75,000 line that governs the western provinces has no application here — and neither does the old Loi sur les cités et villes rule, whose procurement sections were repealed when the Loi sur les contrats des organismes municipaux (CQLR c C-65.01) came into force on 1 April 2026. Under that Act a contract below $25,000 is subject to no prescribed procedure, so a municipal body may award it de gré à gré, subject to whatever its own règlement sur la gestion contractuelle requires; from $25,000 up to the open-procedure threshold of $139,000 it goes by written invitation. Everything on this schedule for a single body sits below the first line. One thing worth saying before the directeur général finds it: where a body’s total with one supplier reaches $25,000 in a year, each contract of $5,000 or more goes on the list it publishes on its own website by 31 March. Fees are exclusive of GST and QST.

Two of these duties are visible from outside the building, which is why this page does not need to take anyone’s word for the gap. Since 22 September 2023, s.63.3 has required the body’s rules on the governance of personal information to be published on its website: the roles through the life cycle, a complaints process, and a description of the training offered to staff. Since 1 January 2024, s.63.4 and its regulation have required a confidentiality policy in clear and simple language, with fourteen prescribed contents, as soon as personal information is collected by technological means — an online form or a recreation sign-up is enough. Behind those sit two that are not visible: the incident register under s.63.11, which has to exist before anything happens, and s.70.1.

Section 70.1 is the one that catches everybody. Before personal information is communicated outside Québec — or where the body entrusts its collection, use, communication or retention to someone outside Québec — the body must assess the sensitivity, the purpose, the contractual protections and the legal regime of the receiving State, and the transfer must be covered by a written agreement reflecting that assessment. Microsoft 365, an Ontario-hosted permit platform, a payroll service in the United States: all caught. It applies to this practice too, which is based in Alberta. So the engagement is built to run on policies, registers, contracts and redacted samples rather than on personal information, and where that is impossible the contract carries the s.67.2 clauses. The assessment itself stays yours: I supply the facts it needs and I do not sign it, and I am not the responsable — that is the person with the highest authority in the body, or whoever they have delegated in writing.

The date, the threshold, and what is not owed

Everything here except the offshore register is preparation for 1 April 2027, the date written into the new Freedom of Information and Protection of Privacy Act (SNS 2025 c.13, s.171). From that day a privacy assessment is required before any new project, programme, system or activity that collects, uses or discloses personal information (s.53); a privacy policy and a published complaint procedure are required (s.52); and a breach that could cause significant harm goes to the person and to the Commissioner, who will be able to review municipal privacy practice for the first time (ss.78, 100–114). The regulations that will set the form of the policy and the assessment have not been made, so nobody can honestly tell you the exact format today. I build to the words of the Act and revise anything I wrote, free, when the regulations land. That is why these fees sit a little below the British Columbia ones.

Nova Scotia has no New West Partnership threshold. The trade-agreement figure for municipal services is $139,000 under CFTA and the Atlantic Trade and Procurement Partnership (Service Nova Scotia, February 2026), and the Public Procurement Act covers municipalities, municipal water utilities and service commissions. Below that figure your own procurement policy governs, and those ceilings are far lower — around $3,000 before quotations are required, in the policies I have read. Tell me which route yours needs and the quote will be written to fit it.

What is not owed, plainly. Today a municipality owes what Part XX of the Municipal Government Act actually asks — reasonable security under s.483(3), the collection limits in s.483(1), accuracy under s.483(2) where the information is used to make a decision about someone, retention under s.483(4), and the correction right in s.484 — together with the data-residency rules in PIIDPA. What it does not owe is the rest: no privacy impact assessment, no privacy policy, no privacy officer, no privacy management programme, no breach notice, and no privacy oversight of municipalities at all. Even after 1 April 2027 there is still no privacy officer to designate, no programme by that name, nothing filed with the Commissioner, no written service-provider agreement duty, and no assessment required of anything undertaken or instituted on or before 1 April 2027 unless you substantially change it (s.53(3)).

Direct award, no tender

New Brunswick is not a New West Partnership province, so the $75,000 line used out west does not apply here. Local governments and regional service commissions are Schedule B entities under the Procurement Act, and s.58 of the Goods and Services Regulation exempts goods and services below $100,000 from competitive bidding. Every figure on this page sits far under it.

The schedule is smaller than Alberta's and British Columbia's because RTIPPA asks for less. There is no privacy impact assessment, no privacy management programme by that name, and no deadline, so there is nothing to file and no date to meet. What s.48.1 and s.4.2 of the General Regulation have required since 1 April 2018 is a designated officer who makes the body's information practices available to the public, a written list of who may see which personal information with the arrangements tested periodically, and a registry of every actual privacy breach — kept whether or not one has ever happened.

Where a service is shared, whether that is your regional service commission or a joint fire or police arrangement, s.46.2 requires one written agreement containing the six things Reg. 4.1 lists, and s.48.1(4) lets one designated officer serve several public bodies. So the work is priced once and extended per body. Where the Official Languages Act binds you, every deliverable is produced in both languages.

Direct award, no tender

The New West Partnership does not reach Prince Edward Island. The external ceiling here is the Canadian Free Trade Agreement threshold for municipalities, school boards, health and post-secondary bodies — $139,000 for goods and services, from 1 January 2026 to 31 December 2027 — and everything on this schedule sits far below it. The limit that actually decides is your own procurement bylaw under MGA s.169. Worth checking before a quote goes to council.

