Governance, risk & compliance

Nunavut Access to Information and Protection of Privacy Act (ATIPPA) SNWT 1994, c 20 as duplicated for Nunavut (2012 office consolidation)

PARTLY VERIFIED.

Read 24 Oct 2026. The Nunavut legislation site would not serve the current consolidation (robots restriction), so the text read is the office consolidation of the S.

N. W.

T. 1994, c.

20 as duplicated for Nunavut, current to 5 December 2012, which says it is not an official statement of the law. That consolidation marks Division D (review and recommendations) and Division E (data breach notification) as not in force (S.

Nu. 2012, c.

13), but the Information and Privacy Commissioner’s 2023-24 and 2024-25 annual reports and the Government of Nunavut Privacy Breach Policy (revised 26 June 2025) apply the breach provisions, so they are treated as in force; check the current consolidation. Part 2 Protection of privacy: collection only for an authorized purpose (s.

40), collection from the individual where reasonably possible (s. 41), protection of personal information by reasonable security arrangements (s.

42), use for the purpose collected or a consistent use (s. 43), correction (ss.

45-46), disclosure (ss. 47-49).

Division E: a public body must report a material breach to the Commissioner as soon as reasonably possible (s. 49.

9), notify an individual where there is a real risk of significant harm (s. 49.

10), and tell other bodies that can reduce the harm (s. 49.

11); the Commissioner may recommend steps (s. 49.

12) and, after a recommendation is ignored or in the public interest, may disclose the breach (s. 49.

14). The Commissioner makes recommendations; the head decides what to do.

Offence (s. 59): knowingly collecting, using or disclosing contrary to the Act is punishable by a fine of up to $5,000, and obstruction by up to $5,000.

Public body means a Government of Nunavut department, branch or office and bodies designated in the regulations. No Nunavut health information statute was found: the 2023-24 and 2024-25 reports and the 2012 consolidation show personal health information being handled under this Act and Government of Nunavut policy.

Private-sector note: PIPEDA applies to commercial activity in Nunavut, which the OPC treats as federally regulated. General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Nunavut Access to Information and Protection of Privacy Act (ATIPPA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Nunavut Access to Information and Protection of Privacy Act (ATIPPA) compliance

Most of Nunavut Access to Information and Protection of Privacy Act (ATIPPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Nunavut Access to Information and Protection of Privacy Act (ATIPPA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Nunavut Access to Information and Protection of Privacy Act (ATIPPA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Nunavut Access to Information and Protection of Privacy Act (ATIPPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.