Privacy Impact Reports 2025 to 2026 - ESDC

On this page

April

Old Age Security (OAS) Release 2 and Release 3: Programme Supported by Social Security Agreement and OAS Domestic Eligibility and Entitlement Rules

Description

The Benefits Delivery Modernization (BDM) Programme is transforming how the Government of Canada delivers benefits, such as Old Age Security (OAS), Employment Insurance (EI), and Canada Pension Plan (CPP). Canadians will find it easier to apply for benefits with a new online system and improved technology that helps protect their information and reduce fraud, errors and delays.

The OAS program is the first to use the new technology platform. Improvements to the OAS program began in the first release of the BDM initiative by moving the International Operations Foreign Benefits and Liaison work to the new system. In Releases 2 and 3, more OAS benefits were added to this upgraded system, making the process more efficient and accessible for Canadians.

Release 2 focused on OAS benefits that are part of an international agreement with other countries, while Release 3 deals with OAS for individuals living in Canada. This PIA is mainly about OAS Release 2 and Release 3, building on OAS Release 1 Foreign Benefits and Liaisons PIA completed in May 2023, to create a complete PIA for OAS on BDM.

Why a privacy impact assessment was completed

Service delivery modernization for OAS aims to transform the program’s processes, tools, and systems. Because this transformation will result in a substantial modification to the administration of OAS benefits, a PIA is required as per the Treasury Board Secretariat’s (TBS) Directive on Privacy Practices.

Additional information

The PIA identified six (6) privacy risks and five (5) compliance issues.

Risk 1: Accountability for information sharing

Action: The OAS Program will ensure ISAs are reviewed every four years and will ensure they reflect recommendations from the ESDC Audit of ISAs (2025).

Completed: June 2025

Risks 2, 3 and 4: Technical safeguards

Action: The OAS Program will continue to work with the Innovation, Information and Technology Branch (IITB) to assess, implement and test security controls for the OAS Solution and ensure the protection of personal information.

Planned completion: December 2027

Risk 5: Administrative safeguards

Action: The OAS Program will implement frequent training and recurring tabletop exercises to support timely response in the event of a security or privacy incident.

Completion: March 2025

Risk 6: Audit log monitoring

Action: The OAS Program will ensure implementation of proactive audit log monitoring.

Completed: January 2025

Issues 1, 2 and 4: Privacy notice

Action: The OAS Program will ensure all forms include a compliant privacy notice.

Planned completion: December 2025

Issues 3 and 5: Personal information bank

Action: The OAS Program will update ESDC PPU 116 to describe all personal information collected and used.

Completed: May 2025

Related personal information banks

For more information about this privacy impact assessment

ESDC Access to Information and Privacy (ATIP) Coordinator

Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal

Phase 3 of the Canadian Dental Care Plan (CDCP)

Description

The Canadian Dental Care Plan provides dental care coverage for uninsured Canadians with an annual family income of less than $90,000, with no co-pays for those with family incomes under $70,000.

The first two phases of the CDCP were assessed in two previously completed PIAs. Phase 3 of the CDCP (the focus of this PIA) launched in March 2025, with the annual renewal of the eligibility process. This was followed in May 2025 by the onboarding of the remaining eligible population. This next cohort includes individuals between 18 to 64 years of age.

ESDC/Service Canada plays a lead role as a service delivery partner, providing services required for the administration of the CDCP.

Why a privacy impact assessment was completed

Privacy Management Division helped complete this PIA to identify the privacy risks associated with Phase 3 of the Canadian Dental Care Plan as the personal information involved is part of an administrative process.

The assessment examines the privacy risks and strategies related to the management and protection of personal information collected and used by Phase 3 of the Canadian Dental Care Plan.

Additional information

This PIA focused on the implementation of Phase 3 of the Canadian Dental Care Plan.

The PIA identified no new risks nor compliance issues. However, some of the privacy risks identified in the previous two PIAs also apply to Phase 3 of the Canadian Dental Care Plan. The strategies to mitigate these outstanding risks are scheduled for completion by December 2025.

