Personal Information Banks

Personal Information Banks

A Personal Information Bank (PIB) is a description of personal information collected and held onto by an institution as it relates to its programs or activities.

When you need one

Your privacy expert can advise on whether your initiative will need to create or update a PIB. Typically, you’ll need one if your initiative uses, has used or has available for use personal information for an administrative purpose.

What’s required

All PIBs must include the following information and headers:

A brief description of the information collected for the initiative
Class of individuals
Who your initiative will collect information from
Why your initiative is collecting this information and under what legal authority it is being collected. Ensure that you cite the same legal authority as noted in the related Privacy Impact Assessment (PIA)
Consistent uses
How information is being used in connection to the initiative’s original purpose
Retention and disposal standards
How long will the information be held on to
Records Disposition Authority (RDA) number
A number assigned by Library and Archives Canada
Related record number
A number of a related Class of records, which is a description of information maintained by an institution in support of an initiative, if applicable
Treasury Board of Canada Secretariat (TBS) Registration
A number assigned by TBS, once the PIB is registered
Bank number
A unique PIB number assigned by your institution
Last updated
The date of the last review and update of the PIB

General process

  • complete all the required sections of the PIB (your privacy expert can help you with the RDA and bank number)
  • get the PIB approved by the delegated head of privacy for your institution
  • email the PIB to the Treasury Board of Canada Secretariat’s (TBS) privacy generic inbox ( along with the related PIA
  • TBS will assign a registration number to the PIB
  • once the PIB is registered, your institution’s privacy office will make sure it is included in the institution’s inventory of information holdings

Privacy tip: A new PIB needs to have a related PIA. So, if you’re working on a PIB, then you’re likely working on a PIA as well. You can prepare both deliverables at the same time leveraging the existing content from one to the other and submit them together.

When to update and review

You should be continuously reviewing and updating your PIA and PIB any time there are changes to the way your initiative collects/creates, uses, shares, or retains personal information.

Page details

Date modified: