Annual Report on the Privacy Act 2025-2026

ISSN 2561-8253 (Online)

Table of Contents

1 Introduction

The Privacy Act (the Act) came into force on July 1, 1983. The purpose of the Actis to protect the privacy of individuals with respect to personal information about themselves held by government institutions as well as to provide individuals with a right of access to that information.

The Public Prosecution Service of Canada (PPSC) became subject to the Act when it was established as an independent organization on December 12, 2006, with the coming into force of the Director of Public Prosecutions Act (Part 3 of the Federal Accountability Act).

Pursuant to section 72 of the Act, this 2025-2026 Annual Report on the Act has been prepared for tabling in the House of Commons and the Senate. It provides an analysis of key statistics for the year, and also includes information on emerging trends, training activities, internal policies, guidelines, and procedures with respect to the PPSC’s administration of the Act.

The PPSC does not have any wholly-owned subsidiaries.

2 The Public Prosecution Service of Canada

The Public Prosecution Service of Canada (PPSC) is a national, independent, and accountable prosecuting authority. Our main objective is to prosecute cases under federal jurisdiction in a fair manner that is free from any improper influence. The Director of Public Prosecutions (DPP) is accountable to the Attorney General of Canada (AGC) and both the DPP and the AGC are required to perform their functions free of political influence or considerations. The PPSC is accountable to Parliament and has an obligation to the courts to present them with all available, relevant, and admissible evidence to preserve the fairness of the criminal justice system.

Mandate

The PPSC’s mandate is set out in the Director of Public Prosecutions Act (DPPA). The DPPA empowers the Director of Public Prosecutions (DPP), as Deputy Attorney General of Canada, to:

The DPPA also empowers the DPP to:

The DPP has the rank and status of a deputy head of a department and, in this capacity, is responsible for the management of the PPSC as a distinct government institution.

3 The ATIP Office

The ATIP Office holds primary responsibility for the implementation and administration of the Privacy Act, along with the Access to Information Act (collectively known as ATIP). The Office deals directly with the public in relation to personal information requests, liaises with Offices of Primary Interest (the subject matter experts) to prepare responses, and serves as the centre of ATIP expertise within the PPSC.

The ATIP Office fulfills its responsibilities by:

3.1 Organizational structure

The Director General, Communications and Parliamentary Affairs (CPA), acts as the PPSC’s ATIP Coordinator. The Director of the ATIP Office reports to the Director General, CPA.

During the period from April 1, 2025, to March 31, 2026, the ATIP Office comprised of the Director, two (2) Senior Advisors, two (2) Advisors, and one (1) ATIP Officer.

Section 73.1 of the Act allows for the PPSC to exchange ATIP services with another government institution within the same ministerial portfolio. There were no such service agreements undertaken during this period.

The following chart outlines the organizational structure of the ATIP Office on March 31, 2026:

Figure 1: Organizational structure
Organizational Chart of Access to Information and Privacy Governance Structure
Text Version
  • ATIP Director
    • Senior ATIP Policy and Operations Advisor
      • ATIP Officer
    • Senior ATIP Policy and Operations Advisor
      • ATIP Advisor
      • ATIP Advisor

4 Delegated authorities

Pursuant to section 73 of the Act, the head of a government institution may designate one or more officers or employees of that institution, by order, to exercise or perform any of the powers, duties, or functions of the head of the institution under the Act.

The DPP, as the “head of institution,” has designated this authority to the Director General, CPA, as well as the Senior Director General, Corporate Services, and the ATIP Director. The ATIP Director exercises this authority in the absence of the Director General, CPA. The Senior Director General, Corporate Services, exercises this authority in the absence of both the Director General, CPA, and the ATIP Director.

A signed copy of the ATIP Delegation Order is available in Appendix A of this report.

5 Performance

The following section provides an overview of key data on the PPSC’s performance for the 2025-2026 fiscal year.

5.1 Requests received under the Privacy Act

5.1.1 Number of requests

The PPSC received 86% of personal information requests through the ATIP Online Request Service, reflecting the continued shift towards digital service delivery for ATIP requests.

In 2025-2026, the PPSC received 36 formal personal information requests, an increase of 10 requests compared with 26 received in the previous fiscal year.

In addition, four (4) requests were carried over from previous fiscal years, including three (3) from 2024-2025 and one (1) from 2020-2021. As a result, the PPSC had a total of 40 personal information requests to process the reporting period.

Since its creation on December 12, 2006, the PPSC has received 317 personal information requests in total. Over time, the organization has experienced periodic, sharp increases in the number of requests received each year. The current period represents the highest number of personal information requests received so far in the organization’s history, surpassing last year’s record.

The following chart illustrates this trend:

Figure 2: Requests received since 2006
Requests received since 2006

Note: As the PPSC was created on December 12, 2006, data for 2006-2007 only reflects a three-month period.

Text Version
Figure 2: Requests received since 2006
Fiscal year Number of requests
2006-2007 1
2007-2008 9
2008-2009 7
2009-2010 17
2010-2011 8
2011-2012 13
2012-2013 16
2013-2014 21
2014-2015 11
2015-2016 14
2016-2017 23
2017-2018 16
2018-2019 19
2019-2020 19
2020-2021 19
2021-2022 11
2022-2023 15
2023-2024 16
2024-2025 26
2024-2025 36
Total 317

5.2 Requests closed during the fiscal year

5.2.1 Disposition of requests

The PPSC responded to 32 of the 40 requests received in 2025-2026 or carried over from the previous year, 80% of all requests and eight (8) more than those closed during the last reporting period.

The annual proportion of closed requests over the last five fiscal years have ranged from 78% to 89%. The chart below breaks down this closure rate:

Figure 3: Requests closed since 2021
Requests closed since 2021
Text Version
Figure 3: Requests closed since 2021
Fiscal year Number of requests received in the fiscal year or carried over from the previous period Number of requests closed %  of requests closed
2021-2022 18 14 78%
2022-2023 19 17 89%
2023-2024 18 16 89%
2024-2025 28 24 86%
2025-2026 40 32 80%

Eight (8) requests remained outstanding as of March 31, 2026, and were carried forward to the next fiscal year, twice the amount remaining at the end of the previous year.

Seven (7) of the requests still active at the end of 2025-2026 were received within the reporting period and were still within legislated timelines, with the exception of one (1) request. The other outstanding request was received in 2020-2021. For this request, an extension to the initial statutory deadline of 30 days, which is the maximum time permitted under the Act, was taken to process a high volume of pages. Despite the extension, further time is needed for processing and it has since passed the extended deadline.

The disposition of requests closed in 2025-2026 is as follows:

Figure 4: Disposition of closed requests
Figure 4: Disposition of closed requests
Text Version
Figure 4: Disposition of closed requests
Disposition of requests Number of requests %
Disclosed in part 9 28%
No records exist 19 59%
Abandoned 4 13%
Total 32 100%

Records were disclosed, in whole or in part, for nine (9) of the 32 requests closed in 2025-2026.

The following categories of requests closed during the reporting period did not result in the disclosure of records to applicants:

No records exist

Nineteen (19) requests could not be processed because relevant records under the control of the PPSC did not exist. Where possible, applicants were advised of other government institutions that may have records and were provided with contact information accordingly.

Abandoned

Four (4) requests were abandoned by applicants. In most abandoned cases, clarification is needed from the applicants in order to process their requests. When the applicants do not provide clarification, the requests are considered to be abandoned. In other cases, the applicants choose to abandon their requests.

5.2.2 Number of pages processed

For the 32 cases closed in 2025-2026, the PPSC processed 3,090 relevant pages. This represents a significant decrease from 2024-2025, where 22,482 pages were processed, but the current volume is consistent with other fiscal years. The unusually high volume in the previous period was primarily due to the closing of a single request, which accounted for 92% of all pages processed that year.

The PPSC ATIP Office also reviewed an additional 2,880 pages received from across the organization that were deemed not relevant to the requests and were therefore not included as part of the responses. This is 63% more than the non-relevant pages received in the previous period.

The following is a summary of the relevant pages processed by the PPSC over the last five fiscal years:

Figure 5: Pages processed for requests closed since 2021
Pages processed for requests closed since 2021
Text Version
Figure 5: Pages processed for requests closed since 2021
Fiscal year Number of pages
2021-2022 13,388
2022-2023 3,033
2023-2024 2,527
2024-2025 22,482
2025-2026 3,090
Total 44,520
Average 8,904

5.2.3 Completion time

Of the 32 requests closed in 2025-2026, 25 were processed within the initial 30-day statutory deadline, representing 78% of requests. This is six (6) more than the number closed within the same timeframe in 2024-2025.

On average, over the last five fiscal years, the PPSC has processed 77% of requests within 30 days of receipt. The proportion of requests closed within that timeframe has fluctuated from year to year. The overall trend is demonstrated in the chart that follows:

Figure 6: Requests closed within 30 days since 2021
Requests closed within 30 days since 2021
Text Version
Figure 6: Requests closed within 30 days since 2021
Fiscal year % of closed requests
2021-2022 71%
2022-2023 71%
2023-2024 81%
2024-2025 79%
2025-2026 78%

The following table is a breakdown of the number of days taken to respond to requests in 2025-2026:

Table 1: Completion time
Completion time Number of requests %
Note: Each percentage has been rounded to the nearest whole value. For this reason, the percentages set out in the table do not add up to an exact 100%.
1 to 15 days 13 41%
16 to 30 days 12 38%
31 to 60 days 6 19%
61 to 120 days 1 3%
Total 32 100%

5.2.4 Exemptions

An individual’s right of access to his or her personal information is subject to limited and specific exceptions. Limitations to the right of access are set out in sections 18 through 28 of the Act.

The following is a breakdown of the exemptions applied by the PPSC in 2025-2026 for closed requests:

Figure 7: Exemptions that were invoked
Exemptions that were invoked
Text Version
Figure 7: Exemptions that were invoked
Exemption Number of requests
Subparagraph 22(1)(a)(i) 1
Paragraph 22(1)(b) 1
Paragraph 22(1)(c) 1
Section 26 8
Section 27 7

Over the past five fiscal years, the PPSC has most frequently invoked sections 26 (information about another individual) and 27 (solicitor-client privilege) of the Act to exempt information from disclosure. This trend reflects the PPSC’s mandate to conduct federal prosecutions, which often involve personal information, and to provide legal advice to law enforcement agencies and investigative bodies on prosecution-related matters.

5.2.5 Exclusions

Records or parts thereof to which the Actdoes not apply are considered to be “excluded.” Pursuant to section 69, the Act does not apply to library or museum material preserved solely for public record or material placed in Library and Archives Canada. Records containing confidences of the King’s Privy Council of Canada, also known as Cabinet confidences, and which have been in existence for less than 20 years are also excluded from the Act pursuant to section 70.

The PPSC did not invoke any exclusions in 2025-2026.

5.2.6 Format of information released

Information was released electronically for all nine (9) requests where the PPSC fully or partially disclosed records in 2025-2026.

In the last five fiscal years, all releases have been in electronic format. At the onset of the COVID-19 pandemic, the PPSC, along with the majority of government agencies and the private sector, had shifted its services to a digital-first environment in order to comply with public health measures. While paper-based release packages can be made available upon request so that the ATIP process remains accessible to all Canadians, PPSC applicants no longer request this option.

5.2.7 Complexity

Due to the nature of the PPSC’s work, processing requests can be challenging, and requests are regularly deemed “complex” based on a number of factors:

5.2.8 Deemed refusals

Requests that are not closed within the initial 30-day statutory deadline or within a timeframe covered by an extension provided by the Act are referred to as “deemed refusals.” Further information on the circumstances in which an extension to the original deadline is permitted by the Act is available in section 5.4 (Extensions) of this report.

The PPSC completed 97% of requests closed in 2025-2026 within the applicable legislated timeframe, either within the initial deadline or an authorized extension. The sole exception involved a request requiring the review of 171 pages of records. Although a 30-day extension was taken, the request was finalized 39 days beyond the extended deadline because processing it within the prescribed timeframe would have unreasonably interfered with the PPSC's core operations.

5.2.9 Requests for translation

During the 2025-2026 fiscal year, the PPSC did not receive any requests from applicants to translate records from one official language to the other. This is consistent with the last five fiscal years.

5.3 Requests for correction of personal information and notations

Under paragraph 12(2)(a) of the Act, individuals who are given access to their personal information have the right to request a correction if the following conditions are met:

Where correction is not possible, an individual has the right to request that a notation about the error or omission be placed on their file.

There were no requests for correction of personal information or notations in 2025-2026. This has been typical of the last five fiscal years.

5.4 Extensions

Paragraph 15(a) of the Act allows for an extension of the initial statutory deadline for a maximum of 30 additional days in cases where:

In 2025-2026, the PPSC extended timelines to process seven (7) requests, applying one (1) extension per request. This is two (2) more than in the previous reporting period. Over the past five fiscal years, the PPSC has taken an average of four (4) extensions per year under the Act.

The following summarizes the length and reasons for the extensions taken in 2025-2026:

Table 2: Extensions
Length of extensions Reasons for extensions
Sub-paragraph 15(a)(i) – Interference with operations Sub-paragraph 15(a)(ii) – Consultation Paragraph 15(b) – Translation purposes or conversion
Further review required to determine exemptions Large volume of pages Large volume of records Records are difficult to obtain Cabinet confidences (Section 70) External Internal
15 days or less 1 1 1 0 0 0 0 0
16 to 30 days 0 3 0 1 0 0 0 0
Total 1 4 1 1 0 0 0 0

5.5 Consultations received from other institutions

5.5.1 Number of consultations

The PPSC received no consultations from other government institutions for processing under the Act in 2025-2026, the first year that this has been the case for a reporting period. No consultations were carried over from previous fiscal years either.

The PPSC has received 126 consultations in total since December 12, 2006. There was a sharp increase in the number of consultations in 2010-2011, but since then, the number of consultations received by the PPSC has largely declined.

The following chart illustrates this trend:

Figure 8: Consulations received since 2006
Consulations received since 2006

Note: As the PPSC was created on December 12, 2006, data for 2006-2007 only reflects a three-month period.

Text Version
Figure 8: Consulations received since 2006
Fiscal year Number of consultations
2006-2007 2
2007-2008 6
2008-2009 7
2009-2010 16
2010-2011 24
2011-2012 10
2012-2013 12
2013-2014 13
2014-2015 7
2015-2016 8
2016-2017 2
2017-2018 5
2018-2019 5
2019-2020 1
2020-2021 2
2021-2022 1
2022-2023 1
2023-2024 3
2024-2025 1
2025-2026 0
Total 126

5.5.2 Sources of consultations

The sources for consultations received by the PPSC typically vary from year to year.

5.5.3 Disposition and recommendations

No consultation requests were received in 2025-2026, and no consultations were carried forward from previous reporting periods. Consequently, the PPSC did not process or close any consultations during the year and had no outstanding consultations as of March 31, 2026.

The number of pages processed in response to consultations over the last five fiscal periods has considerably fluctuated from year to year, which is demonstrated in the following chart:

Figure 9: Pages processed for consultations completed since 2021
Pages processed for consultations completed since 2021
Text Version
Figure 9: Pages processed for consultations completed since 2021
Fiscal year Number of pages processed
2021-2022 6
2022-2023 444
2023-2024 18
2024-2025 33
2025-2026 0

Over the last five fiscal years, the PPSC has never recommended full exemption of records sent in consultation.

5.5.4 Completion time

Over the last five fiscal years, 75% of the consultations completed were closed within the first 30 days. Any consultations closed past that point involved a large number of records to process.

5.6 Consultations on Cabinet confidences

No consultations regarding section 70 (Cabinet confidences) of the Actwere carried out during fiscal year 2025-2026.

5.7 Costs

In the 2025-2026 fiscal year, the PPSC spent a total of $213,882 administering the Act, of which salaries accounted for nearly all expenditures at $204,537, while goods and services accounted for the remaining $9,345. No overtime expenditures were incurred during this period.

Over the past five fiscal years, the costs associated with administering the Act have fluctuated, peaking in 2023-2024. The substantial increase in expenditures during that period was related to goods and services, specifically the purchase of licenses for new ATIP case management software.

The following chart illustrates annual costs over five years:

Figure 10: Costs related to the administration of the Act since 2021
Costs related to the administration of the Act since 2021
Text Version
Figure 10: Costs related to the administration of the Act since 2021
Fiscal year Costs
2021-2022 $219,501
2022-2023 $193,651
2023-2024 $301,882
2024-2025 $202,087
2025-2026 $213,882

6 Training and awareness activities

There are mandatory privacy training obligations for all PPSC employees under the Treasury Board Directive on Personal Information Requests and Correction of Personal Information. One (1) such training session was delivered to employees in 2025-2026 for 14 employees.

Additionally, one (1) training session specific to privacy breach management was delivered to PPSC senior management during the reporting period.

The ATIP Office ensures all new and current staff with functional or delegated responsibility for administering the Act and its Regulations at the PPSC have undertaken mandatory training on the Act and related responsibilities, are provided with annual opportunities to update their knowledge of the legislation, related policies, and directives, and are kept informed of emerging trends, issues, and best practices.

Presentations were also delivered in the past to raise awareness of corporate responsibilities regarding ATIP. These materials continue to be made available to all PPSC employees through the internal website. Communiqués on ATIP topics were also distributed throughout the year to employees, which included promoting Data Privacy Day 2026.

ATIP personnel provided informal learning to employees on an ad hoc basis regarding the processing of personal information requests and regularly provided advice to PPSC officials on the interpretation of the Act, including the appropriate collection, use, disclosure, and safeguarding of personal information.

7 Policies, guidelines, and procedures

No new or revised internal policies, guidelines, and procedures related to privacy were implemented in 2025-2026.

