--- title: "Alberta, Canada Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/alberta-canada/ source_html: /jurisdictions/alberta-canada/index.html description: "Alberta, Canada data protection and privacy regulation: 10 categories, 85 claims, updated 2026-11-04." generated_at: 2026-11-07T14:58:19Z content_sha256: abc36b073fdb942636803e1c814d69e7c2962fd304094c6c2fe6cf05e408cb5e generator: "fe-fleet/md-twin@1.0" --- # Alberta, Canada Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed hybrid regime overlaps: artificial-intelligence Last updated 2026-11-04 · 10 categories · 85 claims · 40 sources in the cumulative register Download report (PDF) Expand all Alberta's PIPA modernization track is the most active data-protection reform signal in CA-AB this cycle. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not covered: AdTech & Commercial Privacy. Not fully checked this cycle: Regulator & Framework, Algorithmic, Biometric & Surveillance Governance (2 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=ALBERTA-CANADA)[Build Report](/reports/?j=ALBERTA-CANADA)[Compare](/compare/?j=ALBERTA-CANADA) Framework posture Hybrid regime 9 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Office of the Information and Privacy Commissioner of Alberta (OIPC) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 9 / 10 modules assessed 0 Confirmed · 9 Probable · 0 Uncertain · 1 Not yet assessed 10 Categories 0 Red categories 57 Sub-modules 85 Claims 13 Tier-1 sources Traffic-light mix 1 green 8 amber 1 n/a (sums to 10 rendered categories; click to filter) No red categories; 21 sub-modules are flagged red. Canada federal law that applies in Alberta, Canada is covered once, on the [Canada](/jurisdictions/canada/) page. This page covers Alberta, Canada’s own layer: its own law, regulators and enforcement. ## Jurisdiction brief Jurisdiction lead brief 700 Full executive summary 406 ###### Latest update · 4 November 2026 #### Lead Signal The Office of the Information and Privacy Commissioner of Alberta has joined a federal, provincial and territorial joint resolution on the responsible use of artificial intelligence in health and health research, issued on 29 October 2026. The resolution is non-binding and creates no new statutory obligation on its own, but it signals that Alberta's privacy regulator is aligning itself with counterparts across the country on a common set of expectations for AI used in clinical and research settings involving health information. For organisations operating in Alberta's health sector, this is a marker of where regulatory expectation is heading even though no enforceable rule has yet followed from it. #### Other Developments There is no other development to report beyond the joint resolution. #### Cross-Monitor Connections The joint resolution concerns the governance of artificial intelligence systems and sits adjacent to work tracked in more depth elsewhere in this operation's monitoring of artificial intelligence regulation specifically; this brief notes the resolution's privacy dimension only and does not analyse the broader AI-governance question in its own right. #### Outlook Because the resolution is a statement of shared principle rather than a binding instrument, no immediate compliance consequence follows from it. The more significant marker to watch is whether any Alberta-specific instrument, such as guidance tied to the Health Information Act, follows from this joint position in the coming months. Absent such a follow-on instrument, the resolution functions for now as a signal of regulatory direction rather than a change in the operating environment itself. 5 earlier updates not shown here. ###### Standing brief · as of 23 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Alberta's PIPA modernization track is the most active data-protection reform signal in CA-AB this cycle. A 2025 legislative review produced concrete recommendations across multiple fronts, defining 'significant harm' with specific criteria, requiring organisations to contractually bind third-party service providers to PIPA compliance, adding minors'-specific provisions, granting the Office of the Information and Privacy Commissioner direct administrative-monetary-penalty authority, and raising court-imposed offence fines to a maximum of CAD $10,000 for individuals and CAD $100,000 for non-individuals. A public consultation on these recommendations ran between February 2 and May 1, 2026, with the online survey open February 2 to February 17. No amendment bill has been introduced as of the most recent commentary reviewed. #### Other Developments A live federal alignment risk. If Alberta fails to align PIPA with the federal Personal Information and Data Protection Act (PPCDA, Bill C-36), Alberta organisations could face exposure under both laws simultaneously, a risk legal commentary has flagged directly against PIPA's current 'substantially similar' status. Sectoral exposure is rising in education and health. The Office of the Information and Privacy Commissioner reported 31 breach notices from Alberta schools using the PowerSchool Student Information System, involving unauthorized access to personal information. Separately, Bill 11's amendments to the Health Information Act are understood to raise privacy, accountability and AI-use concerns specific to the healthcare sector, a distinct reform track from the private-sector PIPA review. AI is an explicit reform driver. The Government of Alberta cites the ever-increasing use of artificial intelligence as a driver for PIPA