Bill 97 isn't just changing privacy obligations. It's bringing a longstanding data management problem into focus for many organizations.
Ontario's Bill 97 received Royal Assent on April 24, 2026. If you operate a municipality, hospital, school board, university, or Crown agency, the clock is already ticking. Royal Assent means these changes are now law, not proposed and not pending.
This means obligations under Freedom of Information and Protection of Privacy Act (FIPPA) and Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) are being rewritten whether you’re ready or not.
That's not much runway, and waiting isn’t a strategy. In this piece, we cover what's changing under Bill 97, the records management gaps that put organizations at risk, and how to build the foundation for compliance. All without replacing your existing systems or disrupting how your team works.
Bill 97, the Plan to Protect Ontario Act (Budget Measures), 2026 is an omnibus budget bill that modernizes Ontario's Freedom of Information (FOI) and privacy legislation. For public sector organizations, it introduces new mandatory obligations around records management, privacy impact assessments, and breach reporting.
This Bill brings FIPPA and MFIPPA closer in line with each other and with modern expectations around public institutions handling personal information. Organizations that rush to compliance last minute will pay for it in staff hours, risk exposure, and reputational cost.
The good news: organizations with a solid records management strategy are already well positioned. For those that aren't, now is the time to act. Here's what the changes mean and how to prepare.
Bill 97 applies to organizations covered by Ontario's FIPPA and MFIPPA, including:
If your organization is responsible for responding to Freedom of Information (FOI) requests or manages public records, Bill 97 applies to you. The changes below affect how you handle information requests, records management, and response timelines.
Bill 97 introduces significant changes to Ontario’s approach to access information and personal data protection. Organizations must follow new requirements, including:
These new requirements come at a time when governance and compliance risks are already under increased scrutiny. Gartner's 2026 Audit Plan survey of 160 chief audit executives found 97% plan to audit regulatory compliance in 2026. Cybersecurity and data governance follow at 96% and 94%. Bill 97 touches all three.
In a 2025 McKinsey survey of 193 risk and compliance leaders, 42% of risk teams said their use of risk and compliance software needs improvement. Bill 97 adds new obligations that are hard to meet without the right tools.
|
Obligation
|
Without Strong Governance |
With Strong Governance |
|
FOI Response |
Manual searches, missed records, late responses |
Fast, scoped retrieval across connected systems |
|
PIA Requirements |
No visibility into what personal data exists or where |
Automated PII identification across all systems |
|
Breach Reporting |
Inconsistent records, delayed reporting, IPC exposure |
Accurate breach documentation ready for reporting |
|
Safeguard Obligations |
Hard to demonstrate, mostly manual |
Technical controls enforced automatically |
|
Retention and Disposal |
Data accumulates indefinitely, ROT files never addressed |
Automated identification and defensible deletion |
|
Revised FOI Response Timelines |
More time means nothing without organized records responses are still late and incomplete |
Fast, complete, and defensible within 45 business days |
|
Staged Access Plans |
No structure to respond in phases, plans rejected or appealed |
Clear record categorization with documented schedules |
|
Ministerial Record Exclusions |
Unclear boundaries lead to over-disclosure or disputes |
Defined custody controls with clear scope of exclusions |
|
IPC Audits & Orders |
Scrambling to produce evidence of compliance |
Governance documentation ready for review at any time |
|
Staff Training |
Inconsistent awareness of new obligations |
Standardized training aligned to Bill 97 requirements |
If your organization sits under "Without Strong Governance, " now is the time to act.
For many organizations, Bill 97 compliance risk stems from one of four underlying records management challenges:
Systems often label documents with different names or just fail to label them at all. This creates a governance framework gap. Classification inconsistency means search results are unreliable, retention policies don’t apply uniformly, and FOI responses are incomplete. Consistent classification across every repository is the foundation of compliant information management.
ROT data accumulates silently across file shares, SharePoint and email archives. Under Bill 97, retaining personal information longer than necessary is a liability, not just a storage cost. Without automated retention enforcement, disposal stays manual, inconsistent, and defensible to no one.
