Cybersecurity for Canadian Schools and Universities

Ontario's Freedom of Information and Protection of Privacy Act (FIPPA) governs provincial universities and colleges, while the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) governs district school boards and public school authorities. Both statutes are administered by the Information and Privacy Commissioner of Ontario, who has investigative and order-making powers. Public institutions under FIPPA and MFIPPA do not fall under PIPEDA for activities in the course of their statutory mandate — but PIPEDA applies to private schools, private career colleges, and some university commercial activities. The practical effect is that a public school board experiencing a student data breach must notify the IPC under Ontario's mandatory breach reporting framework, while a private school experiencing the same breach reports to the federal OPC.

British Columbia's Freedom of Information and Protection of Privacy Act imposes similar obligations on BC public bodies, including school districts and universities. The BC OIPC has been notably active in investigating education sector breaches, including cases where districts shared student data with third-party software vendors without adequate contractual safeguards. This is a recurring compliance gap: schools deploy edtech platforms — learning management systems, student response tools, assessment platforms — often without conducting a privacy impact assessment or ensuring the vendor's data processing agreement meets FIPPA requirements. The BC OIPC's investigation into district use of US-hosted platforms has established that transferring BC student data to a US cloud provider without proper contractual controls is a FIPPA violation regardless of the vendor's privacy marketing claims.

When a Canadian educational institution reports a breach to its applicable privacy commissioner, the notification must include: a description of the circumstances of the breach, the date or period when it occurred, the personal information involved, the estimated number of individuals affected, what steps have been taken to contain the breach, and whether affected individuals have been notified. Commissioners can require additional information, conduct audits, and issue orders mandating remediation. The OPC has published specific guidance for the education sector emphasizing that student data minimization — collecting only what is necessary for the educational purpose — is both a legal requirement and a practical risk-reduction measure. Schools that maintain historical student records well past any operational need create liability with no corresponding benefit.

Post-secondary institutions conducting research that involves personal data face a dual framework: they are bound by their provincial FIPPA for institutional data handling, but research involving human participants is also governed by the Tri-Council Policy Statement (TCPS 2), which requires research ethics board approval and data management plans for sensitive data. Where the research involves personal health information, Ontario's Personal Health Information Protection Act (PHIPA) may also apply, requiring a separate set of breach notification and safeguard obligations. Institutions that receive federal grants through NSERC, SSHRC, or CIHR are subject to the Tri-Agency Research Data Management Policy, which mandates data management plans and has implications for how long personal data can be retained and when it must be destroyed.