The Natural Sciences and Engineering Research Council of Canada (NSERC), through grants, fellowships, and scholarships, promotes and supports research and research training in the natural sciences and engineering to develop talent, generate discoveries, and support innovation in pursuit of economic and social outcomes for Canadians.

NSERC is a separate agency of the Government of Canada (GOC) established in 1978. It is funded directly by Parliament and reports to the Minister of Industry. The functions of NSERC are governed by the authority and responsibility assigned to it under the Natural Sciences and Engineering Research Council Act (1976-1977, c.24).

NSERC is led by a President and a Governing Council comprised of up to 18 distinguished members from the private, public and not-for-profit sectors. Policy matters are advised by Council’s standing committees, and funding decisions are made by the President, or designate, based on peer review committees’ recommendations.

The purpose of the Privacy Act (the Act) is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and to provide individuals with the right to access and to correct that information.

This annual report is tabled in Parliament pursuant to section 72 of the Act and describes how NSERC administered its responsibilities for the reporting period.

At NSERC, the Access to Information and Privacy (ATIP) office resides in the Governance, Risk & Compliance Division under the Strategic, Corporate and Public Affairs Directorate.

The ATIP office is overseen by the ATIP Manager who is responsible for processing requests under the Act and providing support and advice on matters pertaining to the legislation and with the various Treasury Board of Canada Secretariat (TBS) requirements in connection with the Act. The ATIP Manager reports to the Executive Director, Governance, Risk and Compliance, and is supported by an ATIP Analyst and two ATIP & Secretariat Officers. A privacy consultant was engaged on a need basis for a specific project.

NSERC was not party to any service agreements under section 73.1 of the Act during this reporting period and did not have any non-operational ("paper") subsidiaries.

NSERC’s privacy management infrastructure was strengthened by developing internal privacy expertise, providing privacy guidance aligned with NSERC’s privacy framework and protocol, and making tools accessible on the agency intranet. ATIP knowledge-sharing initiatives were expanded across NSERC divisions, enhancing organizational awareness of record management best practices and privacy protection. Guided by forward-looking vision and supported by mentorship within the ATIP office, NSERC sustained its commitments to privacy compliance through streamlined operations and continuous service improvements.

As part of its duties under the Act, NSERC ensures that written notices are provided to applicants for NSERC funding, as well as to committee members, external reviewers, and observers taking part in peer review, advising them of their rights and responsibilities under the Act, and on how the information they access and/or supply is treated and protected in accordance with the legislation. These notices appear in program guides, in NSERC’s online application and grants management systems, and in other pertinent material provided throughout the application and review process. In addition, reviewers are required to sign a conflict of interest and confidentiality agreement to ensure that all review materials are maintained in strict confidence. Information about the protection and disclosure of personal information both for research grants and training awards can also be found on NSERC’s website.

NSERC’s President and senior management are informed of key decisions and developments in the administration and implementation of the Act, as appropriate. The ATIP office provides regular reports to the Executive Director, Governance, Risk and Compliance, who updates the Vice-President, Strategic, Corporate and Public Affairs, who then briefs the President as needed.

When advice on the administration of the Act is required, it is sought from one or several of the following: the TBS, the Department of Justice Canada, the Office of the Privacy Commissioner of Canada (OPC), and other federal government ATIP offices.

Pursuant to subsection 73(1) of the Act, the President of NSERC has delegated the powers, duties, and functions for the administration of the Act to the following NSERC officials:

• Vice-President, Strategic, Corporate and Public Affairs
• Executive Director, Governance, Risk and Compliance & Secretary to Council
• Manager, ATIP & Governance

The current delegation order was approved on August 15, 2022, and can be found in Appendix A.

The Statistical Reports support oversight, accountability, and transparency by providing data on the performance of the Canadian government’s privacy programs. TBS publishes aggregate data annually through the Privacy Statistical Report. The raw data is also made available through the Government’s Open Data Portal.

This section provides an overview of key data on NSERC’s performance for the year, as reflected in the statistical report for 2024-25.

In 2024-25, NSERC received 4 formal requests under the Act, a decrease of 1 from the previous fiscal year (5 in 2023-24). There were no outstanding requests from prior periods. Two requests were closed in 2024-25: 4 fewer than the previous year (6 in 2023-24). Of these, two were completed within the initial 30 days, while the remaining 2 were carried over with extensions under the Act, taking between 31 to 60 days.

