PIPA (Alberta Personal Information Protection Act)

PIPA is Alberta's private-sector privacy law, setting rules for how businesses and many non-profits collect, use, disclose and protect personal information about customers and employees.

The Personal Information Protection Act applies to most private-sector organizations operating in Alberta. It requires reasonable security arrangements to protect personal information, limits collection to what is reasonable for the purpose and gives individuals the right to access their own information. It is overseen by the Office of the Information and Privacy Commissioner of Alberta.

Alberta was the first province to require private-sector organizations to report certain breaches. Under PIPA, if a loss of or unauthorized access to personal information creates a real risk of significant harm to individuals, the organization must notify the Commissioner without unreasonable delay. The Commissioner can then require that affected individuals be notified. A stolen laptop or compromised email account can trigger this obligation.

Practical tip: know what personal information you hold and where it lives, appoint someone responsible for privacy, and include PIPA reporting steps in your incident response plan. Seek legal advice when deciding whether a breach is reportable.