The Access to Information and Privacy (ATIP) system serves as the primary bridge between the Canadian government’s inner workings and the public’s right to know. At its core, ATIP is a dual-mechanism designed to uphold two competing yet essential values: transparency (through the Access to Information Act) and personal privacy (through the Privacy Act).
Canada’s Access to Information and Privacy (ATIP) framework rests on two foundational statutes that balance transparency with the protection of personal information:
- The Access to Information Act (ATIA): Grants Canadian citizens, permanent residents, and individuals or corporations present in Canada the right to access records under the control of federal institutions.
- The Privacy Act (PA): Protects an individual’s personal information held by the government and provides them with a right to access and correct that data.
For this story, we analyzed publicly available data from IRCC and CBSA to better understand how requests are being processed.
But why focus on IRCC and CBSA?
Immigration, Refugees and Citizenship Canada (IRCC) and the Canada Border Services Agency (CBSA) receive a disproportionate share of Canada’s ATIP requests because of their central roles in immigration and border processing.
Applicants frequently request personal records, such as GCMS notes, to monitor application progress, support appeals, or address processing delays. This demand is driven largely by immigration lawyers, consultants, and applicants seeking greater transparency in an increasingly complex system.
In 2024–25, IRCC alone accounted for 83.3% of all Access to Information requests and 43% of personal information requests received across the Government of Canada. The vast majority of these requests related directly to clients’ immigration applications.
During the same fiscal year, CBSA received 1,765 new Access to Information Act requests and 57,924 new Privacy Act (personal information) requests, underscoring its significant role in the ATIP landscape.
| Metric | IRCC ATIA | IRCC PA | CBSA ATIA | CBSA PA |
| Requests received | 168,987 | 101,541 | 1,765 | 57,924 |
| Requests closed | 178,668 | 98,367 | 2,195 | 59,080 |
| Year-over-year change | -7.6% | +45% | -86.71% | +47.27% |
| Closing backlog | 41,521 | 19,698 | 253 | 4,690 |
| Backlog change | -18.9% ↓ | +19.2% ↑ | -63% ↓ | -19.8% ↓ |
| Foreign nationals (outside Canada) | N/A | 53,988 (53%) | N/A | 10,784 (18.6%) |
This data highlights a significant push for government transparency, though the results vary across departments. IRCC remains the primary focus of these requests, largely driven by individuals seeking their personal immigration files from outside the country. While the department has successfully streamlined its general records processing and reduced that specific backlog, it is struggling to keep pace with the massive surge in personal information requests.
You can check the IRCC processing time trends here.
In contrast, the CBSA has seen a dramatic drop in general inquiries, allowing them to aggressively clear their existing backlog and stay ahead of new submissions. Overall, the trend shows that while agencies are processing more files than ever, the sheer volume of personal data requests is creating a growing bottleneck for immigration applicants.
| Metric | IRCC ATIA | IRCC PA | CBSA ATIA | CBSA PA |
| Compliance rate (within timelines) | 80.7% | 87% | 63.19% | 93.02% |
| Completed ≤30 days | 71.5% | 75.4% | 43.9% | 84.5% |
| Completed ≤60 days | 84.8% | 93.4% | 55.0% | 94.5% |
| Deemed refusals (beyond timelines) | 34,321 (19.3%) | 12,379 (12.6%) | 808 (36.8%) | 4,122 (7.0%) |
Across both organizations, PA requests are handled more efficiently than ATIA requests, with higher compliance rates and a larger share completed within 30 and 60 days.
CBSA’s ATIA performance stands out as the weakest, showing lower completion rates and the highest level of deemed refusals, whereas CBSA’s PA results are the strongest overall, with very high compliance and minimal delays.
IRCC shows more moderate results, improving noticeably under PA but still experiencing a meaningful proportion of requests that exceed legislated timelines.
| Metric | IRCC ATIA | IRCC PA | CBSA ATIA | CBSA PA |
| Average pages per request | ~30 pages | ~21 pages | ~150 pages | ~20 pages |
Notable differences can be seen in processing volume and request complexity between organizations and request types. IRCC handles a much larger overall volume of pages, particularly for ATIA requests, reflecting its broader program and client base, while CBSA processes fewer total pages overall. At the same time, CBSA ATIA requests are far more complex on average, with significantly higher pages per request, whereas PA requests for both organizations tend to be more standardized and lighter in scope, averaging around 20 pages per request.
