Privacy Map

British Columbia. Comprehensive data protection. Act

BC PIPAPersonal Information Protection Act (SBC 2003, c. 63)

In force
Partly verifiedMedium confidence. Substantially similar to PIPEDA. OIPC BC site could not be fetched; absence of mandatory breach notification from general knowledge.

§1Summary

Synopsis

British Columbia's private-sector privacy law for provincially regulated organisations, including employee personal information. It requires consent and reasonable purposes and grants access and correction rights, with order-making powers for the Commissioner.

Key themes
  • consent
  • reasonable purposes
  • employee information
  • access and correction
  • Commissioner orders
Unique features

Commissioner can issue binding orders, but the Act still lacks a statutory breach-notification duty.

SaaS relevance

BC-based customers remain subject to PIPA when using SaaS, so vendors must support access requests and reasonable security safeguards.

§2Obligations

Extraterritorial
Limited
Breach notification
None mandatory (voluntary reporting encouraged)
DPO
Yes
Cross-border transfers
No statutory restriction (public sector FIPPA rules differ)
Maximum penalty
CAD 100,000 (organisations)

§3Dates

Key dates
  • Adopted
  • In force
  • 2021 special committee recommended mandatory breach notification and AMPs; not enacted as of Oct 2026

§4Text and authority

Text
Authority
Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)

§5Where it applies

Domestic law of
British Columbia

§6Sources and verification

Sources consulted
Verification

Medium confidence.

Partly verifiedMedium confidence. Substantially similar to PIPEDA. OIPC BC site could not be fetched; absence of mandatory breach notification from general knowledge.