Fifty-three of the fifty-seven municipalities are not under FOIPP at all. What binds them is the access and privacy bylaw their own council passed under MGA ss.147 and 148, built to a 2020 provincial regulation: council appoints a Coordinator, who may not be a councillor or another municipality's CAO (s.4(2)); that Coordinator trains council and staff and reports to council once a year (s.4(1)(c) and (f)); and the CAO is responsible for reasonable security arrangements (s.17).

There is no privacy management program in Prince Edward Island, no privacy impact assessment for any project, and no mandatory breach reporting. Nothing is filed with anyone, and for the fifty-three the Commissioner has no jurisdiction at all — a complaint goes to an adjudicator your own council appoints and pays for. That is why there is no assessment line on this schedule. If someone quotes you for a program or an assessment here, it is not because the Act asks for one.

Three quotes, not a tender

Newfoundland and Labrador is not a New West Partnership party, so the $75,000 line used in the other three provinces has no application here. A town must issue an open call for bids at $139,000 or more, excluding HST (Public Procurement Regulations, NLR 13/18 s.5(2)(a)). Everything on this schedule sits far below that, but below the threshold s.11 still asks for a limited call for bids: quotations from at least three suppliers, or a written determination that the price is fair and reasonable. Nothing here is a direct award, and a town that takes two other quotes alongside mine is doing exactly what the Regulations ask. One more thing worth knowing before you compare them: below the threshold, s.14(1.1)(b) takes 10% off a provincial supplier's price when bids are evaluated. This practice is based in Alberta and does not get it.

This is the smallest schedule on the site, because the Act asks a town for the least. There is no privacy management programme, no privacy impact assessment, and no written agreement with service providers — s.72 puts the assessment duty on provincial ministers only, and s.64(1) asks for steps that are “reasonable in the circumstances” without requiring anything to be written down. No deadline, no breach register, no personal information bank listing, no data-residency rule, and nothing filed with the Commissioner except a breach report. The statutory review now under way is looking at some of this and reports on or before 31 January 2027; until something is enacted, none of it is a duty.

What the Act does ask is stricter than anywhere else on this page. Under s.64(4) the head tells the Commissioner about every privacy breach, with no harm threshold; the “risk of significant harm” test in s.64(7) decides only whether the person affected is told. The commonest breach in the Commissioner's 2024-25 figures was personal information emailed to the wrong address. The provincial ATIPP Office trains coordinators and publishes a Guide for Towns with a breach protocol at no charge, and the Commissioner's office will talk a town through a breach — so this is worth buying only where a town wants its own procedure, its own forms fixed, and its own record that the staff session happened.

Direct award, no tender

British Columbia is a New West Partnership party, so the same $75,000 threshold applies to a B.C. municipality, school district or regional district. Below it, the body may direct-award without a public tender.

The schedule is shaped differently here for one reason. Under Directions 2-21 an assessment is required for every new initiative, and before every significant change, with no harm or sensitivity threshold to clear first. That is a recurring duty, so it is priced as a retainer rather than as a series of one-off assessments.

For a regional district, s.12(a) of the Regulation asks for a written agreement signed by the head of each participating body. One engagement covers the agreement, the joint assessment and the notification the Commissioner receives under s.69(5.4).

§07 · Method

How I work.

This is an independent practice. I am not a law firm and I do not act through one.

Everything I produce is worked from the primary sources rather than from fact sheets or secondhand summaries: in Alberta, the Protection of Privacy Act, the Access to Information Act, AR 143/2025 and the Commissioner's own template; in British Columbia, FIPPA, its Regulation and the Minister's directions 02/2022 and 2-21; in Québec, the Loi sur l'accès and its regulations, read in French. Every other province is worked the same way, from its own Act and regulations, and §08 links each of them. §04 is what that difference looks like. Each of those seven statements is in circulation in Alberta, and each is wrong in a way a reader working from the Regulation would catch.

The work is aimed at the municipalities least able to absorb it internally: villages, summer villages, small towns, and the shared-administration offices carrying five or seven public bodies between them. In Alberta those offices have the same statutory obligations as Calgary and a fraction of the capacity — and the Regulation, in s.7(3) and s.7(4)(b) and in the proportionality requirement at POPA s.25(2)(a), is considerably more accommodating of that than they are usually told. In British Columbia the same is true of villages, regional districts, and library and police boards: Direction 02/2022 says a programme is to be scaled to the volume and sensitivity of what the body actually holds. Saskatchewan asks for less again — no programme with prescribed contents and no assessment duty at all — so the work there is the duty to protect, the agreements under s.23.2, and saying plainly which of the three it is.

Québec is worked in French. The Act, its regulations and the Commission’s guidance are read in French, the documents are delivered in French, and this page has a French version. The Charter of the French language requires French of the body, so the engagement letter is French, with an English translation attached to be read rather than signed.

One place is deliberately not on that list. In Yukon, the Northwest Territories and Nunavut a municipality is a public body only if the regulations designate it, and none has been designated — the Nunavut government says so on its own page — so there is nothing there to comply with and nothing for me to sell.

I am happy to be checked. Every claim here carries the section it rests on.

§08 · Sources

Privacy compliance for local public bodies, worked from the Act itself.

Ten provinces, and they do not ask for the same things.

One statute became two, and the obligations moved.

When an assessment is actually required.

Test a practice against Alberta's s.7(1).

Seven things in circulation that are wrong.

Four pieces of work, each with a defined output.

Privacy Management Program — review, or built from scratch

PIA screening across a municipality's systems

Joint Privacy Impact Assessment

Single-body Privacy Impact Assessment

Flat, and published.

How I work.

Read them yourself.

Want a read on where your public body actually stands?