The Privacy Act gives Canadians the right to access personal information held by the government and protection of that information against unauthorized use and disclosure. This page provides links to the Privacy Act, its policy instruments and tools supporting the administration of the legislation.

Personal information requests, procedures and forms

There are multiple ways to submit a personal information request. Requests should be directed to the institution that has control of the records.

Act and Policy Instruments

• Privacy Act and Privacy Regulations.
• Policy on Privacy Protection – Supports sound privacy management practices, clear responsibilities under the Privacy Act, consistent reporting and identification and mitigation of privacy-related risks.
• Directive on Privacy Impact Assessment – Privacy impact assessments provide a framework for ensuring that privacy is considered throughout the design or re-design of programs or services.
• Directive on Privacy Practices – Provides direction to facilitate the implementation and public reporting of consistent and sound privacy management practices for personal information under the control of government institutions.
• Directive on Privacy Requests and Correction of Personal Information – Provides direction to establish consistent practices and procedures for processing requests for access to or correction of personal information that is under the control of government institutions.
• Directive on Social Insurance Number – Outlines specific restrictions on the collection, use, and disclosure of the social insurance number (SIN) by government institutions and specifies the processes for establishing policy authorization for a new collection or new consistent use of the SIN.
• Standard on Privacy and Web Analytics – Outlines the requirements when using Web analytics in accordance with sound privacy practices that safeguard the privacy of visitors to Government of Canada websites.
• Implementation Reports and Information Notices – Provide guidance on the interpretation and application of the Privacy Act and related policies.

Guidance, Best Practices and Tools

• Privacy Breach Management Toolkit
• Guidance: Confidences of the Queen's Privy Council for Canada (Cabinet confidences) – Guidance on the application of section 70(1) of the Privacy Act.
• Guidance: Guidelines for Privacy Breaches – Guidelines focusing primarily on the improper or unauthorized access to or disclosure of personal information as defined in the Privacy Act.
• Guidance: Info Source: Decentralized Publishing Requirements – Instructions for institutions that self-publishing their Info Source chapters.
• Guidance: Taking Privacy into Account Before Making Contracting Decisions – Provides advice to federal government institutions whenever they consider contracting out activities in which personal information about Canadians is handled or accessed by private sector agencies under contract.
• Guidance: Preparing Information Sharing Agreements Involving Personal Information – Provides advice in the consideration and development of information sharing agreements involving personal information shared with other governments within Canada and across international borders.
  
  
• Best Practices: Delegation under the Privacy Act – Fact Sheet and examples of delegation orders for institutions subject to the Privacy Act.
• Best Practices: Sample Privacy Notice for Government of Canada Institutions – Summarizes the privacy practices for a government institution's online activities.
  
  
• Tools: Privacy Breach Management Toolkit
• Tools: Access to Information and Privacy Glossary – Definitions of commonly used access to information and privacy terms.
• Tools: Standard on Privacy and Web Analytics: Frequently Asked Questions – Answers to commonly asked questions about the use of Web analytics tools within government institutions.
• Tools: Form for the Statistical Report on the Privacy Act.

Reports

• Info Source: Access to Information Act and Privacy Act Bulletins - Summaries of federal court case decisions and statistics relating to the number of requests made under the Access to Information Act and the Privacy Act.
• Web Analytics Privacy Impact Assessment Report – The Privacy Impact Assessment Report determines if there are privacy risks associated with the use of Web analytics, and if so, to provide recommendations on the mitigation or elimination of those risks.

Links of Interest

• Info Source assists individuals exercise their rights under the Access to Information Act and the Privacy Act, and also supports the federal government's commitment to facilitating access to information regarding its activities.
• Office of the Privacy Commissioner of Canada – Independently oversees public sector compliance with the Privacy Act.