Governance, risk & compliance

Manitoba Freedom of Information and Protection of Privacy Act (FIPPA) C.C.S.M. c. F175; M.R. 64/98

The Freedom of Information and Protection of Privacy Act (FIPPA), C.

C. S.

M. c.

F175, and the Access and Privacy Regulation, M. R.

64/98. FIPPA governs personal information held by public bodies: departments, government agencies, the Executive Council Office, ministers’ offices and local public bodies (educational bodies, health care bodies and local government bodies, including the City of Winnipeg), with the exceptions listed in s.

1. Personal health information held by a public body is dealt with under PHIA instead (ss.

6 and 35). The definition of employee includes a person who performs services for a public body under a contract or agency relationship (s.

1), so a contractor’s staff are held to the same standard. Section 41 requires reasonable administrative, technical and physical safeguards.

Section 44. 1 allows a public body to give personal information to an information manager (a person or body that processes, stores or destroys it, or provides information management or information technology services) only under a written agreement that protects it against unauthorized access, use, disclosure, destruction or alteration; the information manager must meet the same protection requirements, and failing to do so is an offence (s.

85(1)(e)). Since 1 January 2022 (S.

M. 2021, c.

43) the head of a public body must notify an individual about a privacy breach that could reasonably be expected to create a real risk of significant harm, and must also notify the Ombudsman (s. 41.

1; Regulation ss. 3.

1 to 3. 3).

Offences, including wilful failure to give that notice, carry fines up to $50,000 (s. 85); an employee who reports in good faith to the Ombudsman is protected (ss.

41. 2 and 86).

The Regulation requires an access and privacy coordinator (s. 2).

The Ombudsman investigates privacy complaints and an adjudicator reviews access decisions. No data residency rule was found in FIPPA.

The Manitoba site lists an amendment to FIPPA in S. M.

2025, c. 33, s.

74 as not yet proclaimed; its content was not read. The Public Sector Artificial Intelligence and Cybersecurity Governance Act (S.

M. 2026, c.

43, assented 1 June 2026) is not in force and applies only to public sector entities that regulation prescribes. This framework applies the existing Act to AI tools; it does not add AI rules.

General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Manitoba Freedom of Information and Protection of Privacy Act (FIPPA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Manitoba Freedom of Information and Protection of Privacy Act (FIPPA) compliance

Most of Manitoba Freedom of Information and Protection of Privacy Act (FIPPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Manitoba Freedom of Information and Protection of Privacy Act (FIPPA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Manitoba Freedom of Information and Protection of Privacy Act (FIPPA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Manitoba Freedom of Information and Protection of Privacy Act (FIPPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.