In the federal arena, two acts govern access to general and personal information held by federal public bodies - the Access to Information Act (AI Act), and the Privacy Act. Below, the exemptions to disclosure are set out for each act.

There are two types of exceptions under both the AI Act and the Privacy Act – mandatory and discretionary. A public body MUST refuse to disclose all or part of a record if the information contained within it falls within a mandatory exemption. Discretionary exceptions give the public body a choice -- they can decide whether or not to withhold all or part of a record.

Access to Information Act (AI Act)

Mandatory Exemptions (Exception)

Records obtained in confidence from other governments (foreign, provincial, municipal or aboriginal) or international institutions (AI Act, section 13(1));
Any record containing information obtained or prepared by the R.C.M.P., while performing a policing services for a province or municipality under an arrangement under the Royal Canadian Mounted Police Act, where the Government of Canada, as requested by the province or municipality (AI Act, section 16(3));
Any record containing information obtained or created in the course of an investigation, examination or audit conducted by the Auditor General of Canada; the Commissioner of Official Languages for Canada; the Information Commissioner; and the Privacy Commissioner (AI Act, section 16.1);
Any record containing information obtained or conducted in the course of an investigation by or under the authority of the Commissioner of Lobbying (AI Act, section 16.2);
Any record containing information obtained or created by Public Sector Integrity Commissioner or on his behalf in the course of an investigation under the Public Servants Disclosure Protection Act (AI Act, section 16.4);
Any record containing information created or prepared in the course of an investigation for the purpose of making a disclosure under the Public Servants Disclosure Protection Act. (AI Act, section 16.5);
Personal information under the Privacy Act (AI Act, section 19(1));
Records which contains trade secrets of a third party and other financial, commercial, scientific or technical confidential information (AI Act, section 20(1));
Records provided by the Public Sector Pension Investment Board which contains confidential advice or information relating to investment (AI Act, section 20.1);
Records provided by the Canada Pension Plan Investment Board which contains confidential advice or information relating to investment (AI Act, section 20.2);
Records which would reveal the terms of a contract for the services of a performing artist or the identity of a confidential donor provided to the National Arts Centre Corporation (AI Act, section 20.4); and
Any record containing information which is restricted by or pursuant to any provision set out in Schedule II of the AI Act (AI Act, section 24).

Discretionary Exemptions

Records which, if released, might injure federal-provincial government relations (AI Act, section 14);
Records which, if released, might injure the relationship between Canada and other countries, or affect Canada’s defence (AI Act, section 15(1)) ;
Law enforcement information, if the record is less than 20 years old, and information about investigation techniques (AI Act, section 16 (1)) ;
Any security record which could facilitate the commission of an offence (AI Act, section 16 (2));
Any record of investigations, examinations and reviews under the Canada Elections Act(AI Act, section 16 (3));
Information which could reasonably be expected to affect the safety of individuals(AI Act, section 17);
Government trade secrets, or financial, commercial, scientific or technical information(AI Act, section 18);
Advice or recommendations that the government has received, if the records is less than 20 years old(AI Act, section 21(1));
Information related to testing procedures, tests and audits(AI Act, section 22);
Information related Internal audits(AI Act, section 22(1));
Privileged legal advice to the government(AI Act, section 23); or
Information that will be available to public within 90 days. (AI Act, section 26).

Privacy Act

Mandatory Exemptions

Information obtained in confidence from a foreign, international, provincial, municipal or aboriginal government (Privacy Act section 19(1));
information obtained/prepared by the RCMP while performing policing services for a province or municipality (Privacy Act section 22(2));
information obtained/created by the Auditor General, Commissioner of Official Languages, Information Commissioner or Privacy Commissioner in the course of an investigation, examination or audit (Privacy Act section 22.1);
information obtained/created by the Public Sector Integrity Commissioner in the course of an investigation or in an attempt to reach a settlement pursuant to the Public Servants Disclosure Protection Act(Privacy Act section 22.2);
information created for the purpose of making a disclosure under the Public Servants Disclosure Act or an investigation into a disclosure under that Act (Privacy Act section 22.3);
personal information about an individual other than yours (Privacy Act section 26).

Discretionary Exceptions

Information contained in a personal information bank designated as an exempt bank (Privacy Act section 18(2));
information injurious to the conduct of federal-provincial affairs (Privacy Act section 20);
information injurious to the conduct of international affairs, defence of Canada (Privacy Act section 21);
information obtained/prepared by a government institution that is an investigative body; information relating to investigative techniques or plans for specific lawful investigations; injurious to enforcement of any law of Canada; injurious to the security of penal institutions (Privacy Act section 22(1));
information obtained/prepared by an investigative body in determining whether to grant security clearances (Privacy Act section 23);
information collected/obtained by Correctional Service Canada or the National Parole Board while the individual was under sentence for an offence (Privacy Act section 24);
disclosure could reasonably be expected to threaten the safety of individuals (Privacy Act section 25);
information subject to solicitor-client privilege (Privacy Act section 27);
personal information that relates to the physical or mental health of the individual (Privacy Act section 28).