modernization, though no concrete AI-governance provisions have been drafted yet. #### Cross-Monitor Connections Bill 11's Health Information Act amendments and their AI-use concerns intersect with artificial-intelligence monitor coverage of algorithmic governance in regulated sectors; readers tracking Alberta's health-AI governance question should expect that thread to develop alongside, rather than inside, this PIPA-focused brief. The PIPA/PPCDA alignment risk also has a natural connection to how the federal privacy regime itself develops, a thread better tracked at the federal jurisdiction level than resolved here. #### Outlook The consultation period closing May 1, 2026 is the clearest near-term event to watch: whether its recommendations, AMP authority for the OIPC, raised fine ceilings, minors' provisions, and third-party processor accountability, translate into an actual introduced bill will determine whether this remains a watch-list item or becomes a resolved reform. The PowerSchool breach and Bill 11's healthcare-AI concerns indicate that sectoral pressure on Alberta's privacy framework is building faster than the legislative track is moving, a gap worth monitoring into the next cycle. Read full brief · 700 words ###### Latest update · 11 October 2026 #### Regulatory Status Alberta's private-sector data-protection framework, the Personal Information Protection Act, remains in a multi-year reform process this cycle, with a public engagement survey completed in February 2026 and a reformed bill expected later in 2026 ahead of an anticipated 2027 Royal Assent. The Office of the Information and Privacy Commissioner currently lacks direct administrative-monetary-penalty authority under PIPA, a gap Recommendation 3 of the Standing Committee's February 2025 report would address. For public bodies, the Protection of Privacy Act's mandatory privacy-impact-assessment template became the sole accepted submission format from 1 May 2026, alongside a Privacy Management Program requirement effective by 11 June 2026. At the federal level, Bill C-36 (Protecting Privacy and Consumer Data Act), introduced 15 June 2026 and now at second reading, would expressly preserve PIPA's substantially-similar exemption for intra-Alberta commercial activity while creating a new federal private right of action and a Digital Safety and Data Protection Commission; the bill notably omits any standalone AI-risk statute. The OIPC's PIPA2026-03 decision (19 August 2026) found no PIPA obligation failure by respondent insurer Wawanesa, illustrating the Commissioner's ordinary adjudicative function operating within its current, AMP-less enforcement authority. #### Outlook Watch for the tabling of Alberta's reformed PIPA bill later in 2026, and for Bill C-36's progress past second reading at the federal level, both of which will shape Alberta's data-protection enforcement and cross-border-transfer architecture going into 2027. ###### Standing brief · as of 23 August 2026 #### Regulatory Status Alberta's private-sector data-protection framework, PIPA, is under active legislative review. The OIPC currently lacks direct fine-imposition authority, and a 2025 review recommends granting it administrative-monetary-penalty authority, raising court-imposed fines to CAD $10,000 (individuals) and CAD $100,000 (non-individuals), defining 'significant harm', requiring contractual binding of third-party processors, and adding minors'-specific provisions. A public consultation on these recommendations ran February 2 to May 1, 2026; no bill has been introduced. A live risk exists that PIPA's 'substantially similar' status relative to the federal PPCDA (Bill C-36) could lapse absent alignment. Sectorally, a PowerSchool breach generated 31 OIPC breach notices from Alberta schools, and Bill 11 raises AI-use concerns in the Health Information Act. #### Outlook The consultation's close on May 1, 2026 and whether its recommendations progress to an introduced bill are the clearest signals to watch; sectoral pressure from education and health is building ahead of the general legislative track. Read full brief · 406 words Key regulatory facts for Alberta, Canada Regulatory Dimension Alberta, Canada Standing Position Jurisdiction Alberta, Canada (CA-AB) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 85 sourced findings) Regulator & Framework A mature, judicially-tested private-sector statute with a dedicated independent regulator and clear substantially-similar status vis-à-vis federal law. Lawful Processing & Special Data Core consent/purpose principles are in force, but special-category and anonymisation frameworks remain gaps pending legislative reform. Data Subject Rights Access rights are established and in force; portability is aspirational/reform-stage only, and precise deadline figures require primary-source verification. Controller/Processor Duties Breach notification and accountability-for-transfers are in force and well-precedented, but DPIA/DPO/ROPA/AMPs infrastructure is thin relative to GDPR-style regimes. Primary Instruments Cited DataGuidance, Office of the Privacy Commissioner of Canada, Clearbreach (legal guide), Alberta, Canada Official Instrument (wunderlich.ca alberta), OIPC Alberta Last Confirmed / Updated 2026-11-04 (40 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Alberta, Canada: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ A mature, judicially-tested private-sector statute with a dedicated independent regulator and clear substantially-similar status vis-à-vis federal law. Primary framework Personal Information Protection Act, SA 2003, c P-6.5 (PIPA) Supervisory authority [Office of the Information and Privacy Commissioner of Alberta (OIPC)](https://oipc.ab.ca/) Traffic-light rationale — Green A mature, judicially-tested private-sector statute with a dedicated independent regulator and clear substantially-similar status vis-à-vis federal law. #### Sub-modules (5) #### Regulator And AuthorityGreen OIPC enforces PIPA, HIA and POPA/ATIA and reports directly to the Legislature as an independent Officer. Claims (4): - The Office of the Information and Privacy Commissioner of Alberta (OIPC) enforces PIPA and reports to the Officer of the Legislature. - Office of the Information and Privacy Commissioner of Alberta (OIPC) — The OIPC Alberta currently has authority to investigate complaints, issue findings, and order compliance, but cannot impose fines directly. - Office of the Information and Privacy Commissioner of Alberta (OIPC) — A single combined office with no separate access-only, privacy-only, or health-privacy-only regulator, overseeing PIPA, POPA and HIA - Personal Information Protection Act (PIPA) — PIPA (SA 2003, c P-6.5), in force since 2004, is Alberta's private-sector personal-information-protection statute, administered by OIPC Alberta and deemed substantially similar to the federal PIPEDA, exempting intra-provincial commercial activity in Alberta from PIPEDA. #### Act And InstrumentsGreen PIPA is the core private-sector instrument; HIA governs health custodians; POPA/ATIA govern the public sector post-2024 split. Claims (5): - The Personal Information Protection Act, SA 2003, c P-6.5 (PIPA) is the primary act protecting personal data in Alberta's private sector. - Alberta separated its public-sector access/privacy law in 2024, replacing the FOIP Act with the Access to Information Act (ATIA) and the Protection of Privacy Act (POPA), following Bill 33/Bill 34 royal assent on December 5, 2024. - Personal Information Protection Act (PIPA) — No PIPA amendment bill has been introduced as of the most recent tracker update; a 2026-2027 timeframe for a bill remains the only stated expectation, with no commencement date announced - OIPC Alberta currently lacks direct AMP authority under PIPA; a reform recommendation would grant it. - Alberta PIPA reform continues through public engagement; no bill tabled as of this cycle, expected later in 2026. #### Material ScopeGreen PIPA governs collection, use and disclosure of personal information by organizations for purposes a reasonable person would consider appropriate; FOIP/POPA-covered information is excluded from PIPA's scope. Claims (2): - PIPA governs the collection, use and disclosure of personal information by organizations in a manner recognizing both individual protection rights and organizations' need to process information for purposes a reasonable person would consider appropriate. - Bill 31, Red Tape Reduction Statutes Amendment Act, 2026 — Bill 31 (passed May 7-8, 2026) amended the Gaming, Liquor and Cannabis Act to let AGLC sell and disclose PlayAlberta customer personal information notwithstanding POPA's general prohibition on public bodies selling personal information, conditional on Cabinet satisfaction that reasonable protective measures are in place, and limited to the original collection purpose. #### Territorial ScopeAmber No explicit extraterritorial/establishment test for PIPA was identified in the sources reviewed; PIPA applies to organizations operating in Alberta, with PIPEDA governing inter-provincial/international commercial flows by the same organizations. #### Regulator Registration And FilingAmber PIPA empowers the OIPC to comment on Privacy Impact Assessments (PIAs) submitted by organizations, notably for biometric identity-verification services, functioning as a de facto filing/consultation channel rather than a general registration regime. Claims (1): - The OIPC's powers include commenting on the implications of Privacy Impact Assessments (PIAs) submitted to it by organizations. Alberta's private-sector data protection regime is anchored in the Personal Information Protection Act (PIPA), SA 2003, c P-6.5, enforced by the Office of the Information and Privacy Commissioner of Alberta (OIPC). PIPA has been deemed substantially similar to Part 1 of the federal PIPEDA since 2004, which displaces PIPEDA for intra-provincial commercial activity but leaves PIPEDA operative for inter-provincial/international transactions. Alberta's public sector now runs on a separate dual-law model (Protection of Privacy Act/POPA and Access to Information Act/ATIA), both effective following 2024 royal assent, replacing the former FOIP Act, with the OIPC retaining oversight of all regimes. Periodic update · new data 2026-10-25 #### Regulator & Framework Alberta's data-protection framework rests on the Personal Information Protection Act, in force since 2004, Alberta's private-sector personal-information statute administered by the Office of the Information and Privacy Commissioner of Alberta and deemed substantially similar to the federal Personal Information Protection and Electronic Documents Act, which exempts intra-provincial commercial activity in Alberta from PIPEDA's direct application. This structural position is unchanged, but Bill 31, the Red Tape Reduction Statutes Amendment Act, 2026, passed May 7-8, 2026, introduced a material development within the broader framework: it amended the Gaming, Liquor and Cannabis Act to let AGLC sell and disclose PlayAlberta customer personal information