Bill 97 Compliance for Ontario Institutions
Bill 97 brings every digital record into FOI scope. Mandatory privacy duties reach Ontario municipalities on January 1, 2027. Shinydocs helps your team find, classify, and govern records where they live.
Key Bill 97 dates
- ✓July 1, 2026New FOI rules for FIPPA and MFIPPA institutions
- ✓September 15, 2026FIPPA data integration changes
- ✓January 1, 2027MFIPPA privacy duties take effect
Bill 97 explained
What Is Bill 97?
Bill 97, the Plan to Protect Ontario Act (Budget Measures), 2026, amends Ontario’s public sector access and privacy laws. It changes how FIPPA and MFIPPA institutions handle freedom of information requests. It also gives municipal institutions new privacy duties, starting January 1, 2027.
Shinydocs is automated information governance software that helps Ontario institutions meet Bill 97 obligations without migrating files. It searches, classifies, and governs records across file shares, SharePoint, Teams, and email. Provincial institutions follow FIPPA. Municipalities, school boards, and other local institutions follow MFIPPA, where the biggest changes land.
What changes
What Changes Under Bill 97?
Bill 97 changes the rules on both access and privacy. Access changes took effect July 1, 2026, for FIPPA and MFIPPA institutions. Municipal privacy duties begin January 1, 2027. Each change assumes your team knows what records it holds, where they live, and how long they are kept.
-
45 Business Days to Respond
FOI response time moved from 30 calendar days to 45 business days. A second extension is allowed only in set circumstances.
-
Every Digital Record Is in Scope
The definition of a record now covers data in any form, including records stored digitally. Every repository can hold responsive records.
-
Staged Access Plans for Large Requests
Institutions can release records in stages. Each plan must categorize the responsive records and name the areas to be searched.
-
Fee Estimates on a Timeline
Fee estimates over $25 must go out within set timelines. The response clock pauses until the fee is paid or waived.
-
Privacy Impact Assessments for Municipalities
From January 1, 2027, MFIPPA institutions must complete a written PIA before collecting personal information. Each PIA states how long that information is kept.
-
Breach Reporting and IPC Reviews
Municipal institutions must report breaches that meet the real risk of significant harm threshold. The IPC can also review information practices and make binding orders.
How Shinydocs helps
How Shinydocs Supports Bill 97 Compliance
Shinydocs supports Bill 97 compliance by showing your team what records it holds and where they live. It searches every connected system, flags personal information, and enforces retention schedules in place. Your staff stay in control and make every decision. Shinydocs gives them the visibility those decisions depend on.
| Bill 97 Requirement | How Shinydocs Supports It |
|---|---|
| Every digital record in FOI scope | Federated search covers file shares, SharePoint, Teams, OneDrive, and Exchange email from one place. Nothing moves. |
| Staged access plans and second extensions | Search results show how many responsive records exist and where they sit. Your plans and estimates start from real numbers. |
| Fee estimates within set timelines | Scope requests quickly by searching every system at once, not one repository at a time. |
| Privacy impact assessments with retention periods | Retention schedules apply to files where they live, so the period in your PIA matches what actually happens. |
| Breach assessment against the RROSH threshold | AI classification flags personal information across repositories. Your team knows what sensitive content an affected system held. |
| IPC review of information practices | Defensible disposition runs with a full audit trail. Nothing is deleted without your approval. |
Legislation reviewed: October 2026
Municipal results
- Saved in year oneCounty of Newell
- $408K
- Documents governedCounty of Newell
- 98%
- Hours saved annuallyCounty of Newell
- 10K+
- Storage reducedDunedin City Council
- 35%
- ROIOn governed content
- 4.5×
Ontario case study
Ontario Proof: Town of Milton
Milton is one of the fastest-growing municipalities in Canada. Its staff wanted a better way to organize and safeguard content, without a disruptive migration.
Shinydocs cleaned, classified, and prepared over 4 million files to meet records management legislation. Staff now find the files they need faster. Read the Town of Milton case study.
Town of Milton results
-
4M+ Files Governed
Cleaned, classified, and prepared to meet records management legislation.
-
Zero Files Migrated
Milton improved records management without moving a single file.
-
Faster File Access
Staff find the files they need faster and more easily.
In their words
What Municipal Leaders Say
“Shinydocs is helping us meet our records management goals faster and without creating disruption.”
“Shinydocs has done what years of dedicated service capacity could not — provide records management to County documents across all unmanaged repositories through automation, visibility, and improved search capabilities.”
“With Shinydocs, we established a new way of work which allows our users to instantly find any information, across any system. Shinydocs has simplified our users’ lives, made onboarding new staff more efficient, and helped improve compliance and information accuracy.”
Compliance resources
Official Bill 97 Resources
These official sources set out Bill 97 obligations for Ontario institutions. The Information and Privacy Commissioner of Ontario oversees FIPPA and MFIPPA compliance. The statutes themselves sit on Ontario’s e-Laws site. Check them directly for current requirements, guidance, and in-force dates.
Where to Find Bill 97 Requirements
| Official Source | What It Covers |
|---|---|
| Bill 97, Legislative Assembly of Ontario | The bill as passed, including Schedule 7 (FIPPA) and Schedule 11 (MFIPPA). |
| IPC Updates on Obligations for Provincial and Municipal Institutions | Every Bill 97 change and its in-force date, for FIPPA and MFIPPA institutions. |
| Freedom of Information and Protection of Privacy Act | The statute for provincial institutions, including ministries, hospitals, colleges, and universities. |
| Municipal Freedom of Information and Protection of Privacy Act | The statute for municipalities, school boards, and other local institutions. |
| IPC Privacy Impact Assessment Guide | How to complete a PIA under FIPPA and MFIPPA. |
| IPC Privacy Breach Guidelines | How to assess, report, and notify privacy breaches. |
Legislation reviewed: October 2026
Ontario Vendor of Record: Tender #18914
Ontario ministries and broader public sector bodies, including municipalities, can engage Shinydocs without an RFP. The arrangement runs from May 1, 2025, to April 2028.
FAQ
