The PIA Exchange is a GO

Three weeks ago, I posted an invitation for Ontario public sector institutions to participate in a Privacy Impact Assessment (PIA) Exchange — an initiative designed to help privacy professionals learn from one another by sharing real-world PIA examples.

I’m happy to report that the PIA Exchange is officially moving ahead.

A number of institutions have already confirmed that they will be contributing PIAs, and I’m very grateful to those organizations for stepping forward.

There is still room for additional participants, and the exchange will only become more valuable as more institutions take part.

Institutions that wish to participate can still join by submitting one or more PIAs by March 27, 2026.

Why a PIA Exchange?

With Bill 194 now requiring Privacy Impact Assessments for Ontario’s provincial institutions, and PIAs becoming increasingly common across the broader public sector, many organizations are preparing these assessments for the first time.

In conversations with FOI and privacy professionals, one theme comes up repeatedly: it can be difficult to know where to start.

While IPCO guidance and internal templates can be helpful, it is often extremely valuable to see real-world examples of how other institutions have approached similar privacy analyses.

The goal of the PIA Exchange is to give participating institutions access to:

• Examples of how PIAs are structured across different institutions
• Approaches to identifying and mitigating privacy risks
• Sample language used in real-world PIAs
• A better sense of how Ontario public sector organizations are approaching privacy impact assessments

How the Exchange Works

The exchange operates on a simple “contribute to participate” model.

Participating institutions will:

• Submit between one and three completed PIAs
• Remove or redact personal or confidential information as necessary
• Receive access to the full set of PIAs contributed by other participating institutions

Redactions can be handled much like preparing records for disclosure under an FOI request — removing personal, confidential, or operationally sensitive details while preserving the structure and analysis of the PIA.

There is no cost to participate, and participation is open to all Ontario provincial and municipal institutions under FIPPA and MFIPPA.

Once the submission deadline passes, I will compile the contributed PIAs and share the exchange package with participating institutions.

Deadline to Participate

The deadline to participate in the exchange is: March 27, 2026

Institutions wishing to participate should submit 1 to 3 PIAs by that date.

Even a single PIA can make a valuable contribution to the exchange.

Interested in Participating?

If your institution would like to take part in the PIA Exchange, please feel free to get in touch.

Ontario’s public institutions are doing thoughtful and important privacy work. Sharing that work with one another can help strengthen privacy practice across the sector and make the PIA process easier for everyone involved.

I encourage you to take part, and I look forward to hearing from you.