A business can face BC PIPA, Alberta PIPA, PIPEDA, or more than one regime across different activities. This guide is a technical planning aid, not legal advice: determine jurisdiction before treating any checklist or control set as complete.
Start with jurisdiction, not a province checkbox
BC and Alberta have private-sector laws declared substantially similar to PIPEDA. Provincially regulated organizations generally apply the relevant provincial law to in-province handling. PIPEDA continues to apply to federal works, undertakings and businesses, including covered employee information, and to commercial personal-information flows across provincial or national borders.
An Alberta client does not by itself prove that every record or activity falls under Alberta PIPA. Ask who controls the information, what organization and activity are involved, where the collection, use or disclosure occurs, whether information crosses a border, whether the organization is federally regulated, and whether another sector law or contract also applies.
| Decision | Alberta PIPA | BC PIPA | PIPEDA |
|---|---|---|---|
| Typical scope | Provincially regulated private-sector organizations and personal employee information in Alberta, with special limits for some non-profits. | Provincially regulated private-sector organizations and personal employee information in BC, subject to statutory exclusions. | Federal works, undertakings and businesses; commercial activity where no substantially similar provincial law applies; and commercial interprovincial or international information flows. |
| Consent | Consent is generally required unless an exception applies. Form depends on context and sensitivity. Personal employee information reasonably required for the work relationship has specific without-consent provisions and notice rules. | Consent is generally required unless an exception applies. Employee personal information also has specific provisions; purpose, reasonableness and notice remain important. | Meaningful consent and identified purposes apply, with statutory exceptions. PIPEDA employee coverage is limited to federal works, undertakings and businesses. |
| Significant-harm breach | The organization must notify the Alberta Commissioner without unreasonable delay when the section 34.1 threshold is met. The Commissioner may require notice to affected individuals; organizations should plan timely individual communication. | BC PIPA currently has no equivalent mandatory private-sector notification rule. The BC OIPC strongly recommends reporting as a best practice; another law or contract may still require notice. | Organizations subject to PIPEDA must report qualifying breaches to the federal Commissioner, notify affected individuals, and keep records of every breach. |
| What technology can prove | System inventories, access records, configuration evidence, contracts, incident records, retention decisions and test results can support compliance work. No product, control list or MSP can certify the legal conclusion by itself. | ||
Breach response needs a jurisdiction step
Use one intake process, then make separate legal decisions. Record the systems and information involved, who controlled the data, sensitivity, probability of misuse, affected people, applicable law and contract, containment actions, notification decision, communication owner and remediation. Keep credentials and unnecessary personal information out of the incident register.
Consent and employee data are context-specific
The old version of this article said health, financial and employee information generally require express consent under all three regimes. That is too broad. Sensitivity affects the appropriate form of consent, but each law also contains exceptions and employee-information provisions. Alberta guidance expressly notes that consent is not required for personal employee information reasonably required to establish, manage or end the work relationship, although notice and reasonable-purpose requirements still matter.
Document the purpose, information category, individual expectation, sensitivity, consent or exception relied on, notice shown, withdrawal handling, retention decision and responsible owner. Do not treat one province's form or one generic privacy policy as automatic coverage for every activity.
Build one evidence system with jurisdiction-specific decisions
A shared inventory, access-control model, vendor register, retention process and incident workflow can reduce duplicated operational work. The legal mapping still needs per-activity fields: organization, jurisdiction, commercial or employment context, cross-border flow, governing law, notice/consent basis, breach pathway and adviser decision.
North Star can help inventory systems, configure safeguards and organize technical evidence for privacy and legal advisers. We do not provide legal advice, determine final jurisdiction or certify compliance. Review related work through our compliance services and the corrected BC PIPA IT checklist.
Frequently asked questions
Does having an Alberta client automatically make Alberta PIPA apply? No. Client location alone is not the full test. Organization type, activity, control of the information, where collection/use/disclosure occurs, cross-border flow and sector-specific rules can affect jurisdiction.
Who must an Alberta organization notify after a significant-harm breach? When section 34.1's threshold is met, the organization must notify the Alberta Commissioner without unreasonable delay. The Commissioner may require the organization to notify affected individuals, and organizations should prepare for timely individual communication.
Can one privacy policy cover Alberta PIPA, BC PIPA and PIPEDA? A shared policy and evidence system can provide a baseline, but it does not remove jurisdiction-specific consent, employee-information, breach, record-keeping or contract decisions. Map each activity to the applicable rule and qualified adviser.