| Metric | IRCC ATIA | IRCC PA | CBSA ATIA | CBSA PA |
| Total extensions taken | 1,110 | 144 | 585 | 4,795 |
| Extension rate (% of requests) | 0.6% | 0.14% | 33% | 8.3% |
| Primary extension reason | Interference (241) | Consultations (142) | Interference (582) | Large volume (4,677) |
CBSA PA had the highest extension rate and relied primarily on large volume as justification, suggesting the agency is consistently overwhelmed by the number of privacy requests it receives. CBSA ATIA also showed a notably high extension rate, with interference being the primary driver. In contrast, IRCC maintained comparatively low extension rates across both acts, with interference and consultations cited as the main reasons where extensions were taken.
Disclosures and request abandonment
| Metric | IRCC ATIA | IRCC PA | CBSA ATIA | CBSA PA |
| All disclosed | 55,961 (31%) | 36,618 (37%) | 378 (17.2%) | 16,661 (28.2%) |
| Disclosed in part | 104,191 (59%) | 52,934 (54%) | 1,007 (45.9%) | 24,627 (41.7%) |
| Total disclosure rate | 90% | 91% | 63.1% | 69.9% |
| Request abandoned | 17,022 (10%) | 7,921 (8%) | 519 (23.6%) | 14,632 (24.8%) |
| No records exist | 978 (0.5%) | 363 (0.4%) | 101 (4.6%) | 3,093 (5.2%) |
IRCC performed strongest on disclosure, with both IRCC ATIA and IRCC PA achieving total disclosure rates above 90%, and very low abandonment and “no records” rates, indicating well-managed and responsive processes.
CBSA, by contrast, showed notably lower total disclosure rates under both acts, with significantly higher abandonment rates and a greater proportion of requests returning no records. This suggests CBSA faces more challenges in fulfilling requests fully, whether due to the nature of the records held, processing capacity, or applicability of exemptions.
Across all four categories, partial disclosure was the most common outcome, reflecting that while information is being shared, it is rarely released in its entirety.
| Metric | IRCC ATIA | IRCC PA | CBSA ATIA | CBSA PA |
| Most used exemption | S.19(1): 82,694 | S.26: 36,300 | S.19(1): 827 | S.22(1)(b): 21,009 |
| Second most used | S.15(1): 25,485 | S.21: 18,253 | S.16(1)(c): 749 | S.19(1)(a): 12,096 |
| Third most used | S.16(1)(c): 19,270 | S.22(1)(b): 12,386 | S.15(1): 469 | S.21: 12,107 |
These exemptions reflect the legal grounds on which information is withheld, and are directly shaped by the sensitive nature of each agency’s mandate in areas such as immigration, border security, and law enforcement.
S.19(1)
Personal Information protects the personal details of third parties from being disclosed without consent. It is the most used exemption for both IRCC ATIA and CBSA ATIA, which makes sense given that immigration and border files frequently contain personal details about individuals other than the requester.
S.15(1)
International Affairs and Defence prsotects information whose disclosure could be injurious to Canada’s international relations, national defence, or security. Its heavy use by IRCC reflects the sensitive geopolitical dimensions of immigration and refugee matters.
S.16(1)(c)
Law Enforcement protects information related to investigative techniques, ongoing investigations, or information that could facilitate illegal activity. Both IRCC and CBSA apply this given their enforcement mandates, particularly CBSA’s border security role.
S.26
Information About Another Individual (Privacy Act) is the Privacy Act equivalent of S.19(1), used by IRCC PA to withhold information about individuals other than the requester. It is the dominant exemption under IRCC PA for the same reasons personal information appears so frequently in immigration files.
S.21
Operations of Government protects advice, recommendations, and deliberations among public servants to preserve the integrity of internal decision-making processes. It appears across both IRCC PA and CBSA PA.
S.22(1)(b)
Law Enforcement under the Privacy Act mirrors S.16(1)(c) but under the Privacy Act, protecting investigative and enforcement activities. It is CBSA PA’s most used exemption, reflecting CBSA’s core law enforcement and border security functions.
S.19(1)(a)
Personal Information (specific provision) is a targeted clause within the broader personal information exemption, protecting individually identifying details. Its appearance in CBSA PA reinforces how frequently personal data surfaces in border-related requests.
Overall, the pattern across both agencies reflects the sensitive nature of their mandates, immigration and border security inherently involve personal data, law enforcement activity, and matters touching on national security, making these exemptions not just common but necessary to protect individuals and government operations alike.
