BC PIPA Compliance: An IT Checklist for 2026

PIPA's core obligations are:

• Identify the purpose before or at the time of collection. You can't collect first and figure out why later.
• Obtain consent when required and document the lawful purpose or exception used for collection, use and disclosure.
• Designate responsibility for privacy compliance and maintain policies and practices that support it.
• Protect personal information using reasonable security arrangements appropriate to the circumstances and sensitivity.
• Support access and correction requests while applying the Act's exceptions, identity checks and response process.
• Retain and dispose deliberately. Section 35 includes a one-year minimum when information was used to make a decision directly affecting an individual, then requires destruction, erasure or anonymization when legal or business purposes no longer require it.

MFA, encryption, access reviews, logging, incident exercises and vendor evidence are practical ways to support reasonable security. PIPA does not prescribe this exact checklist or promise that any single control is sufficient.

Before you can protect personal information, you need to know where it is. This is the step most SMBs skip, and it's the reason everything else is harder.

Run a discovery exercise across:

• File shares (Windows shared drives, NAS devices)
• Cloud storage (SharePoint, OneDrive, Google Drive, Dropbox)
• Email archives
• CRM and helpdesk platforms
• Any third-party SaaS tools your team uses

Build a working inventory with columns such as Data category | System | Custodian | Access roles | Purpose | Legal basis or consent | Retention decision | Third-party disclosure | Safeguard evidence. Keep sensitive records and credentials out of the inventory itself. The inventory supports decisions and evidence collection; it is not a prescribed OIPC form.

Recommended control evidence: ☐ risk-based MFA coverage documented ☐ access roles mapped to business need ☐ shared accounts removed or controlled ☐ offboarding timing and owner defined ☐ access-review cadence based on risk ☐ privileged access restricted, logged and reviewed. These are implementation choices supporting reasonable security, not fixed timelines written into PIPA.

Recommended control evidence: ☐ endpoint-encryption status ☐ storage-encryption configuration ☐ protected transfer method for sensitive information ☐ database and application safeguards confirmed with each provider ☐ backup access, encryption, retention and restore evidence. Match controls to sensitivity and realistic threats rather than treating one product setting as compliance.

Recommended policy evidence: ☐ acceptable use and handling rules ☐ authentication and password-manager expectations ☐ approved AI uses and prohibited data ☐ BYOD conditions where personal devices access company data ☐ named owner, approval date, review trigger and staff acknowledgement. Set review timing from risk, legal change and operational change rather than assuming one universal interval.

For private organizations under BC PIPA, OIPC and individual notification are currently recommended best practices rather than PIPA's mandatory significant-harm rule. Your process still needs to identify all applicable laws, contracts and sector rules; federally regulated or cross-border activity may bring PIPEDA's mandatory reporting and record-keeping requirements into scope.

Recommended response evidence: ☐ containment and preservation steps ☐ affected systems, people and data categories ☐ sensitivity, misuse probability and harm assessment ☐ privacy lead and legal decision owner ☐ applicable-law and contract review ☐ notification decision and rationale ☐ remediation, communication and lessons learned. Do not put live credentials or unnecessary personal information in the incident log.

PIPA section 35 contains two distinct rules: information used to make a decision directly affecting an individual must generally be retained for at least one year, and personal information must be destroyed, erased or anonymized when it is no longer needed for legal or business purposes. Other laws and litigation needs can change the schedule.

Recommended evidence: ☐ purpose-based schedule by record category ☐ documented legal/business hold process ☐ deletion and anonymization method ☐ backup expiry behavior ☐ vendor retention and deletion terms ☐ disposal verification. Have legal and records specialists approve periods rather than copying a generic number.

An organization remains responsible for personal information under its control, including information held by a service provider. Contracts, due diligence, access controls and ongoing evidence help demonstrate how that responsibility is managed.

Recommended evidence: ☐ vendor purpose and data categories ☐ approved access roles ☐ security and breach terms ☐ subprocessors and transfer locations ☐ retention, return and deletion terms ☐ assurance evidence and review cadence ☐ exit plan. BC PIPA does not create a general Canada-only data-storage rule; assess transparency, contractual protection, access risk and every applicable law instead of treating geography alone as compliance.

• PIPEDA, CASL, BC PIPA compliance
• Managed IT services
• Cybersecurity assessments
• Cloud and Microsoft 365

Talk to us about your project