Alberta and BC PIPA: Private Sector Privacy Law in Western Canada

Private sector organisations handling personal information in Alberta or British Columbia answer to a provincial privacy law, not only to the federal PIPEDA, and the two provinces differ on the point security teams care about most: whether a breach must be reported. Alberta's Personal Information Protection Act requires organisations to notify the Information and Privacy Commissioner of breaches that create a real risk of significant harm; British Columbia's Act of the same name does not, although its Commissioner strongly recommends reporting. This guide covers who each Act applies to, the core obligations on consent, purpose, safeguards, access and retention, breach handling, enforcement, current reform status and what the laws mean for AI systems, service accounts and other non-human identities. It is written for security, privacy and compliance practitioners in organisations with Western Canadian operations, customers or employees.

Source note: the official consolidated statute texts (BC Laws, Alberta King's Printer) and CanLII could not be accessed for this guide. It is based on guidance published by the two Information and Privacy Commissioners and the Governments of Alberta and British Columbia, and on named secondary sources: Gowling WLG, McLennan Ross LLP, Borden Ladner Gervais LLP (BLG), Deeth Williams Wall LLP and Baker McKenzie. Each obligation below is attributed to its source. Confirm against the official text before relying on it.

Key takeaways

• Alberta requires breach notification to the regulator. The Alberta OIPC's April 2024 guidance states that organisations must notify the Commissioner without unreasonable delay where a reasonable person would consider there is a real risk of significant harm to an individual, and failing to do so is an offence.
• British Columbia breach reporting is voluntary for organisations. The BC OIPC says PIPA does not currently require organisations to report breaches, continues to ask government to change that, and strongly recommends reporting as best practice.
• Both Acts require reasonable security arrangements. Regulator guidance in each province ties the standard to the sensitivity and volume of the information, across administrative, physical and technological safeguards.
• Reach is broad. BLG reports that the BC Court of Appeal, in Clearview AI Inc v British Columbia (Information and Privacy Commissioner), 2026 BCCA 67, upheld PIPA's application to a US company that collected BC residents' images online, which matters for AI training and data aggregation.
• Reform is under way, not enacted. As of November 2026, the sources reviewed describe Alberta consultation and BC calls for reform, with no amending bill reported for either private sector Act.

Scope: who and what is covered

Gowling WLG notes that Alberta and British Columbia each have a provincial private sector privacy law called the Personal Information Protection Act (PIPA), both introduced in 2004 and both deemed substantially similar to the federal PIPEDA. In practice that means PIPA, rather than PIPEDA, generally governs provincially regulated organisations' handling of personal information within each province, while PIPEDA continues to apply to federally regulated businesses and to information that crosses provincial or national borders in the course of commercial activity. See the Canada PIPEDA and Bill C-27 Guide for the federal layer.

• British Columbia: the Government of BC describes the Act as applying to private sector organisations in BC, including corporations, partnerships, trade unions, trusts and not-for-profits, with some specific exclusions, and as covering personal information about customers, employees and others. The BC OIPC's quick reference guide describes personal information as information about identifiable individuals such as customers, employees or patients.
• Alberta: the Alberta OIPC applies PIPA to "organizations" as defined in section 1(1)(i) of the Act. In a published breach decision (P2023-ND-001), the Commissioner applied PIPA to a BC-licensed pharmacy "to the extent the information was collected in Alberta", which shows that the Act follows the information, not the organisation's head office.
• Online collection: BLG reports that the BC Court of Appeal found a real and substantial connection to BC where a company kept collecting BC residents' facial images after it stopped marketing in the province, using a contextual analysis rather than the location of servers or users. The Alberta Court of King's Bench decided a parallel challenge in 2025 ABKB 287.

The table sets out each Act's rule as its regulator or government describes it. It does not rank the two laws.

