Key Takeaways
- Bill 97 became law on April 24, 2026, rewriting FIPPA and MFIPPA with new privacy and reporting obligations.
- FOI changes under FIPPA and MFIPPA took effect July 1, 2026. MFIPPA privacy duties start January 1, 2027.
- Weak governance leaves you exposed through unclassified data, inconsistent retention, and no visibility into personal information.
- You need automated classification, private AI, and enterprise search to find records fast and prove compliance.
- A strong records management strategy turns Bill 97 from a compliance burden into a real competitive advantage.
Bill 97 isn't just changing privacy obligations. It's bringing a longstanding data management problem into focus for many organizations.
Ontario's Bill 97 received Royal Assent on April 24, 2026. If you operate a municipality, hospital, school board, university, or Crown agency, the clock is already ticking. Royal Assent means these changes are now law, not proposed and not pending.
This means obligations under Freedom of Information and Protection of Privacy Act (FIPPA) and Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) are being rewritten whether you’re ready or not.
That's not much runway, and waiting isn’t a strategy. In this piece, we cover what's changing under Bill 97, the records management gaps that put organizations at risk, and how to build the foundation for compliance. All without replacing your existing systems or disrupting how your team works.
What is Bill 97?
Bill 97, the Plan to Protect Ontario Act (Budget Measures), 2026 is an omnibus budget bill that modernizes Ontario's Freedom of Information (FOI) and privacy legislation. For public sector organizations, it introduces new mandatory obligations around records management, privacy impact assessments, and breach reporting.
This Bill brings FIPPA and MFIPPA closer in line with each other and with modern expectations around public institutions handling personal information. Organizations that rush to compliance last minute will pay for it in staff hours, risk exposure, and reputational cost.
The good news: organizations with a solid records management strategy are already well positioned. For those that aren't, now is the time to act. Here's what the changes mean and how to prepare.
Who does Bill 97 Apply to?
Bill 97 applies to organizations covered by Ontario's FIPPA and MFIPPA, including:
- Provincial ministries and government agencies
- Boards, commissions and Crown agencies
- Municipalities and municipal service boards
- Police services and public libraries
- School boards, universities and colleges
- Conservation authorities
- Healthcare organizations
If your organization is responsible for responding to Freedom of Information (FOI) requests or manages public records, Bill 97 applies to you. The changes below affect how you handle information requests, records management, and response timelines.
What Bill 97 Changed in FIPPA and MFIPPA
Bill 97 introduces significant changes to Ontario’s approach to access information and personal data protection. Organizations must follow new requirements, including:
- Privacy Impact Assessments (PIAs) must now precede any collection of personal information, with updates before any significant change in use.
- Privacy breaches that pose a real risk of significant harm must be reported to both the Information and Privacy Commissioner (IPC) and affected individuals.
- Breach recordkeeping requires institutions to maintain records of privacy breaches and report breach statistics annually.
- Extended FOI response timelines move from 30 calendar days to 45 business days, along with updated rules for managing large or complex requests.
- Safeguard obligations require organizations to demonstrate that reasonable administrative, technical, and physical safeguards are in place to protect personal information.
- Ministerial Record Exclusions remove records held by ministers and their offices from FIPPA entirely. The change applies retroactively to January 1, 1988.
These new requirements come at a time when governance and compliance risks are already under increased scrutiny. Gartner's 2026 Audit Plan survey of 160 chief audit executives found 97% plan to audit regulatory compliance in 2026. Cybersecurity and data governance follow at 96% and 94%. Bill 97 touches all three.
In a 2025 McKinsey survey of 193 risk and compliance leaders, 42% of risk teams said their use of risk and compliance software needs improvement. Bill 97 adds new obligations that are hard to meet without the right tools.
