Annual Report 2025—2026 Administration of the Privacy Act

1. 2025-2026 Highlights

• During the 2025–2026 fiscal year, the on-time compliance rate for Privacy Act requests stood at 26%.
• There was a 35% decrease in Privacy Act requests from the 2024–2025 fiscal year (6,057 Privacy Act requests received during the 2025–2026 fiscal year).
• 91% of the Privacy Act requests received were from individuals seeking the status of their (or someone else’s) immigration/citizenship application.
• 57% of the overall Privacy Act requests were from foreign nationals located outside of Canada (representing 3,478 requests).

2. Summary

Security threats against Canada and its allies continued in 2025–2026. With increasing geopolitical and security challenges, foreign actors are increasingly trying to undermine Canada’s sovereignty, safety and security.

This year, CSIS made important efforts to reprioritize work around initiatives that drive greater value, grew its bilateral and multilateral relationships and deepened international partnerships. It also implemented its comprehensive expenditure review toward savings of 15%, and focused on developing leadership skills and improving the workplace environment.

Within this context, CSIS remains committed to being as transparent with Canadians as possible, while protecting national security sensitivities and privileged information. It is, in part, through the Access to Information and Privacy (ATIP) program that CSIS achieves this transparency, a program that has performed very well and has had, historically, high on-time compliance rates. In recent years, however, the CSIS ATIP program has faced challenges and substantial workloads leading to a continued drop in performance. For instance, the on-time compliance rate for Access to Information Act (ATIA) requests dropped from 77% in 2024–2025 to 68% in 2025–2026. This decline is largely due to the 12% increase in requests, the vacancies in the ATIP Unit throughout the fiscal year and the sheer volume of pages needing to be processed. While compliance decreased slightly during this reporting period, the CSIS ATIP Section reviewed 42% more pages than in 2024–2025. For Privacy Act requests, compliance fell sharply from 66% to 26%. This decline is mostly due to the surge in requests filed by individuals seeking the status of their immigration and citizenship applications. A total of 4,687 requests related to immigration status were carried over from 2024–2025 to 2025–2026. CSIS ATIP began this fiscal year with a mountain of backlog work. The constant and large volume of immigration-related requests significantly challenges the program’s manageability. The CSIS ATIP Section is relatively small and analysts work on a wide range of requests. This influx of immigration-related Privacy Act work and other pressures have and will continue having an impact on the overall on-time compliance rate.

The ATIP Section’s management team took the following steps to deal with some of these pressures. This includes:

• streamlining administrative processes to increase efficiencies;
• partnering with Library Archives Canada (LAC) on a pilot project to actively work through a significant backlog of historical records;
• streamlining consultations by setting clear expectations; 
• engaging with partners to better address client requirements for information regarding the immigration process;
• purchasing and working towards the implementation of a new ATIP processing software;
• utilizing full digitization of our internal business processes; and
• rebuilding the ATIP Section with a number of staffing strategies to fill the capacity gaps.

The collective impact of the aforementioned lines of efforts are expected—with time—to yield some efficiencies in processing time and improve on-time compliance rates. However, the sheer number of immigration-related requests that remain unopened and unprocessed will continue to grow, as long as requesters continue to turn to the access to information and privacy system to determine the status of their immigration/citizenship applications.

3. Introduction

The Privacy Act provides all individuals with the right to access their personal information under the control of the Government of Canada. The right of access to personal information is balanced against the legitimate need to protect sensitive information and to maintain the effective functioning of government, while promoting transparency and accountability in government institutions. The Privacy Act protects an individual’s privacy by preventing others from accessing his or her personal information, and manages the collection, retention, use and disclosure of personal information.

CSIS prepared this report for tabling in Parliament in accordance with section 72 of the Privacy Act. It covers the way in which the CSIS administered the Privacy Act from April 1, 2025, to March 31, 2026.

CSIS is not reporting on behalf of wholly owned subsidiaries or non-operational institutions.