notwithstanding the Protection of Privacy Act's general prohibition on public bodies selling personal information. The exception is conditional on Cabinet satisfaction that reasonable protective measures are in place and is limited to the original purpose of collection; the precise Gaming, Liquor and Cannabis Act provision amended was not confirmed, with the finding resting on secondary legal commentary. The amendment represents a narrow, purpose-limited exception rather than a wholesale change to POPA's general no-sale rule, but it establishes a precedent for carving sector-specific exceptions into an otherwise uniform public-body prohibition. #### Outlook Whether the PlayAlberta carve-out model is extended to other public bodies or sectors, and whether the precise Gaming, Liquor and Cannabis Act provision amended by Bill 31 is confirmed in a primary legislative text, remain open questions for Alberta's framework going forward. 1 earlier distinct update(s) Periodic update · new data 2026-10-18 #### Regulator & Framework Alberta's data-protection framework rests on the Personal Information Protection Act, in force since 2004, Alberta's private-sector personal-information statute administered by the Office of the Information and Privacy Commissioner of Alberta and deemed substantially similar to the federal Personal Information Protection and Electronic Documents Act, which exempts intra-provincial commercial activity in Alberta from PIPEDA's direct application. This structural position is unchanged, but Bill 31, the Red Tape Reduction Statutes Amendment Act, 2026, passed May 7-8, 2026, introduced a material development within the broader framework: it amended the Gaming, Liquor and Cannabis Act to let AGLC sell and disclose PlayAlberta customer personal information notwithstanding the Protection of Privacy Act's general prohibition on public bodies selling personal information. The exception is conditional on Cabinet satisfaction that reasonable protective measures are in place and is limited to the original purpose of collection; the precise Gaming, Liquor and Cannabis Act provision amended was not confirmed this cycle, with the finding resting on secondary legal commentary. The amendment represents a narrow, purpose-limited exception rather than a wholesale change to POPA's general no-sale rule, but it establishes a precedent for carving sector-specific exceptions into an otherwise uniform public-body prohibition. #### Outlook Whether the PlayAlberta carve-out model is extended to other public bodies or sectors, and whether the precise Gaming, Liquor and Cannabis Act provision amended by Bill 31 is confirmed in a primary legislative text, remain open questions for Alberta's framework going forward. Sources and claims (12) - [DataGuidance](https://www.dataguidance.com/jurisdictions/alberta) — The Office of the Information and Privacy Commissioner of Alberta (OIPC) enforces PIPA and reports to the Officer of the Legislature. - [DataGuidance](https://www.dataguidance.com/jurisdictions/alberta) — The Personal Information Protection Act, SA 2003, c P-6.5 (PIPA) is the primary act protecting personal data in Alberta's private sector. - [DataGuidance](https://www.dataguidance.com/jurisdictions/alberta) — Alberta separated its public-sector access/privacy law in 2024, replacing the FOIP Act with the Access to Information Act (ATIA) and the Protection of Privacy Act (POPA), following Bill 33/Bill 34 royal assent on December 5, 2024. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/02_05_d_26/) — PIPA governs the collection, use and disclosure of personal information by organizations in a manner recognizing both individual protection rights and organizations' need to process information for purposes a reasonable person would consider appropriate. - [DataGuidance](https://www.dataguidance.com/jurisdictions/alberta) — The OIPC's powers include commenting on the implications of Privacy Impact Assessments (PIAs) submitted to it by organizations. - [Clearbreach (legal guide)](https://clearbreach.ca/guides/alberta-pipa-reform-update/) — Office of the Information and Privacy Commissioner of Alberta (OIPC) — The OIPC Alberta currently has authority to investigate complaints, issue findings, and order compliance, but cannot impose fines directly. - [https://wunderlich.ca/alberta/](https://wunderlich.ca/alberta/) — Office of the Information and Privacy Commissioner of Alberta (OIPC) — A single combined office with no separate access-only, privacy-only, or health-privacy-only regulator, overseeing PIPA, POPA and HIA - [https://clearbreach.ca/guides/alberta-pipa-reform-update/](https://clearbreach.ca/guides/alberta-pipa-reform-update/) — Personal Information Protection Act (PIPA) — No PIPA amendment bill has been introduced as of the most recent tracker update; a 2026-2027 timeframe for a bill remains the only stated expectation, with no commencement date announced - [OIPC Alberta](https://oipc.ab.ca/) — OIPC Alberta currently lacks direct AMP authority under PIPA; a reform recommendation would grant it. - [OIPC Alberta](https://oipc.ab.ca/) — Personal Information Protection Act (PIPA) — PIPA (SA 2003, c P-6.5), in force since 2004, is Alberta's private-sector personal-information-protection statute, administered by OIPC Alberta and deemed substantially similar to the federal PIPEDA, exempting intra-provincial commercial activity in Alberta from PIPEDA. - [Office of the Information and Privacy Commissioner of Alberta](https://oipc.ab.ca/whats-new/) — Bill 31, Red Tape Reduction Statutes Amendment