Related personal information banks

For more information about this privacy impact assessment

ESDC Access to Information and Privacy (ATIP) Coordinator

Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal

May

Canada Disability Benefit (CDB)

Description

The Canada Disability Benefit provides income support for persons with disabilities who qualify for the Canada Revenue Agency’s (CRA) Disability Tax Credit (DTC).

Why a privacy impact assessment was completed

Provide an outline of the reason for completing the privacy impact assessment:

Privacy Management Division helped complete this PIA to identify the privacy risks associated with the Canada Disability Benefit as the personal information involved is part of an administrative process. The PIA is required by the Treasury Board Secretariat (TBS) Directive on Privacy Practices.

The assessment examines the privacy risks and strategies related to the management and protection of personal information collected and used by the Canada Disability Benefit.

Additional information

The PIA identified four (4) medium-level privacy risks and one compliance issue. The strategies to mitigate these outstanding risks are scheduled for completion by December 2026.

Risk 1: Absence of automated deletion of information

Action: The CDB team will work with the internal IT Security to implement automated deletion of information for all CDB systems prior to the launch of the CDB.

Completion by: December 2026

Risk 2: Absence of procedures for the correction of personal information

Action: The CDB team will work to develop procedures for handling personal information correction requests.

Completion by: April 2025

Risk 3: Lack of processes for reviewing access audit logs

Action: The CDB team will collaborate with the internal security to develop, prior to the CDB launch, a comprehensive audit log review process, which also outlines the frequency of reviews.

Completion by: December 2025

Risk 4: Incomplete IT security assessment

Action: The CDB team will work with internal IT security to complete an IT security assessment as soon as possible.

Completion by: November 2025

Related personal information banks

A personal information bank and the related class of records have been developed. However, they are pending approval from the Treasury Board Secretariat that is required prior to publishing.

For more information about this privacy impact assessment

ESDC Access to information and Privacy (ATIP) Coordinator

Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal

eNotification on My Service Canada Account (MSCA)

Description

Starting in June 2025, there will be a mandatory requirement for all MSCA users to provide their email address (if new client) or opt in with their existing email address (if existing client) for the purpose of receiving security alert notifications. This is not optional.

In addition, all MSCA users, existing and new will be asked when signing in to MSCA or registering to MSCA if they would like to receive program-related eNotifications for Program communications that will reside in the MSCA Messaging Center. Program communications and notification preferences will always reside in the MSCA Messaging Center however clients are required to expressly opt-in to this new MSCA service if they wish to receive a notification that they have mail.

Why a privacy impact assessment was completed

Email address collection represents a significant change in the use of personal information, to allow an individual receive security alerts and notifications from the ESDC programs if they opt-in.

Accordingly, under Appendix C - Standard on Privacy Impact Assessment of the Treasury Board Secretariat’s Directive on Privacy Practices, a PIA is required to be conducted when there is a new use of personal information in a decision-making process when there is a substantial modification to the use of personal information for an administrative purpose (C.2.2.9.2).

Additional information

The PIA identified three (3) privacy risks and one (1) compliance issue.

Risk 1: Accountability

Action: The Program is working with other stakeholders to identify and document the roles and responsibilities to ensure accountabilities are established.

Planned completion: June 2026

Risk 2: Retention and Disposition

Action: The Program is working with ESDC Information Management to define retention and disposition processes applicable to the personal information in the MSCA database.

Planned completion: 2026/2027

Risk 3: Safeguarding

Action: Completion of the applicable security assessments prior to project launch.

Completed: Summer 2025

Issue 1: Personal information bank

Action: Update to MSCA ESDC PPU 680.

Planned completion: Updates were submitted to TBS together with the PIA; the PIB will be updated by in Info Source by TBS.

Related personal information banks

For more information about this privacy impact assessment

ESDC Access to Information and Privacy (ATIP) Coordinator

Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal

Outreach Tracking Tool for Community Outreach and Liaison

Description

The Outreach Tracking Tool (OTT) is a solution driven by an immediate business need. With the introduction of the Canadian Dental Care Plan (CDCP), additional business intelligence and reporting is required that the existing set of separate tracking and reporting solutions cannot support. The OTT will address business intelligence gaps by consolidating all of the Community Outreach and Liaison Service (COLS) program’s distinct tracking and reporting mechanisms into one solution. The OTT will be hosted on the existing eServiceCanada platform.