4. CSIS mandate

CSIS’ mandate is to investigate activities that fall within the definition of threats to the security of Canada, as outlined in the CSIS Act. Specifically, CSIS is authorized to investigate espionage and sabotage, foreign interference, terrorism and violent extremism and subversion. CSIS is prohibited from investigating lawful advocacy, protest and dissent. The duties and functions of CSIS are to:

• Investigate activities suspected of constituting threats to the security of Canada, report and advise on these threats to the Government of Canada.
• Take measures to reduce threats if there are reasonable grounds to believe the security of Canada is at risk.
• Provide security assessments on individuals who require access to classified information or sensitive sites within the government of Canada.
• Provide security advice relevant to the exercise of the Citizenship Act or the Immigration and Refugee Protection Act.
• Conduct foreign collection with Canada at the request of the Minister of Foreign Affairs or the Minister of National Defence.
• Provide Integrated Threat Assessment Center (ITAC) assessments that inform the Government of Canada’s decisions and actions relating to the terrorism threat.

5. Organizational structure

In 2025–2026, the ATIP Section remained under the Deputy Director, Policy and Strategic Partnerships Directorate. The employees of the ATIP Section are fully dedicated to the administration of both the Privacy Act and the Access to Information Act (ATIA) programs within CSIS, providing high quality and timely responses to internal and external clients, including other government departments, as well as providing advice to CSIS employees as they fulfill their obligations under both acts. The CSIS Legal Services Branch, staffed by Department of Justice Canada lawyers, provides legal advice as required.

The Director General of the Litigation and Disclosure Branch, within the Directorate, is supported by the Chief (Coordinator), ATIP Section. There are three key units, namely the ATIP Intake/Governance Unit and two ATIP operational units. These units worked together to process ATIP requests in accordance with legislation, regulations, policies and directives. Their responsibilities include:

• receiving and processing all requests in accordance with the Privacy Act;
• assisting requesters in formulating their requests when required;
• gathering all pertinent records and ensuring rigorous and complete searches;
• conducting the initial review of the records and providing recommendations to program areas;
• applying all discretionary and mandatory exemptions under the Privacy Act;
• conducting and responding to all internal and external consultations;
• consolidating the recommendations;
• assisting the Office of the Privacy Commissioner (OPC) in all privacy related matters including complaints against CSIS;
• representing CSIS in privacy litigation cases;
• coordinating the annual Info Source update and submission to the Treasury Board of Canada Secretariat (TBS);
• preparing the Annual Report on the Administration of the Privacy Act;
• providing ongoing advice and guidance to senior management and departmental staff on all matters related to the Privacy Act;
• ensuring all employees are aware of the obligations imposed by the legislation;
• monitoring relevant changes to procedures/policies and court cases impacting the Privacy Act; and
• participating in ATIP community activities, such as TBS ATIP community meetings and various working groups.

The ATIP Section is comprised of 22 full-time and three part-time term positions at various levels. These positions included one chief (coordinator), one deputy chief, two unit heads, two senior analysts, 12 analysts, three ATIP officers, one researcher and three part-time analysts. For 2025–2026, a senior analyst and the three part-time term analysts worked solely on ATIA consultations from LAC for historical records of the Royal Canadian Mounted Police (RCMP) Security Service. The role of the second senior analyst position included processing formal and complex ATIA requests, special projects and proactive publication obligations under Part 2 of the ATIA. Some of these positions remained vacant with a 27% vacancy rate throughout the fiscal year. The vacancies in the ATIP Section are complicated by challenges with recruitment and staffing, where attracting ATIP analysts to CSIS, given the unique work requirements, is difficult, and the hiring process is lengthy. The ATIP Section also welcomed a new CSIS ATIP coordinator in March 2025.

Also operating under the Policy and Strategic Partnerships Directorate, and within the Policy, Planning, and Accountability (PPA) Branch is the Privacy Management Unit (PMU). During the 2025–2026 reporting period, the PMU was staffed by three full-time positions, one unit head and two analysts. The PMU plays a critical role in ensuring the organization’s adherence to privacy laws and regulations, while promoting transparency and accountability in its operations.

As defined in section 73.1 of the Privacy Act, CSIS did not provide or receive services related to any power, duty or function to or from another government institution, during this reporting period. 

