Approx. 10-min read

Bill 97 isn't just changing privacy obligations. It's bringing a longstanding data management problem into focus for many organizations. 

Ontario's Bill 97 received Royal Assent on April 24, 2026. If you operate a municipality, hospital, school board, university, or Crown agency, the clock is already ticking. Royal assets mean these changes are now law, not proposed and not pending.

This means obligations under Freedom of Information and Protection of Privacy Act (FIPPA) and Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) are being rewritten whether you’re ready or not.

That's not much runway, and waiting isn’t a strategy. In this piece, we cover what's changing under Bill 97, the information governance gaps that put organizations at risk, and how to build the foundation for compliance. All without replacing your existing systems or disrupting how your team works.

What is Bill 97? 

Bill 97, the Plan to Protect Ontario Act (Budget Measures), 2026 is an omnibus budget bill that modernizes Ontario's Freedom of Information (FOI) and privacy legislation. For public sector organizations, it introduces new mandatory obligations around records management, privacy impact assessments, and breach of reporting.

This Bill brings FIPPA and MFIPPA closer in line with each other and with modern expectations around public institutions handling personal information. Organizations that rush to compliance last minute will pay for it in staff hours, risk exposure, and reputational cost.

The good news: organizations with strong information governance practices are already well positioned. For those that aren't, now is the time to act. Here's what the changes mean and how to prepare.

Who does Bill 97 Apply to?  

Bill 97 applies to organizations covered by Ontario's FIPPA and MFIPPA, including:

• Provincial ministries and government agencies
• Boards, commissions and Crown agencies
• Municipalities and municipal service boards
• Police services and public libraries
• School boards, universities and colleges
• Conservation authorities
• Healthcare organizations

If your organization is responsible for responding to Freedom of Information (FOI) requests or manages public records, Bill 97 applies to you. The changes below affect how you handle information requests, records management, and response timelines.

What Bill 97 Changed in FIPPA and MFIPPA

Bill 97 introduces significant changes to Ontario’s approach to access information and personal data protection. Organizations must follow new requirements, including:

• Privacy Impact Assessments (PIAs) are required before collecting personal information through a new program, service, or system.
• Privacy breaches that pose a real risk of significant harm must be reported to both the Information and Privacy Commissioner (IPC) and affected individuals.
• Breach recordkeeping requires institutions to maintain records of privacy breaches and report breach statistics annually.
• Extended FOI response timelines move from 30 calendar days to 45 business days, along with updated rules for managing large or complex requests.
• Safeguard obligations require organizations to demonstrate that reasonable administrative, technical, and physical safeguards are in place to protect personal information.
• Ministerial Record Exclusions removes records held by ministers and their officers from the scope of FIPPA entirely, a change that took effect retroactively to 1988.

These new requirements come at a time when governance and compliance risks are already under increased scrutiny. Gartner has identified cybersecurity, data governance, and regulatory compliance as top risk areas as top 2026 audit risks. These are the same areas significantly impacted by Bill 97.

Additionally, McKinsey's 2025 analysis has found that manual compliance processes fulfill only a fraction of actual obligations. Bill 97 raises the stakes by introducing new requirements that many organizations are not equipped to manage manually.

Here's what that gap looks like in practice:

If your organization sits under "Without Strong Governance, " now is the time to act.

4 Information Governance Risks Threatening Bill 97 Compliance 

 For many organizations, Bill 97 compliance risk stems from one of three underlying information governance challenges:

1. No Visibility Into Personal Information

2. No Consistent Classification Across Systems

Systems often label documents with different names or just fail to label them at all. This creates a governance framework gap. Classification inconsistency means search results are unreliable, retention policies don’t apply uniformly, and ATIP responses are incomplete. Consistent classification across every repository is the foundation of compliant information management.

3. No Automated Retention and Disposal

ROT data accumulates silently across file shares, SharePoint and email archives. Under Bill 97, retaining personal information longer than necessary is a liability, not just a storage cost. Without automated retention enforcement, disposal stays manual, inconsistent, and defensible to no one.

4. Whistleblower Complaints

Bill 97 raises the stakes around accountability in how public institutions handle personal information. That pressure can come from within your organization. Without a secure, documented channel for staff to raise privacy concerns internally, complaints are more likely to go directly to the Information and Privacy Commissioner or surface publicly. A formal whistleblower process isn't just good governance; it's a risk management necessity.