Why a privacy analysis for IT solutions (PAITS) was completed

Privacy Management Division helped complete this PAITS to identify the privacy risks associated with the Outreach Tracking Tool as the personal information involved is part of an administrative process. This privacy assessment is required per the Treasury Board Secretariat (TBS) Directive on Privacy Practices.

The assessment examines the privacy risks and strategies related to the management and protection of personal information collected and used by the Outreach Tracking Tool.

Additional information

The PAITS identified two (2) low and one (1) medium risk. There were no compliance issues.

Risk 1 (Low): Insufficient retention period

Action: The OTT team will consult with ESDC Information Management to develop an official Disposition Authority (DA) and retention periods for the collection of the personal information stored in the OTT. In addition, the team will develop processes for timely disposition of records when they have reached their established retention requirement.

Completion by: May 2026

Risk 2 (Medium): Insufficient access safeguards

Action: The OTT team will examine the possibility of implementing segregated access to data entries in the OTT. This will ensure compliance with the “Need-to-Know” principle.

Completion by: The OTT team chose to accept this risk as they believe the personal information involved is minimal. Therefore, they chose not to mitigate this risk.

Risk 3 (Low): Absence of data access audit log and accompanying audit log review procedure

Action: The OTT team will continue to determine the feasibility of implementing an audit log with an accompanying audit log review procedure to detect and deter unauthorized access to client information.

Completion by: The OTT team chose to accept this risk as they believe the personal information is minimal. Therefore, they chose not to mitigate the risk.

Related personal information banks

  • Outreach Activities (Standard PIB) – PSU 938

For more information about this privacy analysis for IT solutions

ESDC Access to Information and Privacy (ATIP) Coordinator

Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal

June

Opt-Out Process for Automatic Enrolment in the Canada Learning Bond (CLB)

Description

The Canada Learning Bond (CLB), which was introduced in 2004, is a federal education savings benefit for families with low income for each eligible child born on or after January 1, 2004, for a child’s post-secondary education. Budget 2024 announced automatic enrolment in the CLB and an age extension from 20 to 30 years to retroactively apply for the CLB. Automatic enrolment in the CLB will be implemented for eligible children born in 2024 and after with notification letters being sent in 2025 stating that auto-enrollment will happen at the age of four. A caregiver can choose to opt-out of automatic enrolment for their child by notifying Employment and Social Development Canada (ESDC). This PIA focuses on the interim opt-out process that will involve manual opt-out via a contact centre.

Why a privacy impact assessment (PIA) was completed

Privacy Management Division helped complete this PIA to identify the privacy risks associated with the interim opt-out process of the CLB as the personal information involved is part of an administrative process. The PIA is required by the Treasury Board Secretariat (TBS) Directive on Privacy Practices.

The PIA examines the privacy risks and strategies related to the management and protection of personal information collected and used by the interim opt-out process.

Additional information

The PIA identified two (2) medium-level privacy risks. There were no privacy compliance issues. The strategies to address the risks are scheduled for completion by the end of 2026.

Risk 1: Absence of retention schedule and procedure for collected personal information

Action: The CLB team will work with internal Information Management to develop a retention schedule and procedure for personal information collected by this activity.

Completion by: June 2025

Risk 2: Absence of logged and monitored access to the system that stores the collected personal information

Action: The CLB team will work with internal IT security to develop audit log review procedures.

Completion by: End of 2026

Related personal information banks

For more information about this privacy impact assessment

ESDC Access to Information and Privacy (ATIP) Coordinator

Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal

July

Canada Student Financial Assistance (CSFA) National Student Loans Service Centre (NSLSC) My Requests Document Upload

Description

As part of the Canada Student Financial Assistance (CSFA) program transformation towards an electronic service delivery model, the NSLSC will provide functionality to permit borrowers to securely upload required documentation through the Student Hub portal. Documentation includes personal information related to student or apprenticeship loans.