From January 1, 2027, anyone with reasonable grounds can confidentially report a suspected MFIPPA contravention to the IPC. When the IPC reviews a complaint, you need to show what records you hold and how you manage them. Without a full inventory and audit trail, that response becomes a scramble.
Effective municipal records management solutions share a few critical capabilities, especially for organizations navigating Bill 97's expanded requirements. Here's what to look for when evaluating your options:
Any solution worth considering should scan all your repositories automatically, identifying personal information, sensitive records, and applying metadata without manual intervention. Classification that relies on human review doesn't scale. Look for tools that work continuously with high accuracy, directly supporting your PIA obligations and breach recordkeeping requirements under Bill 97.
To learn more about automated classification and governance, see our blog What Is Automated Content Identification?
A strong solution should automatically identify redundant, obsolete, and trivial (ROT) data files. This reduces your breach risk by shrinking your attack surface and directly supports your document destruction obligations under Bill 97.
Bill 97 allows institutions to respond to complex FOI requests with a staged access plan, but that plan needs to be scoped and documented quickly. Look for a solution that can report on what records exist and where across every repository, so your FOI team isn't doing a manual inventory every time.
Bill 97 makes key municipal records management practices legal duties: privacy impact assessments, safeguards, breach reporting and Commissioner reviews. You can no longer treat records management as an IT problem or a back-office project. It must be embedded in how your organization operates.
The organizations that handle Bill 97 most confidently are the ones that see beyond compliance. Implementing best practices doesn’t just reduce risk, it changes how your organization operates.
|
Faster, complete FOI responses |
Intelligent search and consistent classification mean your team finds exactly what's needed, not everything that might be relevant |
|
Reduced legal and regulatory risk |
PII is identified, access is controlled, and retention policies are enforced automatically |
|
Lower storage and infrastructure costs |
Information lifecycle management removes data you no longer need to keep |
|
Stronger internal trust and adoption |
When staff trust the results they get from their systems, governance adoption accelerates |
|
Audit-ready breach documentation |
When a breach occurs, you have the records to report it accurately and on time |
|
Reduced IPC complaints and appeals |
Organized records and clear decision-making reduce the disputes that escalate to formal IPC appeals |
|
Defensible staged access plans |
Documented record categorization and schedules satisfy Bill 97's new staged access requirements |
|
Student and patient data protection |
PII specific to school boards and hospitals is identified, classified, and access-controlled automatically |
A meticulous records management approach helps organizations meet access and privacy obligations while reducing risk, controlling costs, and improving confidence in their information.
Compliance programs don't get built overnight.
FIPPA amendments start on July 1, 2026. This is the first wave of changes: new timelines calculated in business days, expanded extension powers, and new rules around staged access to records. These directly affect how provincial institutions process FOI requests and manage personal information.
MFIPPA access changes started July 1, 2026, alongside FIPPA. Municipalities now work with 45 business days, staged access plans, second extensions and new fee estimate rules. MFIPPA privacy amendments follow on January 1, 2027. These add mandatory privacy impact assessments, breach reporting to the IPC and Commissioner-initiated reviews.
Bill 97 is not a policy exercise. It's a data infrastructure challenge.
That difference determines whether Bill 97 becomes a crisis or a manageable obligation.
Every compliance gap covered here: unclassified PII, inconsistent retention, incomplete FOI responses, traces back to one root cause: ungoverned information.
Fixing that foundation doesn't require replacing your existing systems or disrupting how your team works. It requires the right tool applied consistently across every repository you manage.
Increase visibility across systems with Shinydocs to identify records past retention and support defensible disposition, the groundwork Bill 97 compliance runs on.
Ready to see how Shinydocs can prepare your organization for Bill 97?
📅 Book some time with us and we'll show you exactly what your current content landscape looks like and what it takes to get it compliance-ready.
Topics: Risk Management, Information Governance, Data Insights, Data Management, Data Strategy, Data enrichment AI, AI document tagging
shinydocs.com · info@shinydocs.com