The extensions were due to unreasonably interfering with operational demands, high request volume, and external consultations, as outlined in paragraphs 15(a)(i) and 15(a)(ii) of the Act. Both (100%) requests were processed and closed within legislated timelines without extensions, maintaining a consistent performance compared to 100% compliance in 2023-24 and up from 33% in 2022-23.

Graph 1 shows the annual number of privacy requests received by NSERC, along with the carried forward and closed requests for 2020-21 to 2024-25.

Fiscal Year	Requests Received	Carry-Over from Previous Fiscal Year	Requests Completed
2020-21	22	8	7
2021-22	2	23	13
2022-23	4	12	15
2023-24	5	1	6
2024-25	4	0	2

The two completed requests were disclosed as containing no records. In 2024-25, no pages were processed, as no responsive records were identified. This contrasts with the previous year, when 391 pages were processed, of which 308 were disclosed. Graph 2 shows the annual number of pages processed and disclosed by NSERC from 2020-21 to 2024-25.

Fiscal Year	Disclosed	Processed
2020-21	268	464
2021-22	1251	5074
2022-23	952	2442
2023-24	308	391
2024-25	0	0

During the 2024-25 period, no requests required consultation with other federal institutions before disclosure. Also, the ATIP office did not receive any consultation requests from other government institutions or organizations.

In 2024-25, the ATIP office responded to approximately 70 informal requests for expertise, all originating from NSERC divisions. Over the past three years, there has been a steady increase in the volume of internal requests received. All these informal requests during this period pertained to the review of corporate documents and the interpretation of the Act, primarily related to program and service delivery. The NSERC ATIP office played an active role in reviewing and developing numerous new privacy notice statements to support organizational compliance and transparency.

In addition, NSERC encourages the informal sharing of information requested from external sources outside the ATIP process, provided that the information released pertains to the requester. In 2024-25, NSERC proactively released 16,335 redacted reports and reference letters from external reviewers for all funding opportunities that collect such reports. These documents relate to 6,790 grant and award applications and include expert assessments of research proposals, funding recommendations, and feedback to applicants based on program criteria. Redactions are made in accordance with the Act, and these requests are managed by NSERC program staff who have received training from the ATIP office.

There was no correction requests submitted for the 2024-25 period.

In 2024-25, NSERC did not have any privacy complaints carried over from the previous year and did not receive or conclude any new privacy complaints. Also, there were no privacy complaints carried over into the 2025-26 fiscal year.

No privacy audits nor monitoring were conducted during the reporting period. There were no applications or appeals to the Federal Court or Federal Court of Appeal under the Act during 2024-25.

No material privacy breaches occurred during the reporting period.

In 2024-25, NSERC did not complete any Privacy Impact Assessments (PIAs). However, NSERC has been planning for the review of its 2018 Equity, Diversity and Inclusion (EDI) PIA. With the implementation of the Tri-agency Grants Management System (TGMS), updating the EDI PIA is timely to ensure alignment with new operational and privacy requirements. The revised assessment is expected to be completed and reported in the 2025-26 fiscal year.

During this reporting period, NSERC maintained 11 active institution-specific personal information banks (PIBs). No central PIBs are held by NSERC. Following the Info Source renewal, NSERC now has two institution-specific PIBs:

• NSERC Funding Opportunities PIB (NSERC PPU 060)
• NSERC Compliance - Responsible Conduct of Research PIB (NSERC PPU 023)

Both were modified during the renewal process and are classified as “active” and “modified” for the purpose of this report. The remaining nine PIBs have been rendered redundant by the modifications to the NSERC Funding Opportunities PIB. These have since been terminated with TBS and NSERC will update their status to “terminated” in next year’s annual report.

During the reporting period NSERC made no public interest disclosures under Subsections 8(2) of the Act.

Throughout the year, general training and advice was provided to NSERC employees on the principles of the privacy legislation, key concepts, procedures for processing both formal and informal privacy requests, and employee responsibilities with respect to the Act.

All NSERC staff requiring direct access to self-identification data must complete training on handling sensitive personal information. The training responds to the NSERC, SSHRC, and CIHR joint initiative to collect equity, diversity and inclusion self-identification data for all applicants, co-applicants, collaborators and committee members. Significant progress was made to update and automate the training for equity, diversity and inclusion privacy protection, and the self-led training is expected to launch in 2025-26. Consequently, no training sessions were offered during 2024-25, however course materials remained available on NSERC’s intranet page for those who required them. During this period, 16 NSERC employees reported completing the self-identification training. This number does not account for employees who may have accessed the training independently via NSERC’s Intranet, where completion is not tracked. Formal redaction training was provided to approximately 10 NSERC program staff, and the training presentation is accessible on NSERC’s Intranet as needed.

The ATIP office regularly provides guidance and resources to help employees consider privacy protection at the outset of a project or initiative. For example, in March 2023, TBS published the new Digital Privacy Playbook on Canada.ca, which was shared with NSERC staff and posted on NSERC’s intranet page. Also, during Data Privacy Week, held this year from January 27 to 31, 2025, the ATIP office highlighted key privacy issues and obligations, the role of our ATIP office and shared important privacy-related resources with staff.

Throughout the year, NSERC staff and management are reminded and encouraged to consult the ATIP office regarding any issues that might affect the implementation of the Act, when and where appropriate.

During 2024-25, NSERC’s ATIP office reinforced its commitment to maintaining its compliance with the Act and TBS requirements by updating and modernizing its internal procedures, materials, and NSERC’s ATIP and Transparency webpages. A key milestone this year involved the comprehensive review of its Info Source chapter and the content of its Personal Information Banks (PIBs), resulting in improved accessibility and clearer guidance for NSERC employees and the public on how to request information and understand privacy rights.

Additionally, NSERC formally adopted and communicated TBS’s updated Policy on Privacy Protection and the Directive on Privacy Practices to all employees, including Program and Project Leads. This includes the new Standard on Privacy Impact Assessments (PIAs), launched in October 2024. In the upcoming fiscal year, these requirements pertaining to templates for PIAs, Privacy Checklists, PIBs and Web Summaries, will be integrated into the NSERC-SSHRC joint Privacy Management Framework and Privacy Protocol, accessible on the agencies’ Intranet site.

NSERC-SSHRC’s joint Privacy Management Framework and Privacy Protocol, officially launched in January 2023, remain current and serve as a key resource when considering privacy matters and compliance.

NSERC continues to prioritize the digital transformation of the ATIP office that was advanced during the COVID-19 pandemic. With the implementation of tools such as NSERC’s secure extranet site (SharePoint) and the ATIP Online Management Tools (AOMT) across the GOC, the ATIP office continues to find ways to create new and effective methods of communication. Additionally, the ATIP office, in collaboration with NSERC’s Information and Innovation Solutions office, is working toward acquiring new powerful ATIP software with some ‘AI’ capability to replace the detailed manual work currently required. These developments towards further technological innovation and integration are expected to continue into the 2025-26 fiscal year by procuring new ATIP software.

NSERC has not received authority for any new collection(s) or new consistent use(s) of Social Insurance Numbers during the 2024-25 reporting period.

NSERC regularly publishes an inventory of its information holdings to assist individuals in exercising their rights under the Act, and to support the federal government’s commitment to facilitate access to information on its activities, available to the public on the Internet, free of charge. A description of NSERC’s functions, programs, activities and related information holdings can be found in Info Source: Sources of Federal Government and Employee Information.

In accordance with the federal government’s policy on proactive disclosure, evaluation and audit reports are also posted on NSERC’s website under Transparency and on the federal government’s Open Government website. The NSERC website’s ATIP page provides background information on the Act and useful information about services provided.

During 2024-25, NSERC’s total cost for administering the Privacy Act program was $251,193 which was allocated to salaries and professional development. This figure represents an increase of 9% compared to $229,503 in 2023-24 and 29% compared to $195,344 in 2022-23.

The human resources utilized to administer the Act for this reporting period were estimated at 2.2 FTE, which is a slight increase from 2.1 FTE reported for the 2023-24 fiscal year. A privacy consultant was contracted on a need basis for a specific project.

NSERC’s ATIP Manager position, the ATIP Analyst position and the two ATIP & Secretariat positions are filled on a permanent basis. These positions remained filled and uninterrupted throughout the current reporting period. NSERC has made a commitment to continue to build its internal ATIP capacity and expertise to increase stability and improve ATIP service delivery.

During the 2024-25 reporting period, NSERC continued to strengthen its ATIP operations by enhancing internal capacity and privacy expertise. Ongoing mentorship was provided to the ATIP office, and a clear strategic vision was established through effective resource organization and the setting of specific compliance goals. These efforts led to increased efficiency in processing requests and strengthened adherence to privacy obligations.

Based on the 2024-25 results, NSERC has demonstrated its capacity to effectively fulfill its privacy responsibilities. However, this period was characterized by a low volume of requests received. An increase in requests could potentially impact processing times and pose challenges to maintaining full compliance. Notably, the ATIP office has frequently relied on appropriate extensions of time to ensure adherence to statutory deadlines, highlighting the importance of resource capacity in managing higher volumes of requests.