Why a privacy impact assessment was completed

Substantial modifications to the NSLSC Student Hub web portal will be made to permit electronic document submissions that involve personal information for administrative purposes through the Program’s third-party service provider who administers the Program on behalf of ESDC. Accordingly, these changes to the handling of personal information, from physical documentation to electronic submissions requires a Privacy Impact Assessment (PIA) as per Treasury Board Secretariat’s Directive on Privacy Practices.

Additional information

The PIA identified a total of one (1) privacy risk and one (1) compliance issue.

Risk 1: Retention and Disposition

Action: The program is working with ESDC’s Information Management to address gaps and establish a framework to manage data lifecycle requirements in full alignment of federal legislation and policy.

Planned completion: Winter 2026/2027

Issue 1: Personal information bank

Action: ESDC PPU 030 and ESDC PPU 709 will be updated to describe all personal information collected and used.

Planned completion: Early 2026.

Related personal information banks

  • ESDC PPU 030 – Student Financial Assistance, TBS Registration #000485
  • ESDC PPU 709 – Canada Apprentice Loans, TBS Registration #20150172

For more information about this privacy impact assessment

ESDC Access to Information and Privacy (ATIP) Coordinator

Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal

Internal Activity and Access Monitoring (IAAM) Project 2: Employment Insurance (EI) and Social insurance Number/Registry (SIN/SIR) Applications

Description

The Internal Activity and Access Monitoring (IAAM) Project led by the Integrity Services Branch (ISB) involves the implementation of an enterprise-wide monitoring solution that will enhance the Department’s ability to identify insider threats and provide digital evidence of unauthorized access or misuse of personal information held in key ESDC applications.

The solution automates existing manual processes and provides near real time monitoring for better outcomes in detection and prevention of threats and vulnerabilities to personal information. Accordingly, the solution will rely on the use of personal information held in various ESDC databases and systems.

Why a privacy impact assessment was completed

The IAAM solution is a substantial modification to the handling and use of personal information for the purpose of internal network use monitoring. In accordance the Treasury Board Secretariat’s Directive on Privacy Practices, ISB completed this PIA, as required, to identify privacy risks associated with the Program’s use of personal information in a decision-making process that may impact individuals.

Additional information

The PIA identified one (1) privacy risk:

Risk 1: Retention and Disposition

Action: ISB is working with ESDC Information Management to align IAAM information with established data management framework and to operationalize retention and disposition processes.

Planned completion: December 2025 (completed)

Related personal information banks

For more information about this privacy impact assessment

ESDC Access to Information and Privacy (ATIP) Coordinator

Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal

August

Electronic Social Insurance Number Automation (eSINa)

Description

The electronic Social Insurance Number Application automation (eSINa) is an initiative that automates the same processes of online electronic SIN (eSIN) application. This feature uses an automated tool to authenticate an applicant’s identity documents.

eSINa’s primary purpose is to reduce processing time for eligible applicants, so that they can receive their SIN faster. eSINa also aims to reduce the demand for paper-based applications and to reduce workload demands on Service Canada Citizen Services Officers and wait times for applicants. Personal information will be collected from primary and secondary identity documents for eSINa to process.

The eSINa tool uses optical character recognition (OCR) to extract text from identity documents. Applicants provide a primary and secondary identity document, which eSINa compares to determine their validity. If confident, the tool automatically fills in the required fields for the applicant to review. If not, it refers the validation to a Citizen Services Officer. Once validated, eSINa verifies the information against the document’s source, automatically issues a SIN and sends an email to the applicant to advise them to register to the My Service Canada Account (MSCA).

Why a privacy impact assessment was completed

Treasury Board Secretariat’s Directive on Privacy Practices requires a privacy impact assessment to be undertaken when a decision that directly affects an individual is present in a program or activity. These decisions are present as the eSINa tool intends to automate the elements of the decision-making process, such as the validation and verification of the primary and secondary identity documents.

Additional information

The PIA identified one (1) privacy risk and no compliance issues.

