What Privacy Laws Apply in Ontario?

If you run a business or handle personal data in Ontario, it’s important to understand which privacy laws apply to you. Ontario doesn’t have one single privacy law that covers everything. Instead, a patchwork of laws apply depending on your sector and the kind of information you’re dealing with.

This can be confusing, which is why many organisations are putting privacy training at the forefrnt of their compliance efforts. Not just to tick a legal box, but to build real trust with employees, clients, and the public.

Here’s a breakdown of the key privacy laws you should know.

1. PHIPA – For Health Information
   The Personal Health Information Protection Act (PHIPA) applies to hospitals, clinics, pharmacies, and anyone handling health records. It sets out how health data can be collected, stored, and shared. Whether you’re a major hospital or a single-location dental practice, PHIPA applies.

2. FIPPA and MFIPPA – For Government and Local Bodies
   The Freedom of Information and Protection of Privacy Act (FIPPA) applies to Ontario ministries, universities, and public agencies. The Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) covers local institutions like school boards, cities, and police services. These laws not only allow individuals to request records, they also set strict rules around how personal data must be handled.

3. PIPEDA – For Private Businesses
   Most private-sector organisations in Ontario fall under the federal Personal Information Protection and Electronic Documents Act (PIPEDA). It covers any personal information collected during commercial activities. Ontario doesn’t have its own private-sector privacy law, so PIPEDA fills that gap.

   🥭Mango Moment
   We’ve seen businesses assume they’re too small for privacy laws to apply. One Ontario retailer collecting customer emails for online orders didn’t realise PIPEDA applied until a customer asked to have their data deleted. The business scrambled to figure out what their obligations were. With a bit of basic training, they could have handled the request confidently and avoided the stress.

4. Privacy Act (Canada)
   If your organisation interacts with federal government bodies (like Service Canada or the CRA) the federal Privacy Act applies. This law governs how those institutions collect and use personal information.

5. Education and Employment Laws
   Privacy rules also show up in other laws. The Education Act includes requirements for protecting student records, and the Employment Standards Act sets out rules for employee data like hours worked and wages paid.

6. Other Sector-Specific Laws

   • The Child, Youth and Family Services Act governs data sharing related to children in care
   • The Public Hospitals Act and the Long-Term Care Homes Act contain rules around patient and resident records
   • The Consumer Reporting Act regulates how credit reporting agencies handle personal data
   • The Securities Act applies to investment firms and client information
   • The Occupational Health and Safety Act touches on incident reporting and worker safety records

7. CASL Still Applies
   CASL, Canada’s anti-spam law, is often overlooked but absolutely applies in Ontario. If you send commercial emails or texts, you need permission, a clear sender name, and a working unsubscribe link. CASL isn’t just about marketing, it’s about respectful use of personal contact information.

Need to Train Your Team?
MangoHR’s privacy training makes it easy to get your team up to speed on Ontario and federal privacy laws. Our short, practical videos walk employees through real scenarios they actually deal with. Each team member is automatically enrolled in modules that match their industry and location, with tracking and certificates built in.

Start with a free trial or contact us for a walkthrough. Privacy compliance doesn’t need to be complicated and expensive!