6. Delegation order

In 2024, pursuant to subsection 73(1) of the Privacy Act, the then-Minister of Public Safety, Democratic Institutions and Intergovernmental Affairs delegated the powers, duties and functions for the administration of the Privacy Act to CSIS employees in the following positions:

• Director
• Deputy Director, Policy and Strategic Partnership
• Director General, External Review and Compliance (Section 10 of the Privacy Act)
• Director General, Litigation and Disclosure
• Chief, ATIP Section
• Deputy Chief and Unit Head, ATIP Section

The Delegation Order (Annex A) issued by the Honourable Dominic LeBlanc, P.C., K.C., M.P., on April 25, 2024, remained in effect at the end of this reporting period. During the 2025–2026 fiscal year, the DDP Directorate was restructured to refocus its core activities, streamline decision-making and improve efficiency. The restructuring required the review of the 2024 delegation orders. Following a thorough review, the updated delegation orders were issued by the Honourable Gary Anandasangaree, P.C., K.C., M.P., as Minister of Public Safety on July 16, 2026. They will be included as part of the next CSIS ATIA and Privacy Act annual reports. 

7. Interpretation of the 2025–2026 Statistical Report for requests under the Privacy Act

Every year, TBS requires institutions to submit a statistical report on their administration of the Privacy Act, which contains cumulative data on the application of the legislation during the fiscal year. The CSIS Statistical Report and Supplemental Report for 2025–2026 are included in Annex B and Annex C of this report. The statistics included in this report have been rounded to the nearest decimal point.

As indicated in table 1, CSIS received 6,057 requests between April 1, 2025, and March 31, 2026. This represents a 35% decrease from the requests received during the previous reporting period. CSIS had 4,687 outstanding requests at the end of the 2024–2025 reporting period. Of those 4,687 requests, 945 were received during that fiscal year and 3,742 remained outstanding for more than one reporting period.

As of the end of the 2025–2026 fiscal year, 9,901 requests were carried over to the next fiscal year (see section 2.1 of Annex C). A total of 16% of those active requests were within their legislated timelines as of March 31, 2026, and 84% were beyond their legislated timelines as of that same date.

7.1 - Sources of requests

The 6,057 requests received during this reporting period came from various sources. A total of 91% of requests came from members of the public who were seeking the status of their citizenship or immigration application. A total of 4% of requests came from various businesses such as immigration consultants and law offices also looking for the personal information of their clients in relation to the status of their immigration and citizenship application. Finally, 98% of requests were submitted through the ATIP Online Request Service (AORS), and the remaining 2% were received by email or by mail.

Over the past number of years, the ATIP Section has seen a large increase in the number of immigration-related Privacy Act requests resulting directly from the coming-into-force of Universal Access, increased immigration, and the strain on the immigration system in Canada. Privacy Act requests to obtain personal information related to immigration and citizenship applications have placed enormous pressure on this institution and the broader federal access-to-information and privacy regimes. These types of requests continued to be unmanageable this fiscal year. Of the 6,057 Privacy Act requests received, 91% related to immigration and citizenship. Of those, 3,478 were from foreign nationals outside of Canada, also seeking the status of their immigration or citizenship applications. Foreign nationals represented 57% of requesters. The volume of requests from foreign nationals was similar to that reported in the previous fiscal year.

7.2 - Disposition of completed requests

The ATIP Section successfully closed 843 privacy-related requests during the 2025–2026 reporting period: 17% were closed within 1 to 15 days, 9% were closed within 16 to 30 days, and 74% took over 31 days to close. Vis-à-vis the records related to these requests, none were disclosed in full, 48% were disclosed in part, 26% were all exempt, 4% did not exist, 12% were abandoned, and for 11%, the existence of the requested information could neither be confirmed nor denied. Requesters whose immigration or citizenship applications were still being processed received an all-exempt disposition response. Partial disclosures mostly involved cases that had already been completed and moved forward in the immigration program. Due to limited resources, a heavy workload and competing priorities, the ATIP Section was unable to process 9,901 requests and carried them over to the next reporting period.

7.3 - Deemed refusals

Out of the 843 requests closed during this reporting period, the ATIP Section closed 217 requests (26%) within the legislated timelines; however, the remaining 626 requests (74%) were closed past the legislated timelines. The main reasons for requests closed past their legislated timeline were interference with operations, internal/external consultations, large volume of pages to review, and a significant workload with limited resources. Of the requests deemed refusals, CSIS took extensions on 7% of them. 

7.4 - Extensions

The legislation allows for extensions in certain circumstances: when the response requires internal or external consultations; there is a large number of records; the review could interfere with CSIS operations; or, there is a large number of requests. During the reporting period, CSIS ATIP took extensions on 46 requests (1%). Of the extensions taken, 11% were due to internal and external consultations and 89% were attributed to interference with operations, more specifically due to the large volume of requests received.