Risk 1: There is a risk that records may be kept longer than necessary

Action: The SIN Program will work with Library and Archives Canada to develop a retention schedule.

Planned completion: June 2026

Related personal information banks

  • PPU 390 – Social Insurance Number Register (PIB)
  • ESDC IAP 060 - Social Insurance Number Management Services (CoR)

For more information about this privacy impact assessment

ESDC Access to Information and Privacy (ATIP) Coordinator

Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal

Tips and Allegations Management System (TAMS)

Description

The Tips and Allegations Management System (TAMS) is part of business improvements that helps with Temporary Foreign Worker Program (TFWP) compliance. There are currently 38,000 employers using the TFWP. TFWP performs 3,000 inspections each year and the tips and allegations received by the Leads Team are growing at 30% per year. TAMS implements a modern, scalable leads management tracking system in support of the TFWP and those involved.

Why a privacy analysis for IT solutions (PAITS) was completed

Privacy Management Division helped complete this PAITS to identify the privacy risks associated with the TAMS Project as the personal information involved is part of an administrative process. This privacy assessment is required per the Treasury Board Secretariat (TBS) Directive on Privacy Practices.

The assessment examines the privacy risks and strategies related to the management and protection of personal information of the TFWP that relates to tips and allegations of wrongdoing.

Additional information

The PAITS identified three (3) medium risks. In addition, there was one (1) compliance issue. The strategies to address these risks and issues are scheduled for completion by June 2025.

Risk 1: Potential oversharing of personal information with Immigration, Refugees and Citizenship Canada (IRCC)

Action: PMD recommends that TFWPB amends the 2018 ISA between ESDC and IRCC to account for this possibility and update all relevant privacy notice statements associated with tips and allegations.

Completion by: June 2025

Risk 2: Absence of audit log monitoring and accompanying review procedure for TAMS

Action: The TAMS team will work with internal IT security to determine the feasibility of audit log monitoring for TAMS.

Completion by: June 2025

Risk 3: Unknown IT security risks with privacy implications

Action: The TAMS team will provide the relevant IT security reports for review.

Completion by: June 2024

Compliance Issue 1: Insufficient privacy notice statement for phone calls

Action: The TAMS team will update the privacy notice statement to match that of the online portal.

Completion by: June 2025

Related personal information banks

  • Temporary Foreign Worker Program Employer Compliance Reviews and Investigations (PIB) – ESDC PPU 715
  • Temporary Foreign Worker Program (PIB) – ESDC PPU 440

For more information about this privacy analysis for IT solutions

ESDC Access to Information and Privacy (ATIP) Coordinator

Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal

September

Assault Style Firearms Compensation Program Phase 2 – (For Individuals)

Description

The "Assault-Style Firearms Compensation Program (ASFCP) Phase 2 – (For Individuals)" is a multi-institutional Privacy Impact Assessment (PIA) led by Public Safety Canada (PS) and supported by its partners, the Royal Canadian Mounted Police (RCMP) and Employment and Social Development Canada (ESDC)/Service Canada. A PIA for the ASFCP Phase 1 – (For Businesses) was completed in October 2024.

In this PIA, ESDC continues to provide customer support. In addition, ESDC will provide compensation payment processing validation services to Public Safety.

Why a privacy impact assessment was completed

The PIA was completed as required under the Treasury Board Secretariat’s Directive on Privacy Practices for the initiation of a new program by Public Safety of which RCMP and ESDC are program delivery partners.

This PIA aims to identify, assess and propose mitigation measures to potential risks associated with the collection, use, and retention of personal information by ESDC to fulfil its role in the delivery of ASFCP to individuals.

Additional information

As a result of the assessment, eight (8) privacy risks were identified in the PS Led PIA of which the five (5) identified risks below impact ESDC:

  1. ensuring clarity on partner roles and responsibilities
  2. aligning the PIA and ISAs
  3. finalizing security and threat risk assessments
  4. developing Standard Operating Procedures (SOPs)
  5. establishing retention and disposal processes for information held in the Common System for Grants and Contributions (CSGC)

Of these risks, the first four (4) were mitigated prior to the implementation of this phase. Mitigation measures for risk #5 related to retention and disposition processes for ESDC’s CSGC is currently under development with an interim measure to retain personal information collected for a minimum of two (2) years. The risk level for this item has been assessed as Low.

