Governance, risk & compliance
Saskatchewan public sector privacy (FOIP and LA FOIP) S.S. 1990-91, c. F-22.01 and c. L-27.1
Saskatchewan public sector privacy is in two parallel statutes.
The Freedom of Information and Protection of Privacy Act (FOIP), S. S.
1990-91, c. F-22.
01, applies to government institutions: Executive Council, departments and secretariats, and prescribed boards, commissions and Crown corporations. The Local Authority Freedom of Information and Protection of Privacy Act (LA FOIP), S.
S. 1990-91, c.
L-27. 1, applies to local authorities: municipalities, school boards, libraries, police services, regional colleges, Saskatchewan Polytechnic, the universities and the provincial health authority and its affiliates.
Personal health information held by a trustee is under HIPA (SK_HIPA). Each statute requires policies and procedures for administrative, technical and physical safeguards (FOIP s.
24. 1; LA FOIP s.
23. 1) and sets rules for an information management service provider (IMSP): the institution may give personal information to an IMSP only under a written agreement that governs access, use, disclosure, storage, archiving, modification and destruction and provides for protection, the IMSP may not use or disclose the information for any other purpose, and it must follow the agreement (FOIP s.
24. 2; LA FOIP s.
23. 2).
The Regulations say what the agreement must contain: a description of the service, security and safeguarding obligations, and destruction provisions (FOIP Regulations s. 13.
1; LA FOIP Regulations s. 8.
2). An institution must take all reasonable steps to notify an individual of an unauthorized use or disclosure that creates a real risk of significant harm (FOIP s.
29. 1; LA FOIP s.
28. 1); notifying the Information and Privacy Commissioner (IPC) is not mandatory, but the IPC’s guidelines (May 2023) encourage proactive reporting and call notifying individuals best practice.
Knowingly collecting, using or disclosing personal information in contravention of the Act is an offence with a fine up to $50,000, up to one year in jail, or both, and a prosecution needs the Attorney General’s consent; employees of an institution or IMSP who wilfully snoop or knowingly direct a disclosure are also liable (FOIP s. 68; LA FOIP s.
56). No data residency rule was found in either statute.
Saskatchewan has no private-sector privacy statute found, so PIPEDA applies to commercial activity in Saskatchewan. Bill 628, a private member’s bill to amend FOIP, is not law.
This framework applies the existing statutes to AI tools; it does not add AI rules. General information, not legal advice.
Assessment tiers & levels Lavawall supports
Lavawall assesses Saskatchewan public sector privacy (FOIP and LA FOIP) at every level below, so you can start where you are and step up as your program matures.
| Tier / level | What it covers | Builds on lower |
|---|---|---|
| Government institution (FOIP) | Executive Council, a department, secretariat or other agency of the executive government, or a prescribed board, commission or Crown corporation (FOIP s. 2(1)(d)). Duties under FOIP ss. 24.1, 24.2, 25 to 29.1. | — |
| Local authority (LA FOIP) | A municipality, school board, library board, police service, regional college, Saskatchewan Polytechnic, university, the provincial health authority or an affiliate, and other bodies listed in LA FOIP s. 2(1)(f). Duties under LA FOIP ss. 23.1, 23.2, 24 to 28.1. | — |
| Information management service provider | A person or body, including a managed service provider or cloud or software provider, that processes, stores, archives or destroys personal information for a government institution or local authority or provides it with information management or IT services. Bound by the written agreement and permitted purposes (FOIP s. 24.2(3), (4); LA FOIP s. 23.2(3), (4)); employees who wilfully snoop or knowingly direct a disclosure commit an offence (FOIP s. 68(8); LA FOIP s. 56). | — |
How Lavawall® helps you get to Saskatchewan public sector privacy (FOIP and LA FOIP) compliance
Most of Saskatchewan public sector privacy (FOIP and LA FOIP) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Saskatchewan public sector privacy (FOIP and LA FOIP), and tracks your posture continuously instead of once a year at audit time.
- Assess your current state against Saskatchewan public sector privacy (FOIP and LA FOIP) in the Lavawall GRC module, with the questionnaire and control set built in.
- Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
- Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.
Related
Lavawall® supports Saskatchewan public sector privacy (FOIP and LA FOIP) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.
At a glance
- Framework
- Saskatchewan public sector privacy (FOIP and LA FOIP) S.S. 1990-91, c. F-22.01 and c. L-27.1
- Category
- Regional
- Region
- Canada - Saskatchewan
- Levels
- 3 assessment tiers
All Saskatchewan, Canada frameworks and training →
Map this framework freeTalk to our team