Key obligations

Consent and reasonable purposes

The BC OIPC's guidance on privacy policies states that organisations must obtain consent to collect, use or disclose personal information unless PIPA permits otherwise, that consent may be express or implied depending on sensitivity, and that individuals may withdraw consent on reasonable notice. Collection, use and disclosure must be for purposes a reasonable person would consider appropriate, collecting only what is needed. The same guidance notes that employee personal information may be handled without consent where reasonable for managing the employment relationship. Confirm Alberta's consent and purpose provisions in the official text.

Accountability

• BC: the BC OIPC says PIPA requires organisations to develop and follow policies and practices to meet their obligations, make them available on request and name a contact responsible for compliance. The Government of BC lists designating one or more people responsible for privacy as the first compliance step.
• Alberta: the Government of Alberta says organisations should have written policies on physical, technological and administrative security, and, where they use a service provider outside Canada, must name a person who can answer questions about it.

Safeguards

Both regulators frame the security duty the same way. The BC OIPC describes "reasonable security arrangements" against unauthorised access, collection, use, disclosure, copying, modification and disposal, scaled to volume and sensitivity. The Government of Alberta describes reasonable security measures against unauthorised access, use, disclosure, modification and disposal, matched to sensitivity, and notes that collecting less makes security easier. Neither names a specific control set, so organisations usually evidence reasonableness against a recognised framework. See the Privacy Programme Guide for Security Teams.

Access and correction

The BC OIPC states that individuals may request their personal information, how it has been used and to whom it has been disclosed; requests are in writing, identity may be verified, only a minimal fee may be charged with an estimate in advance, and the organisation responds within 30 business days unless an extension applies. Corrections must be passed to organisations that received the information in the previous year. See the DSAR Guide.

Breach handling

The Alberta OIPC's April 2024 guidance sets out the regulator notice. It must be in writing and, under Regulation s. 19, include a description of the circumstances, the date or period of the breach, the personal information involved, an assessment of the risk of harm, an estimate of the number of individuals at real risk of significant harm, steps taken to reduce the risk and to notify individuals, and a contact person. The OIPC states that labelling risk "low", "medium" or "high" does not meet the requirement for an assessment. Factors it lists include sensitivity, who could access the information, relationships between the parties, whether encryption was in place, exposure time, malicious intent, recovery and the vulnerability of those affected. Notice goes by email to [email protected] using the PIPA Privacy Breach Notification Form, and contacting the OIPC by phone does not satisfy the duty.

In BC, the OIPC's quick reference guide for small and medium-sized businesses describes four steps: containment without destroying evidence, risk assessment, notification (considering individuals and the OIPC, especially where there is a significant risk of harm) and prevention. The OIPC's online breach report form is its preferred reporting route. See the Breach Notification Laws by Country Guide.

Timeline and current status

As of 8 November 2026 the sources reviewed report no enacted amendment to either private sector Act arising from these reviews. BC's Commissioner continues to call for mandatory breach reporting. Status can change quickly, so check both legislatures before relying on this table.

Enforcement and penalties

• Alberta offences: the Alberta OIPC states that failing to notify the Commissioner of an incident meeting the s. 34.1 test is an offence under s. 59(1)(e.1), with fines of up to $10,000 for an individual and up to $100,000 for a person other than an individual under s. 59(2). The Government of Alberta gives the same maximums.
• BC offences: Baker McKenzie and IT World Canada both report fines of up to $100,000 for organisations that commit offences under BC PIPA.
• Damages: Baker McKenzie reports that under both Acts an affected individual may sue for damages once an order or conviction is final.
• Orders and investigations: both Commissioners investigate and issue orders; the Alberta OIPC also notes it may investigate compliance with the s. 34.1 duty.
• No administrative monetary penalties yet: both Commissioners have asked for them (Alberta OIPC; Gowling WLG for BC). Treat any figure you see for AMPs as a proposal until enacted.

What it means for AI agents and non-human identities

Neither Act mentions AI agents or machine identities. The duties still land on them, because the safeguards, purpose and breach duties apply to whatever system processes personal information. These are NHI Mgmt Group's practical readings, not regulator statements.

• Service accounts and API keys are access paths to personal information: "reasonable security arrangements" against unauthorised access cover the credentials that applications, integrations and agents use. Inventory them, scope them and rotate them. See the Service Account Security Guide.
• A leaked machine credential can be a reportable breach in Alberta: if a stolen token gave access to personal information and the Alberta OIPC risk factors point to a real risk of significant harm, the s. 34.1 duty applies whether a person or a script misused it. Your incident plan should route machine credential incidents through the same privacy assessment.
• AI agents need a purpose: an agent that reads customer records must act within purposes a reasonable person would consider appropriate and for which consent exists or an exception applies. Scope agent permissions to the purpose, not to everything the user can see. See the Agent Identity and Access Guide.
• Scraping and training data: the Clearview AI decision, as reported by BLG, read the publicly available exception narrowly and applied BC PIPA to an out-of-province collector. Treat online personal data used for model training as in scope. See the AI and Privacy Guide.
• Logs evidence the risk assessment: the Alberta notice must state who accessed what and how many individuals are affected. Without per-identity audit logs for machine access, that assessment is guesswork.

Compliance steps

1. Map where personal information is collected: identify Alberta and BC customers, employees and users, and which systems, vendors and agents process their data.
2. Name accountable people: designate a privacy lead and publish a contact, as the BC Government and OIPC describe.
3. Write the policies: privacy policy, security policy covering administrative, physical and technological safeguards, and, for Alberta, policies naming any service provider outside Canada, the country and purposes.
4. Build a breach playbook with a provincial branch: Alberta notice to the OIPC using the Regulation s. 19 content where the real risk of significant harm test is met; BC voluntary report as recommended; PIPEDA and other laws checked in parallel.
5. Prepare a risk assessment template using the Alberta OIPC factors, so the notice contains a real assessment rather than a label.
6. Set up access request handling that meets the BC 30 business day response and the Alberta time limit in the Act.
7. Apply retention rules: keep decision records for at least one year in BC, then destroy or anonymise when no longer needed.
8. Govern machine access to personal data with inventory, least privilege, rotation and logging.
9. Track reform: assign someone to follow the Alberta consultation outcome and BC reform calls.

Practitioner checklist

• Confirm which of your systems hold personal information collected in Alberta or BC.
• Designate a privacy contact and publish it with your privacy policy.
• Document safeguards across administrative, physical and technological controls, scaled to sensitivity.
• Add an Alberta OIPC notification step, using the Regulation s. 19 content, to your incident response plan.
• Adopt the BC OIPC recommendation to report significant breaches voluntarily.
• Use the Alberta OIPC risk factors to write a real risk assessment, not a rating.
• Meet the BC 30 business day access response and check the Alberta time limit in the Act.
• Inventory service accounts, API keys and AI agents with access to personal data and scope them to purpose.
• Review online data collection and AI training sets in light of the Clearview AI decision.
• Re-check the status of Alberta and BC reform each quarter.

Standards and references

• Office of the Information and Privacy Commissioner of Alberta: Guidance for Notifying the OIPC about a Privacy Breach Under PIPA
• Government of Alberta: Organization responsibilities for protecting personal information
• Office of the Information and Privacy Commissioner for British Columbia: Report a privacy breach
• Office of the Information and Privacy Commissioner for British Columbia: Developing a privacy policy under PIPA
• Office of the Information and Privacy Commissioner for British Columbia: Privacy breach quick reference guide for businesses
• Office of the Information and Privacy Commissioner of Alberta: Statement on the PIPA review report
• Gowling WLG: Alberta and British Columbia privacy law, 2024 year in review
• BLG (via Mondaq): BC Court of Appeal upholds broad reach of provincial privacy laws

Related NHI Mgmt Group resources: Canada PIPEDA and Bill C-27 Guide · Quebec Law 25 Guide · Breach Notification Laws by Country Guide · Canada AI Regulation Guide (post-AIDA). This guide summarises Alberta's and British Columbia's Personal Information Protection Acts and is not legal advice.