Related personal information banks

The following personal information banks are applicable to ESDC activities and services provided to the ASFCP:

  • ESDC PPU 729 – Call Centre Operations: This bank describes information collected and used to support clients and reply to general enquiries. The information collected is limited to contact and name information in most cases unless enquiries are of a threatening nature or require escalation. Personal information is stored on ESDC/Service Canada's customer support delivery tool. No personal information will be phone-recorded.
  • ESDC PPU 702 - Processing and Payment Services: This bank describes information collected and used to support payment processing to eligible individuals who participate in Phase 2 of the ASFCP.

For more information about this privacy impact assessment

For more information about the program please consult the Assault-Style Firearms Compensation Program website.

For questions and information related to this PIA, please contact Public Safety Canada's Privacy Policy and Governance Unit at ppgu-upprpg@ps-sp.gc.ca.

The complete PIA Summary is available on the PS web site: Privacy Impact Assessments

ESDC Access to Information and Privacy (ATIP) Coordinator

Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal

October

Canadian Digital Service GC Issue and Verify Solution

Description

The Canadian Digital Service (CDS) is the service provider for GC Issue and Verify (GCIV). GCIV is a Government of Canada cloud-based enterprise solution platform that will enable departments and agencies to issue digital credentials to individuals and enable individuals to store and share those credentials in their GC Digital Wallet app with verifiers their GC Verify app. The purpose is to provide a reusable, standards-aligned capability that streamlines service delivery and supports secure, privacy-preserving credential issuance and exchange. As the GCIV service provider, CDS will provide onboarding, configuration and support to client departments. CDS will not collect personal information nor retain the personal information. Accountability for personal information will be the responsibility of participating Partners.

Why a privacy impact assessment was completed

Although ESDC will not collect or retain personal information, and will not participate in administrative decisions, this PIA was conducted under TBS Directive on Privacy Practices, Standard C – Privacy Impact Assessment, C.2.2.9.3: When the official responsible for section 10 of the Privacy Act determines that a PIA is warranted given the potential risks associated with any administrative or non-administrative use of personal information.

Additional information

The PIA did not identify any privacy risks or issues.

Related personal information banks

CDS is not responsible for establishing personal information banks on the basis that CDS does not collect personal information. PIBs are the responsibility of participating Partners.

For more information about this privacy impact assessment

ESDC Access to Information and Privacy (ATIP) Coordinator

Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal

November

Canadian Digital Service – GC Sign in Phase 1

Description

The Canadian Digital Service (CDS) is launching a new initiative, GC Sign, a platform for authentication and identity proofing. It will replace existing identity providers and sign-in solutions. GC Sign in will enable users to access participating Government of Canada programs and services with a single credential. The implementation of GC Sign in will occur in multiple phases. Phase 1, involving self-asserted data from users, is being assessed in this PIA. This phase will not include verification and validation that the provided personal information is true or accurate, referred to as identity-proofing.

Why a privacy impact assessment was completed

While Phase 1 of GC Sign involves the collection and use of personal information, it will not involve an administrative purpose. Further phases may include the collection of personal information for administrative purposes. Because Phase 1 is the start of a continuum of system development that may ultimately involve an administrative purpose the section 10 delegate for ESDC had determined that a PIA is warranted pursuant to 2.2.9.3 of TBS’ Directive on Privacy Practices.

Additional information

Risk 1: Retention and Disposition

Action: CDS will work with departmental officials to develop a formal records disposition authority.

Planned completion: Spring 2026

Issue 1: There may be a delay in registering the personal information bank

Action: CDS will submit the personal information bank to Treasury Board of Canada Secretariat.

Planned completion: January 2026

Related personal information banks

A personal information bank has been submitted to Treasury Board of Canada Secretariat for registration.

For more information about this privacy impact assessment

ESDC Access to Information and Privacy (ATIP) Coordinator

Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal

Page details

2026-02-10