Personal Information Banks
Personal Information Banks
A Personal Information Bank (PIB) is a description of personal information collected and held onto by an institution as it relates to its programs or activities.
When you need one
Your privacy expert can advise on whether your initiative will need to create or update a PIB. Typically, you’ll need one if your initiative uses, has used or has available for use personal information for an administrative purpose.
What’s required
All PIBs must include the following information and headers:
- Description
- A brief description of the information collected for the initiative
- Class of individuals
- Who your initiative will collect information from
- Purpose
- Why your initiative is collecting this information and under what legal authority it is being collected. Ensure that you cite the same legal authority as noted in the related Privacy Impact Assessment (PIA)
- Consistent uses
- How information is being used in connection to the initiative’s original purpose
- Retention and disposal standards
- How long will the information be held on to
- Records Disposition Authority (RDA) number
- A number assigned by Library and Archives Canada
- Related record number
- A number of a related Class of records, which is a description of information maintained by an institution in support of an initiative, if applicable
- Treasury Board of Canada Secretariat (TBS) Registration
- A number assigned by TBS, once the PIB is registered
- Bank number
- A unique PIB number assigned by your institution
- Last updated
- The date of the last review and update of the PIB
General process
- complete all the required sections of the PIB (your privacy expert can help you with the RDA and bank number)
- get the PIB approved by the delegated head of privacy for your institution
- email the PIB to the Treasury Board of Canada Secretariat’s (TBS) privacy generic inbox (ippd-dpiprp@tbs-sct.gc.ca) along with the related PIA
- TBS will assign a registration number to the PIB
- once the PIB is registered, your institution’s privacy office will make sure it is included in the institution’s inventory of information holdings
Privacy tip: A new PIB needs to have a related PIA. So, if you’re working on a PIB, then you’re likely working on a PIA as well. You can prepare both deliverables at the same time leveraging the existing content from one to the other and submit them together.
When to update and review
You should be continuously reviewing and updating your PIA and PIB any time there are changes to the way your initiative collects/creates, uses, shares, or retains personal information.
Page details
- Date modified: