{ "jurisdiction_id": "CA-AB", "jurisdiction": "Canada – Alberta", "url": "https://dataprotection.gi/jurisdictions/canada-alberta/", "generator": "render_jid v13-gdpri-1.0.0", "date_modified": "2026-08-05", "schema_version": "gdpri-v2", "counts": { "categories": 10, "claims": 38, "sub_modules": 57, "source_register": 18 }, "categories": [ { "code": "regulator_and_framework", "name": "Regulator & Framework", "traffic_light": "green", "sub_modules": [ "act_and_instruments", "material_scope", "regulator_and_authority", "regulator_registration_and_filing", "territorial_scope" ], "url": "https://dataprotection.gi/jurisdictions/canada-alberta/#regulator-and-framework-regulator-framework", "traffic_light_rationale": "A mature, judicially-tested private-sector statute with a dedicated independent regulator and clear substantially-similar status vis-à-vis federal law.", "claims": [ { "statement": "The Office of the Information and Privacy Commissioner of Alberta (OIPC) enforces PIPA and reports to the Officer of the Legislature.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/alberta", "source_tier": null, "observed_at": null }, { "statement": "The Personal Information Protection Act, SA 2003, c P-6.5 (PIPA) is the primary act protecting personal data in Alberta's private sector.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/alberta", "source_tier": null, "observed_at": null }, { "statement": "Alberta separated its public-sector access/privacy law in 2024, replacing the FOIP Act with the Access to Information Act (ATIA) and the Protection of Privacy Act (POPA), following Bill 33/Bill 34 royal assent on December 5, 2024.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/alberta", "source_tier": null, "observed_at": null }, { "statement": "PIPA governs the collection, use and disclosure of personal information by organizations in a manner recognizing both individual protection rights and organizations' need to process information for purposes a reasonable person would consider appropriate.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/02_05_d_26/", "source_tier": null, "observed_at": null }, { "statement": "The OIPC's powers include commenting on the implications of Privacy Impact Assessments (PIAs) submitted to it by organizations.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/alberta", "source_tier": null, "observed_at": null } ] }, { "code": "lawful_processing_and_special_data", "name": "Lawful Processing & Special Data", "traffic_light": "amber", "sub_modules": [ "consent_thresholds", "lawful_bases", "pseudonymisation_and_anonymisation", "special_categories" ], "url": "https://dataprotection.gi/jurisdictions/canada-alberta/#lawful-processing-and-special-data-lawful-processing-special-data", "traffic_light_rationale": "Core consent/purpose principles are in force, but special-category and anonymisation frameworks remain gaps pending legislative reform.", "claims": [ { "statement": "An organization may collect, use or disclose personal information under PIPA only for a purpose that a reasonable person would consider appropriate in the circumstances.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/02_05_d_26/", "source_tier": null, "observed_at": null }, { "statement": "PIPA currently requires organizations to provide notice, in a form the individual can reasonably be considered to understand, of intended collection, use or disclosure purposes.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/bc_20210622/is_bc_20210622/", "source_tier": null, "observed_at": null }, { "statement": "PIPA permits organizations to collect 'personal employee information' without consent where reasonable for establishing, managing or terminating an employment or volunteer relationship.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_r/pipeda_review_060718/", "source_tier": null, "observed_at": null }, { "statement": "PIPA does not currently contain a defined category of sensitive personal information; the OIPC and Alberta's Ministry of Technology and Innovation have recommended creating one covering biometric, children's and intimate information.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/ab_20240924/is_ab_20240924/", "source_tier": null, "observed_at": null }, { "statement": "PIPA lacks a codified framework for de-identified or anonymized information; the OIPC has recommended one including definitions, standards, and prohibitions on re-identification.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/ab_20240924/is_ab_20240924/", "source_tier": null, "observed_at": null } ] }, { "code": "data_subject_rights", "name": "Data Subject Rights", "traffic_light": "amber", "sub_modules": [ "access_right", "data_portability", "deadlines_and_response_windows", "rectification_and_erasure", "restriction_and_objection" ], "url": "https://dataprotection.gi/jurisdictions/canada-alberta/#data-subject-rights-data-subject-rights", "traffic_light_rationale": "Access rights are established and in force; portability is aspirational/reform-stage only, and precise deadline figures require primary-source verification.", "claims": [ { "statement": "PIPA provides individuals the right to access personal data held about them by an organization.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/alberta", "source_tier": null, "observed_at": null }, { "statement": "A codified 'right to erasure' under PIPA remains a reform-discussion topic rather than a confirmed existing statutory right, per the Alberta Legislative Assembly's PIPA review materials.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/opc-actions-and-decisions/submissions-to-consultations/sub_pipa_ab_2406/", "source_tier": null, "observed_at": null }, { "statement": "The Alberta OIPC has called for PIPA to be amended to include a right to portability and data mobility, allowing individuals to obtain or transfer their personal information in a structured, machine-readable format.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/ab_20240924/is_ab_20240924/", "source_tier": null, "observed_at": null } ] }, { "code": "controller_processor_duties", "name": "Controller/Processor Duties", "traffic_light": "amber", "sub_modules": [ "accountability_and_dpia", "breach_notification", "dpo_requirements", "joint_controller_arrangements", "retention_and_disposal", "ropa_requirements", "security_measures" ], "url": "https://dataprotection.gi/jurisdictions/canada-alberta/#controller-processor-duties-controller-processor-duties", "traffic_light_rationale": "Breach notification and accountability-for-transfers are in force and well-precedented, but DPIA/DPO/ROPA/AMPs infrastructure is thin relative to GDPR-style regimes.", "claims": [ { "statement": "The OIPC's powers include commenting on the implications of Privacy Impact Assessments sent to it, though PIPA does not impose a blanket statutory PIA mandate on all organizations.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/alberta", "source_tier": null, "observed_at": null }, { "statement": "Under joint OPC/Alberta/BC accountability guidance, the law stipulates that an organization transferring personal information to a third party for processing remains responsible for that information.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda-compliance-help/pipeda-compliance-and-training-tools/gl_acc_201204/", "source_tier": null, "observed_at": null }, { "statement": "PIPA requires organizations that suffer a privacy breach to notify the OIPC without unreasonable delay where the breach poses a real risk of significant harm to affected individuals, and the Commissioner may then require notification of affected individuals.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/ab_20240924/is_ab_20240924/", "source_tier": null, "observed_at": null }, { "statement": "Alberta became the first Canadian jurisdiction to implement mandatory breach notification in private-sector privacy legislation, in 2010.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/the-new-pipeda-data-breach-notification-requirements-twelve-years-in-the-making", "source_tier": null, "observed_at": null }, { "statement": "The Health Information Act requires custodians to notify affected individuals, the Minister of Health, and the OIPC of privacy breaches meeting a harm-based risk threshold, following a structured risk-of-harm analysis.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/new-mandatory-breach-notification-for-health-information-in-alberta", "source_tier": null, "observed_at": null } ] }, { "code": "cross_border_and_adequacy", "name": "Cross-Border & Adequacy", "traffic_light": "amber", "sub_modules": [ "adequacy_granted", "adequacy_received", "data_localisation", "sccs_and_bcrs", "transfer_impact_assessment", "transfer_mechanisms" ], "url": "https://dataprotection.gi/jurisdictions/canada-alberta/#cross-border-and-adequacy-cross-border-adequacy", "traffic_light_rationale": "Adequacy inheritance via PIPEDA is confirmed and strong, but Alberta-specific transfer mechanisms (SCCs, TIAs, localisation) are not independently codified.", "claims": [ { "statement": "When Alberta organizations subject to PIPA engage in trans-border personal information flows for commercial reasons, they must follow PIPEDA for those specific transactions.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/02_05_d_26/", "source_tier": null, "observed_at": null }, { "statement": "Canada's adequacy status under the EU GDPR was reviewed, with the European Commission finding that Canada continues to provide an adequate level of protection for personal information transferred from the EU to recipients subject to PIPEDA.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/opc-actions-and-decisions/submissions-to-consultations/sub_pipa_ab_2406/", "source_tier": null, "observed_at": null }, { "statement": "PIPEDA does not prohibit transferring personal information to another jurisdiction for processing but instead governs such transfers through an organization-accountability model rather than adequacy or standard-contractual-clause designations.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-topics/airports-and-borders/gl_dab_090127/", "source_tier": null, "observed_at": null } ] }, { "code": "sectoral_watch", "name": "Sectoral Watch", "traffic_light": "amber", "sub_modules": [ "credit_and_scoring", "education", "employment_data", "financial_sector_overlay", "health_sector_overlay", "insurance", "telecoms_and_eprivacy" ], "url": "https://dataprotection.gi/jurisdictions/canada-alberta/#sectoral-watch-sectoral-watch", "traffic_light_rationale": "Health-sector overlay is robust and well-evidenced; employment carve-out is confirmed; financial/credit/insurance/telecoms overlays are evidentiary gaps.", "claims": [ { "statement": "The Health Information Act requires custodians to notify affected individuals, the Minister of Health and the OIPC of certain privacy breaches that could create a risk of harm, subject to a harm-based trigger and prescribed safe harbours.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/new-mandatory-breach-notification-for-health-information-in-alberta", "source_tier": null, "observed_at": null }, { "statement": "Under HIA regulations, individual custodians who fail to comply with breach obligations face fines between $2,000 and $10,000, while organizational custodians face fines between $200,000 and $500,000.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/new-mandatory-breach-notification-for-health-information-in-alberta", "source_tier": null, "observed_at": null }, { "statement": "PIPA allows organizations to collect 'personal employee information' without consent where reasonable for establishing, managing, or terminating an employment or volunteer relationship.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_r/pipeda_review_060718/", "source_tier": null, "observed_at": null }, { "statement": "A cyberattack on PowerSchool's Student Information System affected 5.2 million Canadians and generated 31 breach notices from Alberta schools reported to the OIPC.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/alberta", "source_tier": null, "observed_at": null } ] }, { "code": "adtech_and_commercial_privacy", "name": "AdTech & Commercial Privacy", "traffic_light": "red", "sub_modules": [ "clean_rooms_and_dcr", "cookies_and_trackers", "cross_context_advertising", "dark_patterns", "direct_marketing", "opt_out_signals" ], "url": "https://dataprotection.gi/jurisdictions/canada-alberta/#adtech-and-commercial-privacy-adtech-commercial-privacy", "traffic_light_rationale": "This module carries an explicit evidentiary gap; Alberta has no adtech-specific statute distinct from PIPA's general consent regime.", "claims": [] }, { "code": "algorithmic_biometric_and_surveillance_governance", "name": "Algorithmic, Biometric & Surveillance Governance", "traffic_light": "amber", "sub_modules": [ "ai_risk_assessments", "automated_decision_making_transparency", "biometric_regime", "genetic_data", "profiling_restrictions", "state_surveillance_carveouts" ], "url": "https://dataprotection.gi/jurisdictions/canada-alberta/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill", "traffic_light_rationale": "Strong enforcement precedent on biometrics exists, but no codified statutory ADM-transparency or profiling-restriction provision was confirmed; AI-specific rules are emergent/sector-limited (health).", "claims": [ { "statement": "The OIPC of Alberta issued guidance for custodians on completing Privacy Impact Assessments for AI scribe tools under the Health Information Act.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/alberta", "source_tier": null, "observed_at": null }, { "statement": "Bill 11 introduces amendments to Alberta's Health Information Act addressing privacy, accountability, and AI use in healthcare amid restructuring.", "regulatory_stage": "proposed", "is_binding": true, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/alberta", "source_tier": null, "observed_at": null }, { "statement": "A joint investigation by the federal, Alberta, British Columbia and Quebec privacy authorities found Clearview AI's scraping of images and creation of biometric facial-recognition arrays constituted inappropriate mass identification and surveillance of individuals.