Alberta. Comprehensive data protection. Act
Alberta PIPAPersonal Information Protection Act (SA 2003, c. P-6.5)
Partly verified
Medium confidence.Substantially similar to PIPEDA. Text URL is King's Printer catalogue link; confirm. Reform recommendations pending Cabinet decision.
§1Summary
- Synopsis
Alberta's private-sector privacy law covering provincially regulated organisations, including employee information. It sets reasonableness-based rules for collection, use and disclosure and was the first Canadian law to require breach notification.
- Key themes
- Unique features
Mandatory reporting to the Commissioner of breaches posing real risk of significant harm, with the Commissioner able to order notification of individuals; organisations must disclose use of service providers outside Canada in their policies.
- SaaS relevance
Applies to Alberta organisations using SaaS; they must disclose foreign service providers and report breaches, flowing obligations to vendors.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Commissioner without unreasonable delay if RROSH; individuals as directed
- DPO
- Yes
- Cross-border transfers
- Notice of foreign service providers in policies
- Maximum penalty
- CAD 100,000 (organisations); CAD 10,000 (individuals)
§3Dates
- Key dates
- Adopted
- In force
- Mandatory breach notification added 2010; legislative committee review final report Feb 2025 recommends AMPs, minors' rules, ADM notice - no amending bill confirmed as of Oct 2026
§4Text and authority
- Text
- Authoritative text kings-printer.alberta.ca
- Authority
- Office of the Information and Privacy Commissioner of Alberta (OIPC)
§5Where it applies
- Domestic law of
- Alberta
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Substantially similar to PIPEDA. Text URL is King's Printer catalogue link; confirm. Reform recommendations pending Cabinet decision.