Governance, risk & compliance

Northwest Territories Access to Information and Protection of Privacy Act (ATIPPA) SNWT 1994, c 20; amended SNWT 2019, c 8 (in force 30 Jul 2021)

PARTLY VERIFIED.

Read 24 Oct 2026. The NWT justice site could not be retrieved, so the consolidated Act was not read.

This framework rests on the Commissioner’s 2021-22 annual report (TD 711-19(2)), the Health Information Act Ten-Year Report (October 2025), the GNWT news release on the 2021 amendments, and the Standing Committee’s Bill 29 report (May 2019), which includes the committee’s motion text for the breach provisions. The amendments in SNWT 2019, c 8 (Bill 29) came into force on 30 July 2021.

They added Division E of Part 2, Data breach notification: a public body must report a material breach of privacy to the Commissioner as soon as reasonably possible (s. 49.

9), judged on sensitivity, number of individuals, likelihood of harm and whether the cause is systemic; it must notify an individual when the breach creates a real risk of significant harm (s. 49.

10), and notify other government bodies that can reduce the harm (s. 49.

11). The Commissioner may recommend further notice, steps to limit the consequences and steps to prevent recurrence (s.

49. 12 as in the committee text), and the head reports on implementing accepted recommendations within 120 business days (s.

49. 14, quoted in the annual report).

The Commissioner can now issue binding orders at the end of reviews (from 30 July 2021) and can start a review without a complaint; Bill 37 (in force 30 March 2022) replaced s. 49.

5, which gives the Commissioner jurisdiction to report and make orders on unauthorized collection, use or disclosure. A public body must prepare a privacy impact assessment during development of a proposed enactment, system, project, program or service (s.

42. 1).

Penalty amounts and the section numbers for collection, use and disclosure were not read. The breach section numbers match the Nunavut text of the same Division; the committee motion may differ from the enacted words, so check the Act.

Private-sector note: PIPEDA applies to commercial activity in the Northwest Territories. General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Northwest Territories Access to Information and Protection of Privacy Act (ATIPPA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Northwest Territories Access to Information and Protection of Privacy Act (ATIPPA) compliance

Most of Northwest Territories Access to Information and Protection of Privacy Act (ATIPPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Northwest Territories Access to Information and Protection of Privacy Act (ATIPPA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Northwest Territories Access to Information and Protection of Privacy Act (ATIPPA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Northwest Territories Access to Information and Protection of Privacy Act (ATIPPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.