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-topics/health-genetic-and-other-body-information/biometrics/gd_bio_org-final/", "source_tier": null, "observed_at": null }, { "statement": "A joint investigation with the Alberta and BC privacy commissioners found that Cadillac Fairview's collection of facial images and biometric data via mall directory kiosks required express consent that had not been validly obtained.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-topics/health-genetic-and-other-body-information/biometrics/gd_bio_org-final/", "source_tier": null, "observed_at": null }, { "statement": "Alberta's OIPC alerted citizens to privacy risks following 23andMe's asset sale to TTAM, emphasizing data protection obligations under PIPA for genetic information.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/alberta", "source_tier": null, "observed_at": null } ] }, { "code": "children_and_vulnerable_groups", "name": "Children & Vulnerable Groups", "traffic_light": "amber", "sub_modules": [ "age_verification", "dependent_adults", "education_settings", "minor_profiling_bans", "parental_consent" ], "url": "https://dataprotection.gi/jurisdictions/canada-alberta/#children-and-vulnerable-groups-children-vulnerable-groups", "traffic_light_rationale": "Age-of-majority baseline is confirmed, but dedicated minor-specific consent/profiling provisions in PIPA are absent or reform-stage only.", "claims": [ { "statement": "The age of majority in Alberta is 18, as referenced in federal breach-reporting guidance distinguishing provincial age-of-majority thresholds.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/media/4844/pipeda_pb_form_e.pdf", "source_tier": null, "observed_at": null }, { "statement": "Alberta's Ministry of Technology and Innovation proposed that PIPA create a specific category of sensitive personal information including children's information, though this has not been enacted.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/ab_20240924/is_ab_20240924/", "source_tier": null, "observed_at": null }, { "statement": "The OIPC reported 31 breach notices from Alberta schools using the PowerSchool Student Information System, involving unauthorized access to students' personal information.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/alberta", "source_tier": null, "observed_at": null } ] }, { "code": "enforcement_and_redress", "name": "Enforcement & Redress", "traffic_light": "amber", "sub_modules": [ "collective_redress_and_class_actions", "enforcement_activity_index", "private_right_of_action", "recent_developments_180d", "regulator_funding_and_capacity", "regulator_powers_and_penalties" ], "url": "https://dataprotection.gi/jurisdictions/canada-alberta/#enforcement-and-redress-enforcement-redress", "traffic_light_rationale": "Strong order-making and offence provisions are in force with active joint enforcement, but the absence of an AMPs regime is a material capability gap relative to peer regimes (Quebec, EU, UK).", "claims": [ { "statement": "Unlike the federal OPC's orders under the proposed CPPA, the Alberta OIPC's orders are not subject to appeal by an external tribunal, only to judicial review by a court.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/ab_20240924/is_ab_20240924/", "source_tier": null, "observed_at": null }, { "statement": "Section 59(1) of Alberta's PIPA makes it an offence to wilfully attempt to gain or gain access to personal information in contravention of the Act.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_r/pipeda_review_060718/", "source_tier": null, "observed_at": null }, { "statement": "The federal Privacy Commissioner conducts joint investigations with the Alberta OIPC and other provincial counterparts, including cases such as Clearview AI, Facebook/Cambridge Analytica, Tim Hortons, OpenAI, TikTok, and an ongoing tenant-screening/background-check services investigation.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/opc-news/speeches-and-statements/2024/s-d_20240924/", "source_tier": null, "observed_at": null }, { "statement": "Public bodies in Alberta are required to implement a privacy management program by June 11, 2026, when the one-year grace period under the Protection of Privacy Act expires.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/major-privacy-changes-new-requirements-for-albertas-public-sector", "source_tier": null, "observed_at": null }, { "statement": "Alberta's OIPC mandated a new Privacy Impact Assessment template for public bodies to standardize compliance with POPA starting May 1, 2026.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/alberta", "source_tier": null, "observed_at": null } ] } ] }