7.5 – Exemptions and exclusions invoked

The Privacy Act allows institutions to exempt information from disclosure for a variety of reasons. The ATIP Section invoked 1,413 exemptions under the Privacy Act during the reporting period.

The Privacy Act excludes from disclosure information already publicly available and Cabinet confidences. No exclusions of this type were applicable to information reviewed by the ATIP Section during the reporting period.

7.6 - Consultations received from other Government of Canada institutions

During the 2025–2026 fiscal year, CSIS received 29 consultation requests under the Privacy Act involving CSIS records or CSIS information. Five consultation requests were outstanding from the previous fiscal year.

For 2025–2026, the ATIP Section closed 32 Privacy Act consultation requests totaling 5,226 pages reviewed. For 38% of those consultations, it took less than 30 days to process. The ATIP Section carried over three Privacy Act consultation requests to the next fiscal year.

7.7 – Other requests

The ATIP Section also acted as a resource for CSIS employees and executives by offering advice and guidance further to provisions in the legislation. The ATIP Section provided assistance, over 57 times, on a variety of matters including, but not limited to, releases of information made by CSIS outside the parameters of the Privacy Act.

Throughout the 2025–2026 fiscal year, the ATIP Section continued to assist members of the public through telephone and email inquiries related to accessing their personal information and submitting requests under the Privacy Act. The ATIP Section offered professional guidance and facilitated access to available resources, including directing individuals to the AORS for further information and assistance.

8. Training and awareness

During this fiscal year, the employees of the CSIS ATIP Section and those of the PMU participated in a variety of deep dive sessions offered by the TBS ATIP Professionals Community Development Office. The ATIP Section continued to encourage its employees to explore other training opportunities including a variety of courses offered by CSIS, the Canada School of Public Service and other venues.

The ATIP Section continued to offer its awareness sessions through ATIP e-learning narrated slides. These form part of the employee orientation program, which is required for all new employees. The narrative slides remained available, at any given time through an e-learning application, to all employees. The narrated slides provided participants with an overview of the Privacy Act and the ATIA, promoted a better comprehension of individual responsibilities and obligations relating to the acts, and offered a greater understanding of the internal ATIP process. During the 2025–2026 fiscal year, 118 CSIS employees viewed the ATIP online module.

Through the 2025–2026 reporting period, the ATIP Section was unable to provide in-person training sessions due to competing priorities and limited resources. However, CSIS ATIP provided regular advice on the requirements of the Privacy Act to CSIS employees. CSIS ATIP is committed to strengthening training and awareness of the ATIP program during the next fiscal year.

Proactive engagement from branches increased significantly since last fiscal year, demonstrating growing recognition of the importance of privacy management across the organization. For its part, the PMU continued to play a vital role in promoting awareness and education, including arranging a Privacy Act 101 learning session, and an Office of the Privacy Commissioner and TBS panel discussion during Privacy Awareness Week. These initiatives provided employees with a foundational understanding of their roles and responsibilities in protecting personal information.

The PMU made significant strides in enhancing its own privacy awareness and education over the past year. A key highlight was the team’s attendance at the 2025 Global Privacy Symposium in Washington, D.C., where they explored the latest developments in artificial intelligence and privacy. This professional development investment enabled the PMU to maintain expertise in privacy and provide guidance to CSIS employees on complex privacy issues.

By continuing to build a strong foundation of privacy knowledge, CSIS will continue to be well-positioned to navigate the evolving privacy landscape and address challenges posed by emerging technologies, like artificial intelligence.

9. Policies, guidelines, procedures and initiatives

The CSIS ATIP Section revised its procedures multiple times throughout the reporting period to deal with immigration and citizenship-related requests. The administrative amendments to the procedures were designed to streamline the provision of requested information to requesters. The continued digitization initiative of the CSIS Information Management Branch required CSIS ATIP to review its workflow processes to support a shift from a paper-based environment to a digital environment. The ATIP Section shifted its responses to requesters from mailing paper or CD responses to emailing responses. This initiative continued to improve the delivery of timely responses to Canadians and contributed to CSIS’ goal to decrease its reliance on paper.

The ATIP Section did not implement any policies related to any other privacy-related matters this fiscal year.

