ATIP/Privacy

Home

Community

Access to Information

Privacy

Digital Services

Reporting

Judy Booth Award

FR

Privacy

Please note that some sections are still under review. For more information or if you wish to report a broken link, please email OCIO-APCDO-BDPI-BPCAP@tbs-sct.gc.ca. Thank you.

The purpose of this GCwiki site is to support the privacy community in the administration of the Privacy Act by offering reference documents and information related to privacy protection for federal institutions. The site is managed by the Privacy and Responsible Data Division (PRDD) within the Office of the Chief Information Officer of Canada at Treasury Board Secretariat. For inquiries, please contact ippd-dpiprp@tbs-sct.gc.ca.

👁 Tools & References

Legislation

• Privacy Act

Regulations

• Privacy Act Heads of Government Institutions Designation Order (SI/83-114)
• Privacy Regulations (SOR/83-508)

Policies

• Policy on Privacy Protection

Directives and Standards

• Directive on Privacy Practices (NEW Standard on Privacy Impact Assessment)
• Directive on Personal Information Requests and Correction of Personal Information
• Directive on Social Insurance Number

Guidance

• The Digital Privacy Playbook

• Personal Information Request (PIR) Manual
• Taking Privacy into Account Before Making Contracting Decisions
• Preparing Information Sharing Agreements Involving Personal Information
• Delegation under the Access to Information Act and the Privacy Act
• Privacy Act: Plain Language Guide to Exemptions and Exclusions

Implementation Notices

• Access to Information and Privacy Notice 2020-01: Guidance on delays resulting from measures to mitigate the impact of novel Coronavirus (COVID-19) on federal workplace
• Access to Information and Privacy Notice 2022-01: Seeking an Exception to a Requirement of the TBS Access to Information or Privacy Policy Suite
• Access to Information and Privacy Notice 2023-01: Advancing Reconciliation with Indigenous Peoples by Providing Culturally Appropriate Services
• Access to Information and Privacy Notice 2024-01: Upholding privacy and safety of public servants
• Privacy Implementation Notice 2020-01: Collecting and disclosing employees’ personal information related to the novel Coronavirus (COVID-19) pandemic
• Privacy Implementation Notice 2020-02: Definition of Personal Information – Ministerial Staff
• Privacy Implementation Notice 2020-03: Protecting privacy when releasing information about a small number of individuals
• Privacy Implementation Notice 2021-01: Privacy Requirements for Official Social Media Accounts
• Privacy Implementation Notice 2022-01: Cyber security incidents involving personal information
• Privacy Implementation Notice 2022-02: Identity Verification for Personal Information Requests
• Privacy Implementation Notice 2022-03: Requests for Accommodation
• Privacy Implementation Notice 2023-01: De-identification
• Privacy Implementation Notice 2023-02: Personal information for program monitoring, evaluation and reporting purposes
• Privacy Implementation Notice 2023-03: Guidance pertaining to the collection, use, retention and disclosure of personal information that is publicly available online
• Privacy Implementation Notice 2024-01: Digital Advertising
• Privacy Implementation Notice 2024-02: Use of the Office of the Privacy Commissioner’s Online Breach Reporting Form
• Privacy Implementation Notice 2024-03: Personal information management in internal audit
• Privacy Implementation Notice 2025-01: Personal information management in workplace harassment and violence occurrences
• Privacy Implementation Notice 2025-02: Use of the Office of the Privacy Commissioner’s Privacy Impact Assessment Online Form
• Privacy Implementation Notice 2025-03: Guidance pertaining to drones

Other relevant Policies and Directives

• Policy on Government Security
• Directive on Security Management
• Policy on Service and Digital
• Directive on Service and Digital

Toolkit

• Impacts of Bill C-20 on time limits set out in the ATIA and the Privacy Act
  • Bill C-20 - Model Letters
  • Bill C-20 - Qs & As
• Universal Access Readiness Checklist
• Info Sheet- Protecting Personal Information When Teleworking
• Model letter - cannot confirm identity
• The privacy breach management toolkit
• PIB Procedures Document
• Training ATIP 101 Template EN

Privacy Breach Awareness Materials

• Customizable Privacy Breach Awareness Presentation
• Customizable Privacy Breach Awareness Message for Employees

Infographics

• Infographic - Privacy Breaches
• Infographic - Access controls
• Infographic - Limit System Access
• Infographic - Open text boxes
• Digital Standard - 5