Client: Government of Ontario – Central Agencies Cluster

Ministry: Ministry of Treasury Board Secretariat

Location: 222 Jarvis Street, Toronto, ON

Work Arrangement: 100% Onsite – Monday to Friday

Start Date: September 28, 2026

End Date: November 18, 2026

Extension: Up to 2 days / maximum 1 extension term

Openings: 1

Security Clearance: No clearance required

Position Overview The Government of Ontario is seeking an experienced Privacy Impact Assessment (PIA) Specialist – Intermediate to lead and/or support the development of Privacy Impact Assessments for new technologies, information systems, digital solutions, programs, policies, and business initiatives.

The successful candidate will assess privacy implications, identify and mitigate privacy risks, and ensure compliance with applicable provincial, municipal, federal, and private-sector privacy legislation, regulations, statutes, OPS policies, directives, standards, guidelines, and internationally accepted Fair Information Practices.

The resource must have demonstrated experience conducting PIAs involving personal information and digital/online solutions, with strong knowledge of Ontario privacy legislation and prior experience conducting multiple PIAs within an Ontario Public Service (OPS) environment.

Key Responsibilities

- Lead or support the development and completion of Privacy Impact Assessments (PIAs) independently or as part of a team.

- Assess new technologies, information systems, online/digital solutions, programs, policies, and business initiatives for privacy implications.

- Identify privacy risks and develop appropriate mitigation strategies and recommendations.

- Research, interpret, and apply applicable privacy legislation, regulations, jurisprudence, policies, directives, standards, and guidelines.

- Ensure privacy requirements are appropriately incorporated into business processes, policies, technology solutions, and system designs.

- Conduct privacy assessments involving the collection, use, disclosure, retention, storage, transfer, and protection of personal information.

- Lead and conduct PIAs involving online and/or digital solutions.

- Evaluate privacy risks associated with web-based applications, backend integrations, APIs, cloud technologies, legacy systems, and system-to-system information exchange.

- Work with policy development teams to review and compare legislation and policies and provide recommendations to strengthen privacy protections.

- Gather information and requirements from business, technical, legal, security, architecture, and other stakeholders.

- Lead discovery sessions to understand technical solutions, business processes, information flows, and privacy requirements.

- Create and interpret data flow diagrams and business process diagrams.

- Review technical documentation such as architecture designs, process flows, state transition diagrams, system interfaces, and related documentation.

- Develop clear assessment findings, recommendations, mitigation strategies, and supporting documentation.

- Communicate privacy findings and recommendations to technical and non-technical stakeholders, senior management, and executives.

- Manage multiple concurrent privacy assessment requests in an agile and highly dynamic environment.

- Recognize when external privacy, legal, security, or technical expertise is required and obtain appropriate input.

- Support privacy education and awareness activities where required.

- Ensure appropriate OPS processes, templates, approvals, and sign-off requirements are followed.

Requirements

Mandatory Skills & Experience

1.

Privacy

Legislation,



Assessment & Policy – 40%

Candidates must demonstrate

- Experience with privacy legislation, including:
- Freedom of Information and Protection of Privacy Act (FIPPA)

- Personal Health Information Protection Act (PHIPA)

- Personal Information Protection and Electronic Documents Act (PIPEDA)

- Experience conducting Privacy Impact Assessments involving personal information, with specific examples clearly identified in the resume.

- Experience leading and conducting privacy assessments involving online and/or digital solutions.

- Experience working with policy development teams and reviewing/comparing policies and legislation to make informed recommendations.

- Knowledge of privacy principles, compliance requirements, privacy-enhancing practices, and risk countermeasures.

- Knowledge of relevant privacy laws, regulations, jurisprudence, and particularly matters relating to the Information and Privacy Commissioner of Ontario (IPC).

2. Technical & Privacy Risk Understanding – 30%

Candidates must demonstrate

- Experience identifying and assessing privacy risks and conducting PIAs across different technology platforms.

- Understanding of security, encryption, privacy protection, and data protection approaches for digital solutions.

- Experience assessing privacy and security considerations for:
- Web-based applications

- Backend integrations

- APIs and similar integration approaches

- Legacy systems

- Digital solutions

- Cloud-based solutions

- Experience assessing privacy risks associated with systems that obtain, retrieve, exchange, and synchronize information.

- Familiarity with cloud-based technologies, including privacy/security considerations, limitations, and data protection best practices.

