Senior Privacy Impact Assessment (PIA) Specialist

Position Title: Privacy Impact Assessment (PIA) Specialist – Senior

Client: Government of Ontario – Health Services Cluster

Ministry: Ministry of Public and Business Service Delivery and Procurement

Location: 222 Jarvis Street, Toronto, ON, or 49 Place d’Armes, Kingston, ON

Work Arrangement: 100% Onsite – 5 days per week

Contract Start Date: October 13, 2026

Contract End Date: November 17, 2026

Allocation: 100%

Work Schedule: 7.25 hours per day, Monday to Friday, within standard business hours of 8:00 AM to 5:00 PM, excluding lunch

Security Clearance: CRJMC

Submission Deadline: October 27, 2026, at 1:00 PM

Maximum Submissions: One candidate per supplier

Position Overview

The Government of Ontario is seeking an experienced Senior Privacy Impact Assessment (PIA) Specialist to lead or support the development of Privacy Impact Assessments for new technologies, information systems, programs, policies, and business initiatives.

The successful candidate will assess compliance with applicable privacy legislation, government policies, regulations, standards, and internationally recognized Fair Information Practices. The specialist will identify privacy risks, recommend mitigation measures, address stakeholder concerns, and ensure that the collection, use, disclosure, storage, retention, and disposal of personal information are appropriately managed.

The ideal candidate will combine strong knowledge of Ontario public-sector privacy requirements with expertise in information technology, security, business processes, risk assessment, records management, and stakeholder engagement.

Key Responsibilities

• Lead, manage, or support the preparation and completion of Privacy Impact Assessments independently or collaboratively with multidisciplinary teams.
  

• Evaluate proposed and existing technologies, information systems, policies, programs, and business initiatives for privacy compliance and risk exposure.
  

• Apply relevant provincial, municipal, federal, and private-sector privacy and access-to-information legislation, regulations, statutes, jurisprudence, and government policies.
  

• Interpret and apply Ontario's Freedom of Information and Protection of Privacy Act (FIPPA), Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), and Personal Health Information Protection Act (PHIPA), including applicable regulations and related jurisprudence.
  

• Research and apply relevant decisions and guidance from the Information and Privacy Commissioner of Ontario (IPC).
  

• Identify privacy threats, assess risks, develop mitigation strategies, and recommend privacy-enhancing practices and controls.
  

• Gather and analyze information from business owners, program leads, technical teams, privacy officers, IT security professionals, legal advisors, and other stakeholders.
  

• Develop, review, and interpret data flow diagrams, business process diagrams, information architecture, and system interfaces to identify privacy implications.
  

• Assess how IT infrastructure, Internet-based tools, information systems, security controls, and data flows affect the protection of personal information.
  

• Analyze the current and future privacy implications of proposed policies, operational decisions, technology implementations, and business processes.
  

• Develop and apply risk assessment tools, methodologies, policies, procedures, and controls for the effective management of personal information.
  

• Ensure alignment with records management requirements, including information classification, retention, disposition, and applicable policies, directives, standards, business rules, procedures, and guidelines.
  

• Consider accessibility obligations under the Accessibility for Ontarians with Disabilities Act (AODA) and related regulations and standards.
  

• Communicate privacy risks, findings, recommendations, and compliance requirements clearly to technical and non-technical audiences.
  

• Identify situations requiring specialized external expertise and coordinate the appropriate consultation.
  

• Support privacy awareness, education, and training activities as required.
  

Requirements

Mandatory Skills and Qualifications

1. Policy Knowledge and Government Privacy Frameworks

• Familiarity with the Ontario Public Service (OPS) Privacy Impact Assessment Process and Tools released by the Ontario Ministry of Government Services.
  

• Strong understanding of related disciplines, including:
  

• IT security and IT system design.
  

• Privacy and security policy development.
  

• Business architecture and business analysis.
  

• Legal processes and Freedom of Information administration.
  

• Risk management and project management.
  

