Ontario’s Freedom of Information and Protection of Privacy Act (FIPPA) is undergoing changes in 2025, with key updates already in effect as of January 1, 2025 and more coming into force on July 1, 2025 as part of Bill 194, the Strengthening Cyber Security and Building Trust in the Public Sector Act.

The most notable change? Starting July 1, privacy impact assessments (PIAs) will become mandatory for all collection of personal information. This applies to any new system, program or activity — or any changes to existing ones — in which personal information is collected.

While PIAs have long been an integral part of information security risk management at the university, especially for projects involving Level 3 or 4 data, these updates make them a legal requirement.

Additionally, FIPPA now specifically requires that any risk prevention or mitigation measures identified in a PIA are implemented before collecting personal information — or, if that’s not feasible, within a reasonable time afterward.

These changes reflect a broader push to strengthen cyber security and privacy protections across Ontario’s public sector.

Please ensure a PIA is completed before any new collection of personal information takes place within any new system, program or activity, or when there is any change to an existing purpose, use or scope of personal information. Remember, PIAs take time to complete, so be sure to build them into your project timelines.

The university’s Freedom of Information and Protection of Privacy Office and the Information Security team are here to support you.

• Questions about personal information collection or FIPPA?
  Contact the U of T FIPP Office at privacy@utoronto.ca
• Need help with a PIA?
  Access institutional support through the Information Security team.
• Looking for more details?
  Visit the FAQ page for answers to common questions.