How does Canada's Access to Information and Privacy (ATIP) regime differ from the US FOIA process?

Both Canada and the United States give the public a legal right to request records held by federal institutions, and both pair that right with a separate law protecting personal information. The structures are similar, but the way each country organizes and administers access differs in important ways.

Two laws on each side, organized differently

In the United States, the Freedom of Information Act (FOIA) governs public access to federal agency records, while the Privacy Act of 1974 governs how agencies handle records about individuals and gives people access to their own information. These are two distinct statutes that often operate together on a single request.

Canada follows a comparable two-law model under the umbrella commonly called ATIP (Access to Information and Privacy):

• The Access to Information Act lets requesters obtain records held by federal government institutions.
• The Privacy Act governs personal information and lets individuals access and correct records about themselves.

A practical difference is eligibility. US FOIA generally lets anyone — regardless of citizenship — request records. Canada’s access right has historically been tied more closely to Canadian citizens, permanent residents, and persons or corporations present in Canada, though administration has broadened over time.

How requests are administered

In both systems, individual departments and agencies process their own requests, apply statutory exemptions (for example, national security, law enforcement, personal privacy, and confidential business information), and may charge limited fees. Each country also provides independent oversight and an appeal path:

• In the US, requesters can administratively appeal and ultimately seek review in federal court.
• In Canada, complaints typically go to the Office of the Information Commissioner (for access) or the Privacy Commissioner (for privacy), with court review available afterward.

What records professionals should take away

The core principles are shared: a right of access, defined exemptions rather than blanket secrecy, separate handling of personal information, and independent review. The differences are mainly in scope of who may request, terminology, and the specific oversight bodies. For any cross-border records program, the safe approach is to map each jurisdiction’s exemptions, response timelines, and appeal routes separately rather than assuming they mirror each other.

For related guidance on managing and preserving the records that underpin these access rights, see the archives and preservation topic hub.