• Knowledge of applicable privacy laws, regulations, jurisprudence, and risk countermeasures.
  

• Ability to interpret and apply FIPPA, MFIPPA, and PHIPA, including their respective regulations and related jurisprudence.
  

• Familiarity with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and the US PATRIOT Act.
  

• Understanding of privacy-enhancing best practices and internationally accepted Fair Information Practices.
  

• Ability to assess compliance with relevant OPS policies, directives, standards, guidelines, and other applicable legal requirements.
  

2. Operational Program and Business Design Skills

• Demonstrated ability to lead, manage, or support the development of Privacy Impact Assessments , independently or as part of a team.
  

• Ability to direct information-gathering activities and obtain input from relevant stakeholders across an organization.
  

• Knowledge of and ability to create, interpret, and analyze data flow diagrams and business process diagrams.
  

• Ability to recognize when external experts are required and obtain appropriate input.
  

• Experience evaluating business processes, programs, policies, and information systems to identify privacy implications and recommend appropriate mitigation measures.
  

3. Communication and Stakeholder Engagement

• Excellent written and verbal communication skills, including the ability to communicate complex privacy requirements to technical and business audiences and individuals without specialized access-and-privacy knowledge.
  

• Ability to explain privacy risks, legislative obligations, assessment findings, and recommended controls in clear, practical language.
  

• Strong stakeholder consultation, facilitation, analytical, and documentation skills.
  

• Ability to gather requirements, clarify business and technical processes, and translate findings into actionable recommendations.
  

4. Technology and Systems Knowledge

• Strong analytical skills to understand current and future access and privacy implications arising from policies, decisions, systems, and business initiatives.
  

• Knowledge of IT concepts and processes that affect the protection of personal information, including:
  

• Internet tools and technologies.
  

• System interfaces and integrations.
  

• Information security and privacy controls.
  

• Information architecture.
  

• Data flows and information exchange.
  

• Ability to assess how system design, technology architecture, and operational processes influence privacy risks and compliance.
  

• Understanding of the relationship between IT security, information management, privacy requirements, and business operations.
  

5. Information and Records Management

• Experience developing or applying risk assessment tools, methodologies, policies, and procedures to manage personal information effectively.
  

• Knowledge of records management policies, directives, standards, business rules, procedures, and guidelines.
  

• Understanding of information classification, retention, disposition, and appropriate handling of records containing personal information.
  

• Ability to identify records management and information-handling risks and recommend appropriate controls.
  

6. Accessibility Knowledge

• Knowledge and understanding of the Accessibility for Ontarians with Disabilities Act (AODA) and its related regulations and standards.
  

• Ability to consider applicable accessibility requirements when assessing policies, programs, technologies, and service delivery processes.
  

Desirable Qualifications

• Professional certification in a related discipline, such as IT security or architecture.
  

• Experience delivering privacy education, awareness, or training.
  

• Knowledge of Ontario government policies and procedures, including business case development, project approvals, and policy development.
  

• Experience working in a public-sector environment, particularly within the Ontario Public Service or a healthcare-related organization.
  

Evaluation Criteria and Point Distribution

Candidates will be evaluated against the following weighted criteria:

Evaluation Category
Weight

20 points

20 points

20 points

20 points

10 points

5 points

5 points

100 points

Mandatory Submission Requirements

Candidates should clearly demonstrate all four critical supplier-identified requirements in their resumes:

1. Familiarity with the OPS Privacy Impact Assessment Process and Tools released by the Ontario Ministry of Government Services.
   

2. A strong understanding of related disciplines, including IT security, IT system design, privacy/security policy development, business architecture, legal processes, Freedom of Information administration, business analysis, risk management, and project management.
   

3. Demonstrated ability to lead, manage, or support PIA development independently or as part of a team, including directing activities and gathering input from relevant stakeholders.
   

4. Knowledge of IT concepts and processes affecting personal information protection, including Internet tools, system interfaces, information security, information architecture, and data flows.