Act, 2026 — Bill 31 (passed May 7-8, 2026) amended the Gaming, Liquor and Cannabis Act to let AGLC sell and disclose PlayAlberta customer personal information notwithstanding POPA's general prohibition on public bodies selling personal information, conditional on Cabinet satisfaction that reasonable protective measures are in place, and limited to the original collection purpose. - [Government of Alberta](https://www.alberta.ca/personal-information-protection-act-engagement) — Alberta PIPA reform continues through public engagement; no bill tabled as of this cycle, expected later in 2026. ### Alberta, Canada: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core consent/purpose principles are in force, but special-category and anonymisation frameworks remain gaps pending legislative reform. Primary framework Personal Information Protection Act, SA 2003, c P-6.5 (PIPA) Supervisory authority [Office of the Information and Privacy Commissioner of Alberta (OIPC)](https://oipc.ab.ca/) Traffic-light rationale — Amber Core consent/purpose principles are in force, but special-category and anonymisation frameworks remain gaps pending legislative reform. D2 · Lawful Processing — Full Module Record 4 sub-modules · 59 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Alberta, Canada: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Access rights are established and in force; portability is aspirational/reform-stage only, and precise deadline figures require primary-source verification. Primary framework Personal Information Protection Act, SA 2003, c P-6.5 (PIPA) Supervisory authority [Office of the Information and Privacy Commissioner of Alberta (OIPC)](https://oipc.ab.ca/) Traffic-light rationale — Amber Access rights are established and in force; portability is aspirational/reform-stage only, and precise deadline figures require primary-source verification. #### Sub-modules (5) #### Access RightGreen PIPA provides individuals the right to access personal information held by an organization. Claims (2): - PIPA provides individuals the right to access personal data held about them by an organization. - OIPC Alberta — Under PIPA s.36, an individual dissatisfied with an organization's response to a personal-information access/decision request may request review by the Commissioner; in PIPA2026-03 (Aug 19, 2026) the adjudicator found the applicant had not made a valid access request and confirmed no PIPA obligation was breached. #### Rectification And ErasureAmber PIPA imposes correction-related obligations on organizations as part of its access framework; OIPC review materials reference a 'right to erasure' as a reform topic under discussion, implying no fully codified erasure right yet. Claims (1): - A codified 'right to erasure' under PIPA remains a reform-discussion topic rather than a confirmed existing statutory right, per the Alberta Legislative Assembly's PIPA review materials. #### Restriction And ObjectionRed No explicit standalone restriction/objection right distinct from access/correction was confirmed in sources reviewed for PIPA. #### Data PortabilityRed PIPA does not currently include a data portability right; the OIPC has called for amendment to add a 'right to portability and data mobility'. Claims (1): - The Alberta OIPC has called for PIPA to be amended to include a right to portability and data mobility, allowing individuals to obtain or transfer their personal information in a structured, machine-readable format. #### Deadlines And Response WindowsAmber Specific statutory day-count deadlines for PIPA access-request responses were not independently confirmed in the sources reviewed this run. PIPA grants individuals a right of access to personal information held by organizations and corresponding correction rights, but currently lacks a codified data-portability right; the OIPC has called for one modeled on the federal CPPA's data-mobility provisions. Specific statutory response-window day-counts were not confirmed in the sources reviewed. No periodic updates recorded in this cycle Sources and claims (4) - [DataGuidance](https://www.dataguidance.com/jurisdictions/alberta) — PIPA provides individuals the right to access personal data held about them by an organization. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/opc-actions-and-decisions/submissions-to-consultations/sub_pipa_ab_2406/) — A codified 'right to erasure' under PIPA remains a reform-discussion topic rather than a confirmed existing statutory right, per the Alberta Legislative Assembly's PIPA review materials. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/ab_20240924/is_ab_20240924/) — The Alberta OIPC has called for PIPA to be amended to include a right to portability and data mobility, allowing individuals to obtain or transfer their personal information in a structured, machine-readable format. - [https://oipc.ab.ca/whats-new/](https://oipc.ab.ca/whats-new/) — OIPC Alberta — Under PIPA s.36, an individual dissatisfied with an organization's response to a personal-information access/decision request may request review by the Commissioner; in PIPA2026-03 (Aug 19, 2026) the adjudicator found the applicant had not made a valid access request and confirmed no PIPA obligation was breached. ### Alberta, Canada: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Breach notification and accountability-for-transfers are in force and well-precedented, but DPIA/DPO/ROPA/AMPs infrastructure is thin relative to GDPR-style regimes. Primary framework Personal Information Protection Act, SA 2003, c P-6.5 (PIPA) Supervisory authority [Office of the Information and Privacy Commissioner of Alberta (OIPC)](https://oipc.ab.ca/) Traffic-light rationale — Amber Breach notification and accountability-for-transfers are in force and well-precedented, but DPIA/DPO/ROPA/AMPs infrastructure is thin relative to GDPR-style regimes. Periodic update · new data 2026-10-25 #### Controller/Processor Duties Alberta tightened a procedural controller obligation: the Office of the Information and Privacy Commissioner of Alberta mandated a new Privacy Impact Assessment template for public-body submissions under the Protection of Privacy Act, effective May 1, 2026, and the OIPC will not accept PIA submissions in the old format from that date onward. This is an accountability-and-assessment tightening applicable to all public bodies conducting privacy impact assessments, not confined to any single sector. Separately, the Protection of Privacy Act applies the same Real Risk of Significant Harm threshold for breach notification that governs private-sector organizations under the Personal Information Protection Act; public bodies must notify the OIPC and affected individuals where a breach poses a real risk of significant harm, though the precise PIPA breach-notification provision number was not independently re-confirmed. Together, these developments reflect continued procedural tightening of Alberta's public-body accountability framework even as the underlying statutory thresholds for breach notification remain unchanged. #### Outlook Whether public bodies' transition to the new PIA template surfaces any compliance gaps, and whether the RROSH breach-notification threshold is itself revisited as part of any future PIPA or POPA amendment, remain points to watch going forward. Periodic update · new data 2026-10-18 #### Controller/Processor Duties Alberta tightened a procedural controller obligation this cycle: the Office of the Information and Privacy Commissioner of Alberta mandated a new Privacy Impact Assessment template for public-body submissions under the Protection of Privacy Act, effective May 1, 2026, and the OIPC will not accept PIA submissions in the old format from that date onward. This is an accountability-and-assessment tightening applicable to all public bodies conducting privacy impact assessments, not confined to any single sector. Separately, the Protection of Privacy Act applies the same Real Risk of Significant Harm threshold for breach notification that governs private-sector organizations under the Personal Information Protection Act; public bodies must notify the OIPC and affected individuals where a breach poses a real risk of significant harm, though the precise PIPA breach-notification provision number was not independently re-confirmed this cycle. Together, these developments reflect continued procedural tightening of Alberta's public-body accountability framework even as the underlying statutory thresholds for breach notification remain unchanged. #### Outlook Whether public bodies' transition to the new PIA template surfaces any compliance gaps, and whether the RROSH breach-notification threshold is itself revisited as part of any future PIPA or POPA amendment, remain points to watch going forward. Periodic update · new data 2026-10-04 #### Controller/Processor Duties The standing breach-notification duty under PIPA requires an organisation to notify the OIPC without unreasonable delay of a loss, unauthorized access, or disclosure presenting a real risk of significant harm, with the Commissioner then deciding whether individual notification to affected persons is also required. This cycle's material development sits alongside that standing duty rather than replacing it: Bill 31, the Red Tape Reduction Statutes Amendment Act, 2026, creates a narrow exemption to the Protection of Privacy Act's no-sale rule specifically for the AGLC, permitting the sale or disclosure of PlayAlberta customer personal information where cabinet is satisfied that reasonable protective measures are in place following any such sale. The OIPC publicly characterised this carve-out as setting a concerning precedent, a notable position for the regulator to take against a legislative amendment affecting a public-sector gambling operator's data-handling latitude. The exemption is gambling-sector specific and does not alter the general private-sector no-sale default that continues to apply outside this carve-out. #### Outlook Whether the AGLC carve-out is exercised, and how cabinet assesses what counts as reasonable protective measures in any future sale, remains to be seen; no sale under the new exemption has been evidenced this cycle. The OIPC's concerning-precedent framing suggests continued regulatory attention to how the exemption is used going forward. Periodic update · new data 2026-09-28 #### Controller/Processor Duties The Office of the Information and Privacy Commissioner of Alberta mandated a new Privacy Impact Assessment template for public bodies under the Protection of Privacy Act (POPA), effective 1 May 2026. This new template applies specifically to public-body controllers and does not extend to PIPA-governed private-sector organisations, meaning Alberta's private sector continues to operate under whatever PIA practices individual organisations have adopted voluntarily, without a mandated template equivalent to the public-sector one. This development is understood to be probable rather than confirmed, drawn from a secondary reporting source rather than a directly retrieved primary OIPC or government publication stating the template's mandate in full. It nonetheless represents a tightening of documented accountability expectations for one half of Alberta's dual public/private privacy framework, creating a visible asymmetry between the two sectors' controller/processor duties at a moment when the private-sector PIPA statute itself remains unamended despite years of pending reform recommendations. The practical effect for organisations operating across both public and private capacities, or contracting with public bodies as processors, is that the new PIA template may create downstream documentation expectations even for private-sector processors supporting public-body controllers, though no evidence this cycle addresses that specific processor-facing question directly. #### Outlook Whether Alberta eventually extends an equivalent PIA template requirement to PIPA-governed private-sector controllers is the key structural question raised by this cycle's public-sector-only measure. Confirming the POPA PIA template's full requirements from a primary OIPC or government source, rather than the secondary reporting currently supporting this finding, would also usefully firm up the current probable-confidence assessment. D4 · Controller & Processor — Full Module Record 7 sub-modules · 72 words · 13 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Alberta, Canada: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Adequacy inheritance via PIPEDA is confirmed and strong, but Alberta-specific transfer mechanisms (SCCs, TIAs, localisation) are not independently codified. Primary framework Personal Information Protection Act, SA 2003, c P-6.5 (PIPA); Personal Information Protection and Electronic Documents Act (PIPEDA) for trans-border flows Supervisory authority [Office of the Information and Privacy Commissioner of Alberta (OIPC)](https://oipc.ab.ca/) Traffic-light rationale — Amber Adequacy inheritance via PIPEDA is confirmed and strong, but Alberta-specific transfer mechanisms (SCCs, TIAs, localisation) are not independently codified. Periodic update · new data 2026-10-11 #### Cross-Border & Adequacy Bill C-36, the Protecting Privacy and Consumer Data Act, was introduced in the House of Commons on 15 June 2026 and had reached second reading as of this cycle. The bill would replace Part 1 of the federal Personal Information Protection and Electronic Documents Act with a modernized federal framework, overseen by a new Digital Safety and Data Protection Commission of Canada. For Alberta specifically, the bill's most consequential provision is its express preservation of the substantially-similar exemption, meaning Alberta's Personal Information Protection Act would continue to govern intra-Alberta commercial activity even after the federal successor statute takes effect, with the new federal framework instead governing cross-provincial and international data flows touching Alberta organisations. The bill also creates a private right of action under the federal framework: once a contravention is established through the regulatory process, whether by a Commissioner's finding, a Commission review decision, or a Federal Court ruling on appeal, an affected individual may bring a claim within two years of becoming aware of the contravention. This is a federal mechanism rather than a direct PIPA amendment, but it would apply to Alberta organisations' cross-border data handling once the bill passes and the private right of action becomes operative. As of this cycle, Bill C-36 remains at second reading, meaning both the substantially-similar exemption's final wording and the private-right-of-action mechanism remain subject to amendment before passage. #### Outlook The principal item to watch is Bill C-36's progress through the House of Commons beyond second reading. Any amendment affecting the substantially-similar exemption would have direct consequences for whether Alberta's PIPA continues to govern intra-Alberta commercial activity independently, or whether the federal framework's reach expands. Periodic update · new data 2026-09-28 #### Cross-Border & Adequacy Federal Bill C-36, the Protecting Privacy and Consumer Data Act, had its first reading on 15 June 2026 and explicitly preserves Alberta PIPA's substantially-similar provincial exemption from the federal PIPEDA standard. Alberta and British Columbia are the only two provinces whose private-sector privacy statutes have been deemed substantially similar to PIPEDA, a designation that allows Alberta organisations to be governed by PIPA rather than the federal statute for most private-sector purposes. However, the preservation clause in C-36 is understood to carry a maintenance risk: if Alberta does not amend PIPA to keep pace with the new requirements C-36 would introduce federally, the substantially-similar designation could, over time, come under pressure, since the designation depends on Alberta's statute remaining broadly equivalent to the federal standard as that standard evolves. This risk sits alongside the separate, longer-running fact that no PIPA amendment bill has been introduced in Alberta despite the Standing Committee's 12 recommendations having been published in February 2025, meaning Alberta's statute has not moved in step with reform pressure even before C-36's first reading raised this new federal-alignment consideration. This finding is probable rather than confirmed, since it rests on a secondary legal-commentary source's reading of C-36's preservation clause rather than a directly retrieved primary text of the bill itself; the practical mechanics of how and when the substantially-similar designation might be reassessed have not been established in the evidence available this cycle. #### Outlook Whether Alberta responds to C-36's first reading by initiating its own PIPA amendment process, potentially folding in the Standing Committee's 12 recommendations alongside any changes needed to keep pace with the new federal standard, is the central cross-border question to watch. Confirming the exact preservation and reassessment mechanics of C-36's provincial-exemption clause from the bill's primary text, rather than secondary commentary, would also usefully firm up this cycle's probable-confidence assessment. