What Can Service Providers To The Public Sector Learn From The PowerSchool Privacy Incident?

On November 17, 2025, Ontario's Information and Privacy Commissioner (ON IPC) and Alberta's Office of the Information and Privacy Commissioner (AB OIPC) each released their findings from their investigations into a cybersecurity incident that occurred at a widely used third-party service provider, PowerSchool Canada ULC (PowerSchool), which affected 5.2-million Canadians across several schools and school boards in Canada.

The reports considered whether the Ontario and Alberta institutions had reasonable measures in place to prevent unauthorized access to personal information. The ON IPC found that some institutions (a) did not have reasonable provisions in their agreements with PowerSchool to ensure the privacy and security of personal information, and (b) did not have sufficient oversight or monitoring measures in place to ensure personal information would be protected. Similarly, the AB OIPC found the institutions did not have policies or procedures in place to