- Knowledge of privacy protection standards and best practices.

- Understanding of business architecture, information architecture, security architecture, and emerging technologies affecting privacy and personal information.

- Knowledge of IT concepts and processes affecting protection of personal information, including:

- Internet technologies

- System interfaces

- Information security

- Information architecture

- Data flows

3. Leadership & Communication – 20%

Candidates must demonstrate

- Strong communication and stakeholder engagement skills.

- Ability to lead discovery sessions and elicit information regarding:
- Technical solutions

- Business processes

- Policies

- Information flows

- Strong written communication skills for documenting assessments, findings, recommendations, risks, and mitigation strategies.

- Ability to interpret both technical and non-technical documentation.

- Ability to develop practical privacy mitigation strategies.

- Strong organizational and time-management skills.

- Demonstrated ability to manage multiple concurrent requests in an agile and highly dynamic environment.

- Strong presentation skills and the ability to communicate findings and recommendations to senior management and executives.

- Ability to explain complex privacy, security, and technical issues in clear and straightforward terms.

4.

Ontario Public Service

Experience – 10%

This is a key mandatory requirement.

Candidates must demonstrate





- Prior experience leading and conducting multiple PIAs within an Ontario Public Service (OPS) setting/environment.

- Demonstrated knowledge and practical experience with OPS privacy processes, existing PIA templates, requirements, expectations, approval processes, and sign-off procedures.

- Familiarity with Ontario government policies, directives, standards, and procedures relevant to privacy and information management.

Additional Required Knowledge The successful candidate should also possess:

- Knowledge and ability to interpret and apply:
- FIPPA

- MFIPPA

- PHIPA

- Related regulations and jurisprudence

- Familiarity with PIPEDA and the US PATRIOT Act.

- Familiarity with OPS Privacy Impact Assessment processes and tools released by the Ontario Ministry of Government Services.

- Knowledge of records and information management, including:

- Classification

- Retention

- Disposition

- Records-related policies, directives, standards, business rules, procedures, and guidelines

- Experience developing risk assessment tools, methodologies, policies, and procedures for effectively managing personal information.

- Understanding of the Accessibility for Ontarians with Disabilities Act (AODA) and related regulations and standards.

- Understanding of related disciplines including:

- IT security

- IT/system design

- Privacy/security policy development

- Business architecture

- Legal processes

- Freedom of Information administration

- Business analysis

- Risk management

- Project management

Nice-to-Have Qualifications

- Professional certification in a related discipline such as:
- IT Security

- Information/Technology Architecture

- Privacy

- Information Management

- Experience providing privacy education and training.

- Knowledge and experience with Ontario government policies and procedures, including:

- Business case development

- Project approvals

- Policy development

- OPS governance processes

- Experience interpreting architecture design documents, process flows, and state transition diagrams.

- Experience with cloud-based technologies and associated privacy/security considerations.

Work Environment

This is a 100% onsite position at the Ontario Public Service office located at:

222 Jarvis Street, Toronto, Ontario The successful candidate is expected to work:

- Monday to Friday

- 7.25 hours per calendar day, excluding lunch

- Within standard working hours of 8:00 AM–5:00 PM

Critical Candidate Requirements

Before submission, candidates should be able to clearly demonstrate the following on their resume:

1. FIPPA experience

2. PHIPA experience

3. PIPEDA experience

4. Multiple Privacy Impact Assessments involving personal information

5. PIAs involving online/digital solutions

6. Privacy risk assessment experience

7. Experience with security/privacy challenges across technology platforms

8. Experience with web applications, backend integrations and/or APIs

9. Experience with legacy, digital, and/or cloud-based systems

10. Multiple PIAs conducted within an OPS environment

11. Knowledge of OPS PIA processes, templates, approvals and sign-off

12. Ability to manage multiple concurrent PIA requests

13. Strong stakeholder engagement and communication skills

14. Ability to interpret technical and non-technical documentation

15. Ability to develop privacy mitigation strategies and recommendations

Submission Limit: Maximum 1 candidate.

Important: Candidates who do not clearly demonstrate the mandatory privacy legislation, PIA, digital-solution, and OPS PIA experience requirements in their resume should not be submitted.

📌 Privacy Impact Assessment (PIA) Specialist – Intermediate (Toronto)
🏢 Upstaff
📍 Toronto