Governance, risk & compliance
New Brunswick Right to Information and Protection of Privacy Act (RTIPPA) S.N.B. 2009, c. R-10.6; N.B. Reg. 2010-111
The Right to Information and Protection of Privacy Act (RTIPPA), S.
N. B.
2009, c. R-10.
6, and General Regulation 2010-111. RTIPPA governs personal information held by public bodies: departments, secretariats and offices of the Province, listed Crown corporations, boards and commissions, ministers’ offices and local public bodies (educational bodies such as schools, school districts and the universities, health care bodies such as the regional health authorities, and local government bodies), with the exclusions in s.
1. Personal health information held by a custodian is under PHIPAA (NB_PHIPAA).
Section 48. 1 requires information practices and reasonable security arrangements, and designation of an officer to oversee compliance and take complaints (s.
48. 1(4)).
Regulation s. 4.
2 spells out the arrangements: identify who may access what, allow only that access, verify identity, record and monitor access, protect information in storage and transfer, require officers, employees and agents to comply, and periodically test and evaluate the arrangements. Breach duties sit in the Regulation, not the Act: a public body must investigate every reported or suspected privacy breach, keep a registry of actual breaches and corrective measures, notify a person as soon as possible when there is a risk of significant harm, and notify the Commissioner as soon as possible (Regulation s.
4. 2(4)); the Regulation still says Commissioner although the Act now refers to the Ombud (S.
N. B.
2019, c. 19, per the amendment notes), which this framework treats as the Ombud.
RTIPPA has no information manager clause like PHIPAA’s; the nearest rules are the agent and contractor staff covered by Regulation s. 4.
2(2) and (3), and the written agreements for common or integrated services with non-public bodies (s. 46.
2; Regulation s. 4.
1). A person, including a non-public body that signed a s.
46. 2 agreement and its employees, who wilfully collects, uses or discloses personal information in contravention of the Act commits a category F offence under the Provincial Offences Procedure Act (s.
82), with a fine of $240 to $10,200 under s. 56(6) of that Act as displayed when read.
No data residency rule was found in RTIPPA. The Province published a review report on RTIPPA on 18 June 2026 and plans a bill for a later session; no bill was read, and nothing here depends on it.
New Brunswick has no private-sector privacy statute found, so PIPEDA applies to commercial activity in New Brunswick outside the PHIPAA custodian exemption. This framework applies the existing Act to AI tools; it does not add AI rules.
General information, not legal advice.
Assessment tiers & levels Lavawall supports
Lavawall assesses New Brunswick Right to Information and Protection of Privacy Act (RTIPPA) at every level below, so you can start where you are and step up as your program matures.
| Tier / level | What it covers | Builds on lower |
|---|---|---|
| Public body | A public body under s. 1: a department, secretariat or office of the Province, a listed Crown corporation, board or commission, a minister’s office or a local public body (educational, health care or local government body). Owns information practices, security arrangements, the designated officer, the breach registry and notice to the individual and the Commissioner (Ombud). | — |
| Agent / service provider | A contractor, managed service provider or other agent that handles a public body’s personal information. RTIPPA names no information manager; the duties reach agents through Regulation s. 4.2(2) and (3) (officers, directors, employees and agents must follow the security arrangements) and, for non-public bodies in a common or integrated service, through the s. 46.2 agreement and the s. 82(1.1) offence. | — |
How Lavawall® helps you get to New Brunswick Right to Information and Protection of Privacy Act (RTIPPA) compliance
Most of New Brunswick Right to Information and Protection of Privacy Act (RTIPPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to New Brunswick Right to Information and Protection of Privacy Act (RTIPPA), and tracks your posture continuously instead of once a year at audit time.
- Assess your current state against New Brunswick Right to Information and Protection of Privacy Act (RTIPPA) in the Lavawall GRC module, with the questionnaire and control set built in.
- Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
- Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.
Related
Lavawall® supports New Brunswick Right to Information and Protection of Privacy Act (RTIPPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.
At a glance
- Framework
- New Brunswick Right to Information and Protection of Privacy Act (RTIPPA) S.N.B. 2009, c. R-10.6; N.B. Reg. 2010-111
- Category
- Regional
- Region
- Canada - New Brunswick
- Levels
- 2 assessment tiers
All New Brunswick, Canada frameworks and training →
Map this framework freeTalk to our team