What That Gap Looks Like in Practice
|
Obligation
|
Without Strong Governance |
With Strong Governance |
|
FOI Response |
Manual searches, missed records, late responses |
Fast, scoped retrieval across connected systems |
|
PIA Requirements |
No visibility into what personal data exists or where |
Automated PII identification across all systems |
|
Breach Reporting |
Inconsistent records, delayed reporting, IPC exposure |
Accurate breach documentation ready for reporting |
|
Safeguard Obligations |
Hard to demonstrate, mostly manual |
Technical controls enforced automatically |
|
Retention and Disposal |
Data accumulates indefinitely, ROT files never addressed |
Automated identification and defensible deletion |
|
Revised FOI Response Timelines |
More time means nothing without organized records responses are still late and incomplete |
Fast, complete, and defensible within 45 business days |
|
Staged Access Plans |
No structure to respond in phases, plans rejected or appealed |
Clear record categorization with documented schedules |
|
Ministerial Record Exclusions |
Unclear boundaries lead to over-disclosure or disputes |
Defined custody controls with clear scope of exclusions |
|
IPC Audits & Orders |
Scrambling to produce evidence of compliance |
Governance documentation ready for review at any time |
|
Staff Training |
Inconsistent awareness of new obligations |
Standardized training aligned to Bill 97 requirements |
If your organization sits under "Without Strong Governance, " now is the time to act.
4 Records Management Risks Threatening Bill 97 Compliance
For many organizations, Bill 97 compliance risk stems from one of four underlying records management challenges:
1. No Visibility Into Personal Information
You can’t protect what you can’t find. Many organizations struggle with unclassified repositories and have no reliable way to identify where PII lives. This makes PIA compliance and breach reporting difficult to execute accurately. Under Bill 97, organizations are expected to understand what information they collect, store, and manage.2. No Consistent Classification Across Systems
Systems often label documents with different names or just fail to label them at all. This creates a governance framework gap. Classification inconsistency means search results are unreliable, retention policies don’t apply uniformly, and FOI responses are incomplete. Consistent classification across every repository is the foundation of compliant information management.
3. No Automated Retention and Disposal
ROT data accumulates silently across file shares, SharePoint and email archives. Under Bill 97, retaining personal information longer than necessary is a liability, not just a storage cost. Without automated retention enforcement, disposal stays manual, inconsistent, and defensible to no one.
4. IPC Complaints and Reviews
From January 1, 2027, anyone with reasonable grounds can confidentially report a suspected MFIPPA contravention to the IPC. When the IPC reviews a complaint, you need to show what records you hold and how you manage them. Without a full inventory and audit trail, that response becomes a scramble.
Records Management Capabilities for Bill 97 Compliance
Effective municipal records management solutions share a few critical capabilities, especially for organizations navigating Bill 97's expanded requirements. Here's what to look for when evaluating your options:
1. Automated Document Classification at Scale
Any solution worth considering should scan all your repositories automatically, identifying personal information, sensitive records, and applying metadata without manual intervention. Classification that relies on human review doesn't scale. Look for tools that work continuously with high accuracy, directly supporting your PIA obligations and breach recordkeeping requirements under Bill 97.
To learn more about automated classification and governance, see our blog What Is Automated Content Identification?
2. Private AI Means Your Data Stays in Your Environment
Data sovereignty is a priority for Ontario public sector organizations. Any AI-powered tool you consider should run entirely within your own environment and not send data to an external cloud provider. This isn't just an IT preference, it directly aligns with Bill 97's explicit safeguard obligations. The right solution gives you the power of AI without introducing new privacy risk.3. Enterprise Search That Finds Everything
When an FOI request arrives, your team needs to locate the right records quickly and completely. Look for an intelligent search that lets staff query all connected systems in plain language and not navigate complex folder structures. Under Bill 97, incomplete responses aren't just a process problem; they're a legal liability.4. Automated Retention and Disposal
A strong solution should automatically identify redundant, obsolete, and trivial (ROT) data files. This reduces your breach risk by shrinking your attack surface and directly supports your document destruction obligations under Bill 97.
5. Minimal Disruption to Existing Workflows
If your team has to change how they work, governance adoption will stall. Look for tools that run quietly across your environment, classifying content in the background while staff keep working as normal.6. Staged Access Plan Report
Bill 97 allows institutions to respond to complex FOI requests with a staged access plan, but that plan needs to be scoped and documented quickly. Look for a solution that can report on what records exist and where across every repository, so your FOI team isn't doing a manual inventory every time.
