Privacy impact assessments

The Freedom of Information and Protection of Privacy Act requires that a Privacy Impact Assessment (PIA) be conducted for any new initiative for which there has not been one previously conducted, or if there has been a significant change to an existing initiative.

“Initiative” refers to a program or activity that involves the collection, use, or disclosure of personal information, but does not include the collection, use, or disclosure of personal information for research conducted by a faculty member, teaching assistant, or research assistant.

If the initiative does not involve the management of personal information then only Part One of the template must be completed.

If the initiative involves the storage of sensitive personal information outside of Canada, the General Counsel or their delegate will use the information in the PIA to determine whether to proceed with the initiative based on a risk assessment.

The PIA must be signed by the Administrative Authority responsible for the initiative, after considering the recommendations of the Chief Privacy Officer and Information Security Office, as applicable.

Contact for assistance completing a PIA.