For its part, the PMU introduced a formal Management Response and Action Plan (MRAP) procedure to track the progress and implementation of recommendations following privacy breaches or privacy impact assessments. This procedure enhances visibility into remediation efforts, ensuring necessary steps are taken to address vulnerabilities, mitigate risks, and implement corrective actions effectively. The introduction of MRAPs marks a significant step forward in strengthening the PMU’s privacy management framework, facilitating a structured approach to responding to privacy incidents while demonstrating commitment to protecting personal information and maintaining stakeholder trust.

10. Initiatives and projects to improve privacy

The CSIS ATIP Section continued to rely on the AORS and the ATIP Online Management Tool (AOMT). The ATIP Section's efforts to leverage the AOMT for improved requester service delivery were hampered by the portal’s slow response times and inefficiencies. A combination of these challenges and specific CSIS security requirements impeded the ATIP Section’s ability to use the portal to its full capacity. These issues, combined with a substantial fiscal year workload, continued to hinder AOMT efficiency.

During the reporting period, the ATIP Section undertook the assessment of its current and anticipated requirements to determine the most appropriate request processing software solution (RPSS). Informed by discussions with members of the ATIP community and insights gained from organizations in the implementation phase, an RPSS was selected and procured. The implementation of the new ATIP software will be a significant initiative in the next fiscal year. The ATIP Section also continued to explore technologies and AI-enabled tools that could help improve ATIP operations.

Over the past year, the PMU introduced new initiatives and tools to enhance privacy management capabilities and promote a culture of privacy awareness and compliance. A key highlight was the development of the CSIS Privacy Ecosystem placemat and Privacy Impact Assessment (PIA) dashboard, which are innovative tools designed to provide a visual representation of the organization’s privacy structure and facilitate informed decision-making. The PIA dashboard, which categorizes PIAs by risk level, enabled the PMU to prioritize and address potential privacy vulnerabilities proactively.

In addition, the PMU implemented formal tracking for recommendations stemming from privacy breaches and PIAs to enhance and monitor progress on addressing privacy risks, providing valuable insights to branches and senior management. This initiative improved the organization’s ability to identify and mitigate privacy risks while demonstrating a commitment to transparency and accountability.

Overall, the PMU’s efforts strengthened the foundation for a robust privacy management framework, positioning CSIS to effectively manage privacy risks and protect personal information in a dynamic environment.

11. Issues and actions taken on complaints or audits

Section 29(1) of the Privacy Act provides requesters with the right to file a complaint with the OPC if they are not satisfied with the response to their personal information request. Reasons for complaints include, among others, the refusal of an institution to disclose personal information, personal information used and disclosed for other purposes, delays in receiving a response. A total of 468 complaints were registered with the OPC during the 2025–2026 fiscal year. The large majority of the complaints received were due to delays in receiving responses, primarily related to immigration status requests. Complaints received by the OPC represent less than 8% of the total number of Privacy Act requests received throughout the fiscal year.

OPC investigators closed and issued their findings on 428 complaints. They determined that one complaint was not well founded while nine complaints were discontinued. A total of 428 complaints were resolved during the early resolution stage and did not require an OPC investigation. The large number of delay complaints closed at the early resolution stage was directly due to the ongoing collaboration between the OPC and CSIS. One complaint was deemed well founded; however, CSIS provided sufficient information to the OPC, which did not require any further action from CSIS.

CSIS had 86 open complaints at the end of the 2025–2026 reporting period. The following table shows the number of open complaints that were outstanding from previous reporting periods (see Annex C – section 2.2 of the Supplemental Statistical Report on the Access to Information Act and Privacy Act).

CSIS continued to work closely with the OPC in order to resolve complaints in an efficient and timely manner. CSIS ATIP and the OPC established a strategy to deal with the growing number of time delay complaints on immigration and citizenship related requests. The streamlined process led to the high number of time delay complaints being closed at the early resolution stage. In addition, CSIS reviewed the outcome of all OPC investigations and integrated lessons learned into corporate processes where possible.

During this reporting period, the PMU addressed two OPC privacy complaints. The OPC investigated whether CSIS employees’ handling of sensitive information complied with relevant privacy laws and policies. Both investigations remain open.

There were two court actions filed against CSIS regarding the Privacy Act during this reporting period.