Records Management Best Practices Are a Legal Requirement
Bill 97 makes key municipal records management practices legal duties: privacy impact assessments, safeguards, breach reporting and Commissioner reviews. You can no longer treat records management as an IT problem or a back-office project. It must be embedded in how your organization operates.
The organizations that handle Bill 97 most confidently are the ones that see beyond compliance. Implementing best practices doesn’t just reduce risk, it changes how your organization operates.
What a Governed Content Estate Means for Your Organization
|
Faster, complete FOI responses |
Intelligent search and consistent classification mean your team finds exactly what's needed, not everything that might be relevant |
|
Reduced legal and regulatory risk |
PII is identified, access is controlled, and retention policies are enforced automatically |
|
Lower storage and infrastructure costs |
Information lifecycle management removes data you no longer need to keep |
|
Stronger internal trust and adoption |
When staff trust the results they get from their systems, governance adoption accelerates |
|
Audit-ready breach documentation |
When a breach occurs, you have the records to report it accurately and on time |
|
Reduced IPC complaints and appeals |
Organized records and clear decision-making reduce the disputes that escalate to formal IPC appeals |
|
Defensible staged access plans |
Documented record categorization and schedules satisfy Bill 97's new staged access requirements |
|
Student and patient data protection |
PII specific to school boards and hospitals is identified, classified, and access-controlled automatically |
A meticulous records management approach helps organizations meet access and privacy obligations while reducing risk, controlling costs, and improving confidence in their information.
Key Deadlines to Note for Bill 97
Compliance programs don't get built overnight.
FIPPA amendments start on July 1, 2026. This is the first wave of changes: new timelines calculated in business days, expanded extension powers, and new rules around staged access to records. These directly affect how provincial institutions process FOI requests and manage personal information.
MFIPPA access changes started July 1, 2026, alongside FIPPA. Municipalities now work with 45 business days, staged access plans, second extensions and new fee estimate rules. MFIPPA privacy amendments follow on January 1, 2027. These add mandatory privacy impact assessments, breach reporting to the IPC and Commissioner-initiated reviews.
- April 24, 2026: Bill 97 received Royal Assent. All amendments are now law. The compliance clock is running for every FIPPA and MFIPPA institution regardless of when your specific obligations take effect.
- July 1, 2026: FOI amendments come into force under FIPPA and MFIPPA. Provincial and municipal institutions now use business-day timelines, staged access plans and new extension rules.
- September 15, 2026: Additional FIPPA provisions take effect, including data integration requirements and updated data standards governing how personal information is collected, linked, and disposed of.
The Core Insight: Bill 97 Is a Data Management Problem
Bill 97 is not a policy exercise. It's a data infrastructure challenge.
Without strong records management, your organization faces:
- Incomplete FOI responses and missed deadlines
- Breach reporting failures from inconsistent records
- Regulatory exposure from unclassified personal information
- Compounding ROT data that grows the risk surface every day
A solid records management strategy provides your organization with:
- Precise, defensible FOI responses within the new timelines
- Enforceable safeguards that satisfy Bill 97's explicit requirements
- Less data risk and lower storage costs
That difference determines whether Bill 97 becomes a crisis or a manageable obligation.
Prepare Your Organization for Bill 97
Every compliance gap covered here: unclassified PII, inconsistent retention, incomplete FOI responses, traces back to one root cause: ungoverned information.
Fixing that foundation doesn't require replacing your existing systems or disrupting how your team works. It requires the right tool applied consistently across every repository you manage.
Increase visibility across systems with Shinydocs to identify records past retention and support defensible disposition, the groundwork Bill 97 compliance runs on.
Ready to see how Shinydocs can prepare your organization for Bill 97?
📅 Book some time with us and we'll show you exactly what your current content landscape looks like and what it takes to get it compliance-ready.
Topics: Risk Management, Information Governance, Data Insights, Data Management, Data Strategy, Data enrichment AI, AI document tagging
shinydocs.com · info@shinydocs.com
