Governance, risk & compliance

Nova Scotia public sector privacy (FOIPOP, PIIDPA and the 2027 Act) 1993 Act, PIIDPA; 2025 c. 13 from 1 Apr 2027

Nova Scotia public sector privacy, across the change of law on 1 April 2027.

Today: provincial departments, agencies and local public bodies (hospitals, universities, education entities) are under the Freedom of Information and Protection of Privacy Act, S. N.

S. 1993, c.

5; municipalities are under Part XX of the Municipal Government Act; and both, with their service providers, are under the Personal Information International Disclosure Protection Act (PIIDPA, S. N.

S. 2006, c.

3), which requires personal information to be stored and accessed only in Canada unless the individual consents, the storage or access is for a permitted disclosure, or the head of the public body allows it to meet the necessary requirements of its operation and reports that decision to the Minister (s. 5).

PIIDPA binds service providers, their employees and associates (affiliates and subcontractors) directly, requires anyone who receives a foreign demand for disclosure to notify the Minister immediately (s. 6), and fines a corporate service provider up to $500,000 (s.

13). The current law has no statutory privacy breach notification duty.

From 1 April 2027: the Freedom of Information and Protection of Privacy Act, S. N.

S. 2025 (Fall), c.

13, replaces the 1993 Act, Part XX of the Municipal Government Act, the Privacy Review Officer Act and PIIDPA (ss. 151, 164, 166, 167, 171).

It adds a privacy policy (s. 52), privacy assessments before a new or substantially changed project, program, system or activity (s.

53), notification of the affected individual and the Information and Privacy Commissioner where it is reasonable to believe an individual could experience significant harm (s. 78), and replaces PIIDPA with s.

76: no disclosure, storage or access outside Canada except in accordance with the regulations, which had not been published as of 19 October 2026. Contracts committed on or before 30 April 2027 stay under PIIDPA's rules for their term; contracts committed from 1 May 2027 follow s.

76 (s. 147).

Offences carry fines up to $10,000 or imprisonment for individuals and $50,000 for corporations (s. 140).

Pick the tier for the period being assessed (current law, the 2025 Act, or both during the transition), and the service provider tier if you provide services to a Nova Scotia public body or municipality. Provincial departments must also follow Government Policy 3.

18 on responsible use of AI; it is mapped in the AI domain. Private businesses in Nova Scotia are under PIPEDA instead.

General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Nova Scotia public sector privacy (FOIPOP, PIIDPA and the 2027 Act) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Nova Scotia public sector privacy (FOIPOP, PIIDPA and the 2027 Act) compliance

Most of Nova Scotia public sector privacy (FOIPOP, PIIDPA and the 2027 Act) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Nova Scotia public sector privacy (FOIPOP, PIIDPA and the 2027 Act), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Nova Scotia public sector privacy (FOIPOP, PIIDPA and the 2027 Act) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Nova Scotia public sector privacy (FOIPOP, PIIDPA and the 2027 Act) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.