Nepean Privacy Impact Assessments for Third Parties

In Nepean, Ontario (within the City of Ottawa jurisdiction), third parties that collect, access or manage personal information on behalf of the municipality must follow the City of Ottawa's privacy practices and provincial rules on information protection. This guide explains when a Privacy Impact Assessment (PIA) is required for third-party contracts, which City office enforces the rules, how to document risk controls, and practical next steps for compliance. Refer to the City's official PIA guidance for required steps and templates City of Ottawa PIA guidance^[1] and provincial guidance from the Information and Privacy Commissioner of Ontario for MFIPPA expectations IPC PIA guidance^[2].

When a PIA is required

Third parties and vendors should prepare a PIA when a project or service will:

• Collect new categories of personal information on behalf of the municipality.
• Significantly change how personal information is accessed, stored, transmitted or disclosed.
• Use cloud or externally hosted solutions to handle municipal personal information.
• Integrate third-party systems with municipal IT infrastructures where personal data flows are created.

A PIA assesses privacy risks, documents controls, and supports contract clauses on data handling, retention and breach notification. If a PIA template or intake process is required, use the City of Ottawa's Access and Privacy guidance pages for the current template and submission instructions City of Ottawa PIA guidance^[1]. If a specific template name or filing fee is not listed on that page, it is not specified on the cited page.

Penalties & Enforcement

The City of Ottawa's Access and Privacy Office oversees compliance with municipal privacy procedures and coordination with provincial enforcement under the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). For provincial orders and oversight, the Information and Privacy Commissioner of Ontario provides guidance on PIAs and enforcement approaches IPC PIA guidance^[2].

• Fine amounts: not specified on the cited municipal pages; provincial remedies and any monetary penalties are detailed on IPC or statute pages where applicable.
• Escalation: first and repeat/continuing offences are handled through administrative orders and corrective directions; specific fine ranges are not specified on the cited municipal pages.
• Non-monetary sanctions: orders to change practices, mandatory audits, court enforcement, and corrective directions by the IPC or municipal directions.
• Enforcer and complaints: City of Ottawa Access and Privacy Office handles municipal complaints; provincial appeals and orders flow through the IPC (see Help and Support / Resources below).
• Appeals and review: appeals of IPC orders or parties' requests for review follow IPC procedures; time limits for appeals are set by statute or IPC rules and may be listed on IPC pages (if not listed on the municipal page, they are not specified on the cited municipal page).

Applications & Forms

The City publishes PIA guidance and intake instructions on its official privacy pages; some projects require submission of a city PIA form or template as part of procurement or contract onboarding. Specific form names, fee amounts, and formal submission deadlines are not specified on the cited municipal page when absent, so check the City of Ottawa PIA guidance and contact the Access and Privacy Office for current templates and submission routes City of Ottawa PIA guidance^[1].

How to comply - practical steps

1. At project start, confirm whether the scope involves municipal personal information and whether a PIA is required.
2. Gather data flow diagrams, data inventories and retention schedules that will accompany the PIA submission.
3. Complete the City's PIA template or documentation request and submit to the Access and Privacy Office as instructed on the City PIA guidance page.
4. Implement technical and contractual controls (encryption, access limits, breach notification clauses) identified in the PIA.
5. Respond to any follow-up queries from the Access and Privacy Office and retain PIA records for audits and procurement closeout.

FAQ

Do third-party vendors need to complete a PIA for City projects?

Yes — when the vendor will collect, access or manage municipal personal information a PIA is generally required; confirm via the City of Ottawa PIA guidance pages.

Who enforces PIA compliance and how do I file a complaint?

The City of Ottawa Access and Privacy Office manages municipal compliance; the Information and Privacy Commissioner of Ontario handles provincial oversight under MFIPPA.

Are there fees to file a PIA?

Fees for filing a PIA are not specified on the City page; contact the Access and Privacy Office for current procedures.

How-To

1. Identify data processing activities that involve municipal personal information.
2. Collect required documentation: data inventory, purposes, retention and third-party subcontractor details.
3. Complete the PIA template or form provided by the City and submit to the Access and Privacy Office.
4. Apply recommended technical and contractual mitigations and record them in the PIA response.
5. Keep records and update the PIA when scope, systems or data flows change.

Key Takeaways

• Start the PIA early in procurement to avoid contract delays.
• Document technical and contractual controls clearly in the PIA.
• Contact the City of Ottawa Access and Privacy Office for templates and submission instructions.

Help and Support / Resources

• City of Ottawa - Access and Privacy contact
• City of Ottawa - Procurement
• Municipal Freedom of Information and Protection of Privacy Act (MFIPPA)
• City of Ottawa - Privacy and access information

1. [1] City of Ottawa PIA guidance and intake
2. [2] Information and Privacy Commissioner of Ontario - PIA guidance