Nepean Records Retention and Encryption Bylaw

Overview

This guide explains how municipal records retention and encryption practices apply to Nepean, Ontario residents and staff within the City of Ottawa framework. It summarizes retention schedules, encryption expectations for electronic municipal data, and the offices responsible for recordkeeping and privacy compliance. Where the City publishes specific schedules or privacy guidance, this guide cites those official pages to help you locate forms, complaint routes and technical requirements.^[1]

Records retention

Municipal records are managed according to a corporate records schedule that sets retention periods by record type and legal requirement. Departments must follow the city-approved retention schedule for record disposal, archival, and transfer to corporate archives. For the City of Ottawa records program and retention schedule, see the official records management guidance.^[1]

• Retention periods are set by record class and may vary from months to permanent retention for archival material.
• Records that support decisions, expenditures or legal obligations are retained according to legislative timelines.
• Disposition procedures require authorization and documentation before secure destruction.

Encryption standards

The City requires reasonable administrative, technical and physical safeguards for electronic records and personal information, including encryption for data at rest and in transit where appropriate. Specific technical standards (algorithms, key lengths, approved ciphers) are maintained in corporate IT security policies and standards; public summaries reference that encryption is required but technical details are typically internal to IT policy documents.^[2]

• Use city-managed platforms for storing official records rather than unmanaged third-party services unless approved by IT.
• Encrypt sensitive data in transit (TLS) and employ approved key management for encrypted backups.
• Report suspected encryption or security issues to the corporate IT security contact immediately.

Penalties & Enforcement

Enforcement of records, privacy and information security obligations is undertaken by the City of Ottawa Access and Privacy Office and, where applicable, provincial authorities under MFIPPA (Municipal Freedom of Information and Protection of Privacy Act). Civil or administrative remedies, orders to preserve or disclose records, and court actions can be applied by relevant authorities.^{[2] [3]}

• Fine amounts: not specified on the cited municipal pages; check provincial statute pages for offence provisions and the City for bylaw notices.^[2]
• Escalation: first, repeat and continuing offences lead to progressive enforcement actions; exact ranges are not specified on the public summary pages.^[2]
• Non-monetary sanctions: orders to preserve or produce records, administrative directions, suspension of access privileges, and court applications are possible remedies.
• Enforcer and inspection: Access and Privacy Office (City Clerk) handles privacy/compliance and coordinates investigations; provincial offices enforce MFIPPA where applicable.^[2]
• Appeals and review: decisions under municipal policy can be reviewed internally and appealed through statutory routes under MFIPPA or via court; specific time limits are set by the controlling statute or decision notice and are not specified on the cited municipal summary pages.^[3]

Applications & Forms

Common forms and applications include the Access to Information request form and privacy complaints forms; fees, submission methods and deadlines are published on the City access and privacy pages. If a specific form or fee is required, consult the City of Ottawa access pages for the current form and submission address.^[2]

FAQ

How long does the City keep municipal records?

The retention period depends on the record class and legal obligations; check the City records schedule for the specific class or contact Records Management.

Are municipal emails and documents required to be encrypted?

Sensitive municipal data must be protected and encryption is required where appropriate; consult corporate IT security for technical standards.

How do I report a suspected data breach?

Report breaches immediately to the City IT security contact and the Access and Privacy Office; follow the incident reporting instructions on the City access pages.^[2]

How-To

1. Identify the record class and locate the retention schedule before submitting a request.
2. Submit an Access to Information request or privacy complaint following the City instructions and include specific dates and file identifiers.
3. If you suspect a breach, notify IT security and the Access and Privacy Office immediately and preserve evidence.
4. Pay any published fees for access requests if required and track deadlines for appeals or reviews.

Key Takeaways

• Follow the City records schedule for retention and secure disposal.
• Use city-approved systems and encryption for sensitive municipal data.
• Report breaches and complaints to the Access and Privacy Office and IT security promptly.

Help and Support / Resources

• City of Ottawa - Records Management
• City of Ottawa - Access and Privacy
• City Clerk and Solicitor - Contact
• City of Ottawa - Information Technology

1. [1] City of Ottawa - Records Management
2. [2] City of Ottawa - Access and Privacy
3. [3] Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) - Ontario e-Laws