Capabilities Required for Bill 97 Compliance

Effective information governance solutions share a few critical capabilities, especially for organizations navigating Bill 97's expanded requirements. Here's what to look for when evaluating your options:

1. Automated Document Classification at Scale

Any solution worth considering should scan all your repositories automatically, identifying personal information, sensitive records, and applying metadata without manual intervention. Classification that relies on human review doesn't scale. Look for tools that work continuously with high accuracy, directly supporting your PIA obligations and breach recordkeeping requirements under Bill 97.

To learn more about automated classification and governance, see our blog What Is Automated Content Identification?

2. Private AI Means Your Data Stays in Your Environment

3. Enterprise Search That Finds Everything

4. Automated Retention and Disposal

A strong solution should automatically identify redundant, obsolete, and trivial (ROT) data files. This reduces your breach risk by shrinking your attack surface and directly supports your document destruction obligations under Bill 97.

5. Minimal Disruption to Existing Workflows

6. Staged Access Plan Report

Bill 97 allows institutions to respond to complex FOI requests with a staged access plan, but that plan needs to be scoped and documented quickly. Look for a solution that can report on what records exist and where across every repository, so your ATIP team isn't doing a manual inventory every time.

Information Governance Is Now a Legal Requirement and a Competitive Advantage

Bill 97 makes information governance a legal statutory obligation, with real consequences for Ontario public institutions. You can no longer treat records management as an IT problem or a back-office project. It must be embedded in how your organization operates.

The organizations that handle Bill 97 most confidently are the ones that see beyond compliance. Strong information governance doesn’t just reduce risk, it changes how your organization operates.

What a Governed Information Estate Means for Your Organization

Strong information governance helps organizations meet ATIP and FOI obligations while reducing risk, controlling costs, and improving confidence in their information.

Key Deadlines to Note for Bill 97

Compliance programs don't get built overnight.

FIPPA amendments start on July 1, 2026. This is the first wave of changes: new timelines calculated in business days, expanded extension powers, and new rules around staged access to records. These directly affect how provincial institutions process FOI requests and manage personal information.

MFIPPA amendments follow January 1, 2027. Municipalities and other MFIPPA covered institutions get a longer runway, but the scope of the change is significant. The changes include mandatory privacy impact assessments, breach of reporting requirements to the Information and Privacy Commissioner, and new provisions for Commissioner-initiated reviews of your institution’s information practices.

• April 24, 2026: Bill 97 received Royal Assent. All amendments are now law. The compliance clock is running for every FIPPA and MFIPPA institution regardless of when your specific obligations take effect.
• July 1, 2026: FIPPA amendments come into force. Provincial institutions must now respond to FOI requests within revised business-day timelines, manage staged access plans, and apply the new extension rules to every active and incoming request.
• September 15, 2026: Additional FIPPA provisions take effect, including data integration requirements and updated data standards governing how personal information is collected, linked, and disposed of.

The Core Insight: Bill 97 Is a Data Management Problem

Bill 97 is not a policy exercise. It's a data infrastructure challenge.

Without strong information governance, your organization faces:

• Incomplete ATIP / FOI responses and missed deadlines
• Breach reporting failures from inconsistent records
• Regulatory exposure from unclassified personal information
• Compounding ROT data that grows the risk surface every day

With, your organization receives:

• Precise, defensible FOI responses within the new timelines
• Enforceable safeguards that satisfy Bill 97's explicit requirements
• Measurable reduction in data risk and storage cost 
  
  

That difference determines whether Bill 97 becomes a crisis or a manageable obligation.

Prepare Your Organization for Bill 97

Every compliance gap covered here: unclassified PII, inconsistent retention, incomplete ATIP responses, traces back to one root cause: ungoverned information.

Fixing that foundation doesn't require replacing your existing systems or disrupting how your team works. It requires the right tool applied consistently across every repository you manage.

Shinydocs scans and classifies information across every connected repository, enforcing retention schedules and surfacing PII, the groundwork Bill 97 compliance runs on.

Ready to see how Shinydocs can prepare your organization for Bill 97?
📅 Book a demo call today and we'll show you exactly what your current content landscape looks like and what it takes to get it compliance-ready. 

Topics: AI, Dark Data, GDPR, Risk Management, Information Governance, Data Governance, Unstructured Data, Data Insights, Data Management, Data Strategy, data enrichment AI, AI document tagging, Shadow Copies

                                              shinydocs.com  ·  info@shinydocs.com