The PPSC also did not undertake any new collections or consistent uses of the Social Insurance Number during the reporting period.

The ATIP Office regularly advises various PPSC officials on appropriate privacy protections to include in contracts and information sharing agreements or arrangements, on request. These protections will include privacy breach notification, limits on use or disclosure of personal information, technical or physical safeguards for its secure retention for the duration of the contract, agreement, or arrangement, as well as the appropriate return or disposition of personal information collected on the PPSC’s behalf.

8 Initiatives and projects to improve privacy

The PPSC launched a new electronic case management system in 2025-2026, ATIPXpress, with enhanced features for processing ATIP requests and performance tracking.

To support the transition, the PPSC ATIP Office developed written guidance for its staff. The team also updated office correspondence templates, so that they are compatible with the new system, as well as to improve communications with applicants and PPSC officials.

9 Complaints and investigations

Decisions made under the Actare subject to a two-tiered system of review. This ensures government institutions’ compliance with their privacy protection obligations as well as fair treatment for all applicants. The first level of review is a formal complaint made to and investigated by the Privacy Commissioner, supported by the Office of the Privacy Commissioner (OPC). The second level is an application for judicial review to the Federal Court. The PPSC reviews the outcomes of all investigations and incorporates lessons learned into business processes, where appropriate.

Two (2) new complaints were filed against the PPSC in 2025-2026. One (1) investigation remained active as of March 31, 2026, where the complainant alleged that records are missing after having received a response to their request from the PPSC.

In the other case, the complainant alleged that the PPSC failed to respond to their request in a timely manner. Following an investigation that concluded at the end of the fiscal year, the Privacy Commissioner determined that the complaint was well-founded. The PPSC experienced delays in processing this request within legislated timelines due to it involving over 12,000 pages as well as the complexity of the subject matter. To address the complaint, the PPSC worked to further expedite its processing, which was still under way at the end of the reporting period.

The OPC did not undertake any privacy audits in 2025-2026 involving the PPSC. There were also no applications for judicial review filed with the Federal Court during this same period.

10 Monitoring compliance

The ATIP Office maintains a comprehensive statistical reporting and performance measurement system to track the processing of formal requests, informal requests, and consultations received by the PPSC.

Each ATIP staff member is responsible for monitoring the time taken to process files that they are assigned on a regular basis, while the Senior ATIP Advisors meet with the ATIP Director twice a week to review timelines and address challenges that could affect the PPSC’s ability to meet its legal obligations under the Act. The ATIP Director meets weekly with the ATIP Coordinator on the status of active requests, complaints, and any issues that have arisen. The ATIP Office also formally reports to the PPSC’s senior management on a regular basis about its activities, caseload, performance metrics, and privacy trends.

11 Material privacy breaches

A privacy breach involves improper or unauthorized collection, use, disclosure, retention, or disposal of sensitive personal information.

The ATIP Office received seven (7) privacy breach reports in 2025-2026, none of which were considered to be material. A material privacy breach could reasonably be expected to cause serious injury or harm to the individual to whom it relates. These cases are to be reported to the TBS and the OPC, as required by the Treasury Board’s Directive on Privacy Practices.

12 Privacy impact assessments

A privacy impact assessment (PIA) is a tool that assists a government institution in meeting its privacy responsibilities regarding the management of personal information. Institutions initiate PIAs when assessing the privacy implications of new or substantially modified programs and activities involving personal information.

No new PIAs were completed in 2025-2026.

Further information about past PIAs is available on the PPSC’s webpage listing summaries of its completed privacy impact assessments.

13 Public interest disclosures

Subsection 8(2) of the Act describes the circumstances under which personal information under the control of a government institution may be disclosed without the individual’s consent.

In particular, disclosures without consent may be made in the public interest, pursuant to paragraph 8(2)(m) of the Act. The PPSC did not make any such disclosures in 2025-2026.

14 Appendix A – Delegation order

Access to Information Act and Privacy Act Delegation Order

The Director of Public Prosecutions, pursuant to subsection 95(1) of the Access to Information Act and subsection 73(1) of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Director of Public Prosecutions as the head of the Office of the Director of Public Prosecutions, under the provisions of the Acts and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

Schedule
Position Access to Information Act and Regulations Privacy Act and Regulations
Senior Director General, Corporate ServicesFull authorityFull authority
Director General, Communications and Parliamentary AffairsFull authorityFull authority
Director, ATIPFull authorityFull authority

Dated, at the City of Ottawa, this 8th day of August 2024

George Dolhai
Director of Public Prosecutions

Date modified: