The Ontario Privacy Commissioner (IPC): What It Covers and How to Complain

The Ontario privacy commissioner, formally the Information and Privacy Commissioner of Ontario (IPC), is the independent body that oversees Ontario’s public-sector privacy and access to information laws and PHIPA, the province’s health information privacy law. You can complain to the IPC if a provincial ministry, municipality, police service, school board, hospital or health care provider has mishandled your personal information, or appeal if an institution refused your request for records. Private businesses in Ontario are usually covered by the federal law, PIPEDA, so complaints about them go to the Office of the Privacy Commissioner of Canada (OPC) instead.

This guide is general information, not legal advice. If you’re dealing with harassment or threats that involve your personal information, put your safety first and see our help resources.

What the Ontario privacy commissioner oversees

The IPC is an officer of the Ontario legislature, independent of the government of the day. Its main job is to oversee a set of Ontario laws:

Law	Who it covers
Freedom of Information and Protection of Privacy Act (FIPPA)	Provincial institutions, such as ministries, many provincial agencies, universities, colleges and hospitals.
Municipal Freedom of Information and Protection of Privacy Act (MFIPPA)	Municipal institutions, such as cities and towns, municipal police services, school boards and transit authorities.
Personal Health Information Protection Act (PHIPA)	Health information custodians, such as doctors, hospitals, pharmacies, labs and clinics, whether publicly funded or private.
Child, Youth and Family Services Act (the part on personal information)	Children’s aid societies and other service providers in the child and family services sector.

FIPPA and MFIPPA do two things: they give you a right to request access to records held by public institutions, and they set rules on how those institutions collect, use, disclose and protect personal information. PHIPA gives similar rights and rules for personal health information.

When the federal commissioner applies instead

Ontario doesn’t have its own general privacy law for private businesses. For most private-sector organizations in Ontario, such as retailers, banks, telecom companies, apps and online platforms, the federal law, PIPEDA, applies. Complaints about how they handle your information go to the Office of the Privacy Commissioner of Canada.

The main exception is health information. A private health care provider, such as a family doctor, dentist or physiotherapy clinic in Ontario, is generally covered by PHIPA for your health information, so the IPC is the right regulator. Our guide to PIPEDA explains the federal rules and how to complain to the OPC.

A quick way to tell:

• A government body, police service, school board, hospital or university? Usually the IPC.
• A health care provider handling your health information? Usually the IPC, under PHIPA.
• A private business, website or app? Usually the OPC, under PIPEDA.
• A federal government department? The OPC, under the federal Privacy Act.

If you’re unsure, the IPC’s website explains its jurisdiction, and it can tell you if a complaint belongs elsewhere.

What you can complain or appeal about

There are two main routes to the IPC, and they work differently.

Privacy complaints

You can complain if you believe an institution or health information custodian has collected, used, disclosed, stored or disposed of your personal information in a way the law doesn’t allow. Examples include a city employee sharing your details without authority, a hospital staff member looking at your records without a reason, or a school board publishing information it shouldn’t have.

Access appeals

If you asked a public institution for records, including your own personal information, and it refused, released only part, didn’t respond on time, or charged a fee you disagree with, you can appeal to the IPC. You can also ask for correction of your personal information and appeal if the institution refuses. Under PHIPA, you can complain if a health care provider won’t give you access to your health records or won’t correct them.

How to make a complaint, step by step

1. Raise it with the organization first. Contact the institution’s freedom of information and privacy coordinator, or the health care provider’s privacy contact. Explain what happened and what you want. Many issues are resolved at this stage, and the IPC may expect you to have tried.
2. Keep records. Save your emails, letters, request numbers, decision letters and dates. For a privacy complaint, note what information was involved and how you found out.
3. Check you have the right regulator. Use the list above. If the organization is a private business, go to the OPC instead.
4. Act promptly. Access appeals have a short deadline after the institution’s decision, and complaints generally need to be made within a reasonable time. The IPC’s website sets out current time limits, and there may be a small fee for some access appeals.
5. File with the IPC. Use the forms on the IPC’s official website. Describe what happened, which organization was involved, what you’ve done to resolve it, and what outcome you’re looking for. Attach copies of key documents.
6. Take part in the process. The IPC typically tries early resolution or mediation first. If that doesn’t work, a case may move to investigation or adjudication, which can end with a decision or order.