ATIP complaints
| Metric | IRCC ATIA | IRCC PA | CBSA ATIA | CBSA PA |
| New complaints received | 914 | 132 | 161 | 3 |
| Complaint rate | 0.54% | 0.13% | 9.12% | 0.005% |
| Active complaints (year-end) | 148 | 55 | 132 | 18 |
| Primary complaint type | Delay (83%) | Delay (80%) | Delay (majority) | Not specified |
| Well-founded complaints | 132 | N/A | N/A | N/A |
| Complaints resolved in year | 888 | 99 | 418 (70%) | 75 (81%) |
Delay was the dominant complaint type across all institutions, reflecting the broader processing pressures both agencies face. CBSA ATIA stood out with a notably high complaint rate relative to its request volume, and also carried a significant number of active complaints at year-end, suggesting unresolved backlog pressures.
IRCC ATIA received the highest volume of complaints overall but also resolved the vast majority within the year. CBSA PA and IRCC PA both maintained very low complaint rates, indicating comparatively smoother processes under the Privacy Act.
ATIP program cost – IRCC & CBSA
| Metric | IRCC ATIA | IRCC PA | CBSA ATIA | CBSA PA |
| Dedicated FTE | 143.4 | 27.1 | 35.3 | 75.8 |
| Total program cost | $12,047,789 | $2,451,531 | $2,869,927 | $6,608,093 |
| Cost per request closed | $67 | $25 | $1,307 | $112 |
IRCC operates the largest programs in terms of both staffing and overall cost, which is consistent with the high volume of requests it processes. However, when looking at cost efficiency, IRCC PA stands out as the most cost-effective, processing requests at the lowest cost per closure.
CBSA ATIA is by far the most expensive on a per-request basis, which aligns with its lower request volumes, higher complexity, and the processing challenges reflected in its extension and complaint data. CBSA PA falls in the middle but still costs considerably more per request than either IRCC program.
What IRCC and CBSA ATIP requests include
Requests made to IRCC (Immigration, Refugees and Citizenship Canada) and CBSA (Canada Border Services Agency) are most commonly submitted through the Access to Information and Privacy (ATIP) process. ATIP requests are legal mechanisms that allow individuals to obtain copies of their personal immigration records, application updates, and internal officer notes held by Canadian government departments.
These requests typically include the following types of records:
1. GCMS Notes (Global Case Management System)
GCMS is the internal database used by IRCC and CBSA to manage and process applications for citizenship, permanent residence, and temporary residence (such as visitor visas, work permits, and study permits).
What they contain: GCMS notes provide a comprehensive snapshot of an application at a specific point in time. They include officer comments, eligibility and security assessments, background checks, and details on the next processing steps.
Applicants request GCMS notes to understand processing delays, identify concerns raised by officers, confirm whether interviews are required, or review the reasons for a refusal.
2. CBSA Traveller History Reports
These reports document an individual’s recorded entries into and exits from Canada.
What they contain: Dates of travel, ports of entry, and travel document details.
These records are commonly used to support citizenship applications or permanent resident card renewals by demonstrating compliance with Canada’s physical presence requirements.
3. Case File and Application Records
These records contain copies of application forms, passports, supporting documents submitted to IRCC, and any notes made by CBSA officers during border interviews or investigations.
These records help individuals verify what information was provided to the government or better understand decisions, enforcement actions, or ongoing immigration investigations.
4. Regulatory and Procedural Documents
These documents contain internal operational bulletins, policy manuals, and procedural guidelines that immigration officers rely on when assessing applications and making decisions.
These documents are useful for understanding how immigration laws and policies are applied in practice.
What does this data say about your Access to Information Request: ATIP.ca explains
If you have ever submitted a GCMS or ATIP request and wondered why it is taking so long, or why you only received part of what you asked for, these tables hold some of the answers, and they matter.
For anyone navigating the immigration system, IRCC’s numbers explain a lot. The department is processing a staggering volume of requests, the vast majority of which are people simply trying to access their own files. Disclosure rates are high, which is encouraging, but the system is under serious strain. If your request has been delayed, you are far from alone, and the data shows why.
CBSA’s numbers are equally telling, particularly if you have ever had a border-related file request go quiet. Complexity is high, costs per file are significant, and the complaint rate under ATIA is notably elevated. For individuals trying to understand decisions made about them at the border, this data underscores just how difficult that process can be.
The dominance of delay as the primary complaint across both agencies is something every applicant should know going in. Setting realistic expectations is part of navigating these systems effectively, and the numbers here make clear that delays are structural, not exceptional.
At ATIP.ca, we help thousands of applicants get access to their immigration case files. Tracking this data helps us keep our users informed. Knowing which exemptions are commonly applied, how long requests typically take, and the pressure points, gives you a clearer picture of what to expect, and when it may be worth pushing back.
ATIP data beyond IRCC
While Immigration, Refugees and Citizenship Canada (IRCC) and Canada Border Services Agency (CBSA) account for the vast majority of ATIP activity, driven largely by the volume of immigration and travel records, the ATIP system extends across the full breadth of Canada’s federal institutions.
In the 2024–2025 fiscal year, beyond the “Big Two,” a substantial but comparatively smaller share of requests was distributed across other departments, including the Royal Canadian Mounted Police (RCMP), Department of National Defence (DND), Canadian Security Intelligence Service (CSIS), and Indigenous Services Canada (ISC), covering subject matter that ranges from national security and law enforcement to environmental oversight and Indigenous programs.
Take a look at the table below:
| Department | Requests Received (24-25) | Key Performance Note |
| Correctional Service (CSC) | 7,503 (Privacy) | A massive workload of over 2.3 million pages reviewed. |
| CSIS (Intelligence) | 373 (ATI) | High sensitivity; 50% of records were partially blacked out. |
| Indigenous Services (ISC) | 484 (ATI) | 58% were completed within 60 days. |
| Public Services (PSPC) | 501 (ATI) | Saw a massive 1,497 “informal” requests (outside the legal Act). |
| National Security Review (NSIRA) | 23 (ATI) | Small volume but highly specialized security reviews. |
The Bottom Line
The 2024–2025 ATIP data tells a clear story: Canada’s transparency system is busier than ever. While IRCC and CBSA handle the mountain of paperwork, mostly for people checking on their immigration files, the rest of the government is also processing thousands of requests on everything from national security to the environment.
Need help?
We know that staring at massive tables of data and legal jargon can be a bit scary. Trying to figure out why your file is delayed or what those “redacted” codes mean is enough to give anyone a headache.
ATIP.ca is here to help. We simplify the complex, and help you cut through the red tape to get you the information you need. You don’t have to navigate the ATIP maze alone, let us do the heavy lifting for you.
FAQs
1. What is an ATIP request, in simple terms?
An ATIP request is a formal way to ask the Canadian federal government for records. It can be used either to access government documents (under the Access to Information Act) or to obtain your own personal records (under the Privacy Act).
2. What’s the difference between an ATIA request and a Privacy Act (PA) request?
An ATIA request is for general government records, such as policies, reports, or emails.
A PA request is for your own personal information, such as immigration or travel records.
3. Why do IRCC and CBSA receive so many ATIP requests?
Because these departments manage immigration, visas, citizenship, and border records. Most requests are people asking for their own immigration files, such as GCMS notes, to understand delays, refusals, or next steps.
4. Are ATIP requests actually processed on time?
Mostly they are, but it depends on the type of request.
Privacy Act requests are usually completed within legal timelines. Access to Information requests, especially complex ones, are more likely to be delayed or extended.
5. Why are so many pages “blacked out” in ATIP responses?
Redactions are required by law to protect:
- Personal information of others
- National security
- Law enforcement techniques
- Internal advice to government
Heavy redactions are especially common in CBSA and national security files.
6. What does “deemed refusal” mean?
A deemed refusal occurs when the government fails to respond within the legal deadline. The request is still processed, but it counts as non-compliant and may trigger complaints.
7. Why does CBSA have more delays for Access to Information requests?
CBSA ATIA requests tend to involve:
- Enforcement and intelligence records
- Larger files
- More consultations with other agencies
This makes them slower, more expensive, and more likely to exceed timelines.
8. I live outside Canada. Can you help me access my files?
Yes! A significant number of people use our services from outside Canada. You can request GCMS or ATIP notes by placing a new order at https://atip.ca/new-order
10. Who are ATIP.ca? How can ATIP.ca help with your ATIP requests?
ATIP.ca is a privately held entity. We specialize in getting you access to your immigration case files and records. We help you:
- Decide which type of request to file
- Understand why delays, redactions, and exemptions occur
- Handle the ATIP process from end-to-end
Thousands of immigration consultants and other applicants use our services every day. ATIP.ca doesn’t offer any paid or unpaid immigration advise.