Governance, risk & compliance

Newfoundland and Labrador Access to Information and Protection of Privacy Act, 2015 (ATIPPA) SNL 2015, c A-1.2 (amended to 2026 c16 s2)

Read 24 Oct 2026.

The Access to Information and Protection of Privacy Act, 2015, SNL 2015, c A-1. 2 (assented to 1 June 2015), was read in the King’s Printer version that lists amendments through 2026 c16 s2.

Part III Protection of Personal Information (ss. 61-84) is the privacy part: Division 1 Collection, use and disclosure (ss.

61-72), Division 2 Privacy complaint (ss. 73-80), Division 3 Application to the Trial Division for a declaration (ss.

81-84). The head of a public body must protect personal information with reasonable steps (s.

64(1)), must notify the individual at the first reasonable opportunity when information is stolen, lost, improperly disposed of or disclosed to or accessed by an unauthorized person (s. 64(3)), unless the head reasonably believes there is no risk of significant harm (s.

64(7)), and must inform the Commissioner of a breach involving unauthorized collection, use or disclosure (s. 64(4)); the text of s.

64(4) sets no harm threshold for telling the Commissioner. A minister must submit a privacy impact assessment, or the result of a preliminary assessment, to the minister responsible for the Act when developing a program or service (s.

72). The Commissioner’s general powers include investigations, audits of public body practices, and authorizing collection from other sources (s.

95); after a privacy complaint the Commissioner makes recommendations (s. 76), the head must respond (s.

78), and a head that declines must apply to the Trial Division for a declaration within 10 business days (s. 79); the Commissioner may file an order with the Trial Division where a head that accepted a recommendation fails to act (s.

80). Offences (s.

115): wilful collection, use or disclosure in contravention, gaining access in contravention, misleading or obstructing the Commissioner, or destroying, altering or concealing records to evade an access request: fines of up to $10,000, up to six months in prison, or both; prosecution within two years of discovery. Section 117 sets a committee review of the Act at least every five years.

Not read: the exact in-force date of each Part (only s. 118 and the assent date were seen), the regulations, and the definition of public body in full.

The Personal Health Information Act governs health custodians (see NL_PHIA). Private-sector note: businesses that contract with public bodies are under PIPEDA for their own commercial activity and under their contract and the Act’s duties for the public body’s information.

General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Newfoundland and Labrador Access to Information and Protection of Privacy Act, 2015 (ATIPPA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Newfoundland and Labrador Access to Information and Protection of Privacy Act, 2015 (ATIPPA) compliance

Most of Newfoundland and Labrador Access to Information and Protection of Privacy Act, 2015 (ATIPPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Newfoundland and Labrador Access to Information and Protection of Privacy Act, 2015 (ATIPPA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Newfoundland and Labrador Access to Information and Protection of Privacy Act, 2015 (ATIPPA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Newfoundland and Labrador Access to Information and Protection of Privacy Act, 2015 (ATIPPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.