Timelines depend on the complexity of the case and how quickly the parties respond. Keep your contact details up to date and reply to requests from the IPC promptly.

A worked example

This is an illustrative scenario, not a real client. Aisha, who lives in Ottawa, learns that a staff member at her local hospital, who knows her ex-partner, looked at her health records without any role in her care. She’s worried about what may have been shared.

1. She contacts the hospital’s privacy office, explains her concern and asks for an audit of who accessed her records.
2. The hospital confirms an unauthorized access and tells her what steps it’s taking.
3. She isn’t satisfied with the response, so she files a complaint with the IPC under PHIPA, attaching the hospital’s letter and her notes.
4. Because her ex-partner may now know more about her, she also makes a safety plan with a local support service and tightens her privacy settings online.
5. The IPC reviews how the hospital handled the incident and whether its safeguards were adequate.

The IPC couldn’t undo what had been seen, but the complaint made the hospital account for the access and review its safeguards.

Getting your information out of search results

People sometimes contact the IPC hoping it can remove information about them from Google or a private website. That’s usually outside what it does. If a public body published your information and shouldn’t have, the IPC can help with that institution. For content on private sites, the right route is usually the site itself, the search engine’s own removal tools, or legal advice.

Our guides on removing personal information from Google and making a data access request explain those routes. If harmful results keep appearing for your name, our content removal team can tell you honestly what can and can’t be taken down.

Common mistakes to avoid

• Complaining to the IPC about a private business. Most private businesses fall under PIPEDA and the OPC. Health care providers are the main exception.
• Missing the appeal deadline. Access appeals have a short window. Check the time limit on the IPC’s website as soon as you get a decision.
• Skipping the organization. Contacting the coordinator or privacy officer first often resolves things faster and strengthens your complaint if it doesn’t.
• Sending vague complaints. Name the organization, the information involved, what happened and when, and what you want done.
• Expecting compensation. The IPC can order changes but doesn’t award damages. A lawyer can advise on a civil claim.

When to get help

Talk to a lawyer if you want compensation, if the privacy breach has caused you serious harm, or if the matter involves employment, family law or a criminal case. If the breach has left you at risk, for example because someone who is harassing you may now have your address, focus on safety first. Our guides on online harassment and cyberstalking explain practical steps.

Frequently asked questions

What does the Ontario privacy commissioner do?

The Information and Privacy Commissioner of Ontario oversees Ontario’s public-sector access and privacy laws, FIPPA and MFIPPA, and its health privacy law, PHIPA. It handles privacy complaints and access appeals, mediates disputes, and can make orders in many cases.

Can I complain to the Ontario IPC about a private company?

Usually not. Most private businesses in Ontario fall under the federal PIPEDA, so complaints go to the Office of the Privacy Commissioner of Canada. The main exception is health information held by health care providers, which the IPC oversees under PHIPA.

How do I file a complaint with the IPC?

First raise the issue with the organization’s privacy or freedom of information contact. If that doesn’t resolve it, file a complaint or appeal using the forms on the IPC’s official website, with copies of your key documents, within the time limits it sets out.

Is there a fee to complain to the IPC?

Privacy complaints are generally free. Some access appeals carry a small fee. Check the IPC’s website for the current rules before you file.

Can the IPC award compensation?

No. The IPC can investigate, mediate and make orders, such as requiring records to be released or practices to change, but it doesn’t award damages. Talk to a lawyer if you want to seek compensation.