PIPA (Alberta and British Columbia)
Also known as: Alberta PIPA, BC PIPA, Personal Information Protection Act, provincial privacy law
Alberta and British Columbia each have their own Personal Information Protection Act, known as PIPA, which governs how private businesses in those provinces handle personal information.
While they cover similar ground to the federal PIPEDA, they're broader in one important way: they also protect employee information. Businesses operating in the West often find they're dealing with provincial rules, not federal ones.
PIPA (Alberta and British Columbia), explained at three levels
At home
Think of Canadian privacy law as a set of local referees. In Alberta and BC, the provincial referee, a law called PIPA, oversees how local businesses like your gym, dentist, or employer handle your information. They need a reasonable purpose, usually your consent, and proper safeguards. You can ask for a copy of what they hold about you and complain to the provincial privacy commissioner if they refuse.
At work
Alberta and BC each have a Personal Information Protection Act, or PIPA, that governs private-sector organizations operating inside the province. Because Ottawa declared them 'substantially similar' to PIPEDA, they replace PIPEDA for most local activity. They cover customers and also employees. Businesses care because a company in Calgary or Vancouver usually answers to a provincial commissioner, while federally regulated sectors like banks and airlines stay under PIPEDA.
At home
The PIPAs follow a simple chain of rules: an organization may collect, use, or disclose personal information only for purposes a reasonable person would consider appropriate, usually with consent. The big difference from PIPEDA is employment. Both PIPAs cover employee personal information, with a looser consent rule for reasonably managing the job relationship. So if you work for a private company in Alberta or BC, you can request the personnel information your employer holds, subject to some exceptions.
At work
Each PIPA has the same building blocks: reasonable purposes, consent with listed exceptions, safeguards, retention limits, and access and correction rights, with access requests generally answered within 45 days in Alberta and 30 business days in BC. Alberta adds mandatory breach notification to its commissioner when there is a real risk of significant harm. Jurisdiction follows the activity, so one business may handle Alberta employees under PIPA, Ontario customers under PIPEDA, and Quebec customers under Law 25.
At home
Each province has an independent Information and Privacy Commissioner who can investigate complaints, mediate, and issue binding orders. That goes further than the federal Privacy Commissioner, who mostly makes recommendations, and it changes how businesses respond, because ignoring a provincial order has legal consequences. While a patchwork of regulators can confuse people, in my view local oversight is an advantage: provincial offices often resolve cases faster and with more attention to local context.
At work
The jurisdictional line is the tricky part. PIPEDA still applies to federal works, such as banks and telecoms, and to personal information that crosses provincial or national borders in commercial activity, so a BC company sending customer data to a US vendor can face both regimes. As of 2026, BC's PIPA still has no general mandatory breach-reporting rule, while Alberta's has had one since 2010. Mapping data flows by province and by type, customer versus employee, shows which law governs each flow.
Real-world examples
At home
Aisha works for a private engineering firm in Edmonton. After a disagreement about a performance review, she asked HR for a copy of her personnel file. Under Alberta's PIPA, the company had to provide her personal information within the legal timeline, with limited exceptions.
At work
Jerome is the operations manager at a BC property management company. During a privacy review, he discovered that tenant data fell under BC's PIPA, but data sent to a US software provider also raised PIPEDA questions. He updated vendor contracts and the company's privacy policy to address both.
How it compares
| feature | PIPA (Alberta and British Columbia) | PIPEDA |
|---|---|---|
| Applies to | Private organizations within each province | Commercial activity elsewhere, interprovincial and international flows, federal works |
| Employee information | Covered | Covered only for federally regulated employers |
| Regulator | Provincial Information and Privacy Commissioner | Privacy Commissioner of Canada |
| Breach notification | Alberta since 2010; BC has been reviewing its law | Required since 2018 |
| In force | January 1, 2004 | Phased in from 2001, fully by 2004 |
The PIPAs replace PIPEDA inside Alberta and BC, but cross-border data can still bring PIPEDA into play.
For analysts
For any Canadian business, I'd start privacy work with a simple map: which provinces, which data types, which flows cross borders. That one diagram tells you which laws apply and prevents the classic mistake of assuming PIPEDA covers everything.
History & origin
When PIPEDA took effect for commercial activity across Canada in 2004, it allowed provinces with 'substantially similar' laws to take over. Alberta and British Columbia both passed their own PIPA laws, which came into force on January 1, 2004, joining Quebec, which had its own private-sector law since 1994. Alberta added Canada's first mandatory private-sector breach notification requirement in 2010, years before PIPEDA required breach reporting in 2018. Both laws cover non-profit organizations in some circumstances and include employee personal information. In my opinion, the PIPAs show that provinces can move faster than Ottawa, but they also explain why Canadian privacy compliance feels like a patchwork.