12. Monitoring Compliance

There is a robust case monitoring system in place using reports produced by the ATIP case management software. The Chief, the Deputy Chief and the Unit heads monitor, on a daily basis, Privacy Act requests, the need for inter-institutional consultations and proactive publication requirements. The ATIP Chief (Coordinator) conveys compliance issues to the Director General, Litigation and Disclosure Branch, when required. Currently, the PMU does not have any measures in place to monitor compliance with the Privacy Act.

13. Material Breaches

CSIS reported two material privacy breaches, related to employee personal information, to the OPC and TBS during the reporting period. One breach resulted from unauthorized disclosure, and the second from unauthorized access to personal information. The PMU made recommendations in both cases, including implementing strict access controls, providing regular privacy training, and conducting audits to ensure compliance. The PMU also recommended regularly reviewing and updating policies to align with relevant laws and regulations. These measures will help protect personal information and prevent future breaches.

14. Privacy Impact Assessments (PIA)

No PIAs were completed during this reporting period.

15. Public Interest Disclosures

No disclosures were made under paragraph 8(2)(m) of the Privacy Act during the reporting period.

16. Other

Throughout the 2025–2026 fiscal year, CSIS incurred $1,307,563 in salary costs and $136,789 in other costs associated with the administration of the Privacy Act. The total cost of operating the CSIS Privacy Act program during the 2025–2026 fiscal year was $1,444,352.

Annex A: Delegation Order

Privacy Act Delegation Order

The Minister of Public Safety, Democratic Institutions and Intergovernmental affairs pursuant to section 73 (1) of the Privacy Act (Act), hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as the head of the Canadian Security Intelligence Service, under the provisions of the Act and related regulations set out in the Schedule opposite each position. This designation replaces all previous delegation orders.

Schedule

Dated, at the City of Ottawa, this 25 day of day of April 2024.

The Honourable Dominic LeBlanc, P.C., K.C., M.P.

Minister of Public Safety, Democratic Institutions and Intergovernmental Affairs

Annex B: Statistical Report on the Privacy Act

Name of institution: Canadian Security Intelligence Service (CSIS)

Reporting period: 2025-04-01 to 2026-03-31

Section 1: Requests under the Privacy Act

1.1 Number of requests

1.2 Channels of requests

Section 2: Informal requests

2.1 Number of informal requests

2.2 Completion time of informal requests

2.3 Pages released informally

Section 3: Requests closed during the reporting period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper, e-record and datasets formats

3.5.2 Relevant pages processed per request disposition for paper, e-record and datasets formats by size of requests

3.5.3 Relevant minutes processed and disclosed for audio and video formats

3.5.4 Relevant minutes processed per request disposition for audio and video formats by size of requests

3.5.5 Other complexities

3.6 Closed requests

3.6.1 Requests closed within legislated timelines

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

3.7.2 Requests closed beyond legislated timelines (including any extension taken)

Section 4: Disclosures Under Subsection 8(2) and 8(5)

Section 5: Requests for correction of personal information and notations

Section 6: Extensions

6.1 Reasons for extensions and disposition of requests

6.2 Length of extensions

Section 7: Consultations received from other institutions and organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Section 8: Completion time of consultations on Cabinet Confidences

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

Section 9: Complaints and investigation notices received

9.1 Investigations

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Programs and activities 

10.2 Privacy impact assessments

10.3 Privacy protocol

10.4 Institution-specific and central personal information banks

10.5 Info Source page

Section 11: Social insurance number

Section 12: Privacy breaches

12.1 Material privacy breaches reported

12.2 Non-material privacy breaches

Section 13: Privacy Training

Section 14: Resources related to the Privacy Act

14.1 Allocated costs

14.2 Human resources

Note: Enter values to three decimal places.

Annex C: Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Name of institution: Canadian Security Intelligence Service (CSIS)

Reporting period: 2025-04-01 to 2026-03-31      

Section 1: Requests carried over and active complaints under the Access to Information Act 

1.1 Requests carried over to next reporting period, broken down by reporting period received.

1.2 Active complaints with the Information Commissioner of Canada, broken down by reporting period received.

Section 2: Requests carried over and active complaints under the Privacy Act

2.1 Number of open requests that are outstanding from previous reporting periods.

2.2 Active complaints with the Privacy Commissioner of Canada, broken down by reporting period received

Section 3: Universal Access under the Privacy Act