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 69 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Alberta, Canada: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Health-sector overlay is robust and well-evidenced; employment carve-out is confirmed; financial/credit/insurance/telecoms overlays are evidentiary gaps. Primary framework Health Information Act, RSA 2000, c H-5 (health sector); PIPA (employment carve-out) Supervisory authority [Office of the Information and Privacy Commissioner of Alberta (OIPC)](https://oipc.ab.ca/) Traffic-light rationale — Amber Health-sector overlay is robust and well-evidenced; employment carve-out is confirmed; financial/credit/insurance/telecoms overlays are evidentiary gaps. Periodic update · new data 2026-09-28 #### Sectoral Watch Two sectoral developments are active in Alberta this cycle. In the health sector, Bill 11 introduces significant amendments to the Health Information Act that raise privacy, accountability and AI-in-healthcare concerns, and the OIPC has issued Privacy Impact Assessment guidance specifically addressing AI scribe tools used in clinical settings. This pairing of a legislative amendment with targeted regulator guidance on a specific AI application indicates the health sector overlay is actively moving, with the OIPC positioning itself to address AI-driven clinical documentation tools as they are adopted by Alberta health providers. In the education sector, the OIPC reported 31 breach notices from Alberta schools using the PowerSchool platform, forming part of a cyberattack reported to have affected 5.2 million Canadians nationally. The scale of the national impact suggests this is not an Alberta-specific vulnerability but rather Alberta's share of a broader Canadian education-sector incident; the 31 notices from Alberta schools represent the locally reportable portion of a much larger cross-jurisdictional breach event. Both developments are assessed at probable confidence, drawn from secondary reporting rather than directly retrieved primary OIPC breach-notification or health-ministry sources; the exact number of Alberta individuals affected by the PowerSchool breach, as distinct from the national figure, has not been separately confirmed in the evidence available this cycle. #### Outlook Confirming the Alberta-specific individual-count impact of the PowerSchool breach, as distinct from the 5.2 million national figure, from a primary OIPC source would clarify the scale of this cycle's most significant sectoral data event. On the health-sector track, watching how Bill 11 progresses through the Legislature and whether the OIPC's AI scribe guidance evolves into a more formal instrument would clarify whether the health-sector overlay is moving toward a durable new compliance requirement or remains guidance-level for now. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 66 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Alberta, Canada: D7 AdTech & Commercial Privacy 6 sub-modules Not assessed ▾ This module carries an explicit evidentiary gap; Alberta has no adtech-specific statute distinct from PIPA's general consent regime. Supervisory authority [Office of the Information and Privacy Commissioner of Alberta (OIPC)](https://oipc.ab.ca/) Traffic-light rationale — Not assessed This module carries an explicit evidentiary gap; Alberta has no adtech-specific statute distinct from PIPA's general consent regime. #### Sub-modules (6) #### Cookies And TrackersRed No Alberta-specific cookie/tracker consent statute was identified. #### Dark PatternsRed No Alberta-specific dark-pattern prohibition was identified. #### Opt Out SignalsRed No Alberta-specific recognition of Global Privacy Control or similar opt-out signals was identified. #### Clean Rooms And DcrRed No Alberta-specific clean-room/data-collaboration-room rules were identified. #### Cross Context AdvertisingRed No Alberta-specific 'sale'/'share' cross-context advertising framework analogous to US state law was identified. #### Direct MarketingAmber No Alberta PIPA-specific direct-marketing consent/suppression regime distinct from general consent principles was identified; Canada's federal anti-spam law (CASL) may apply but was outside the scope confirmed this run. No Alberta-specific statutory regime for cookies/trackers, dark patterns, opt-out signals, clean rooms, cross-context advertising, or direct marketing was identified in the sources reviewed this run; general PIPA consent/purpose principles would apply by extension, but no dedicated adtech rules, GPC-equivalent recognition, or 'sale'/'share' framework analogous to US state laws were found. Periodic update · new data 2026-10-25 #### AdTech & Commercial Privacy The principal commercial-privacy signal in Alberta is not a standalone adtech rule but the knock-on effect of Bill 31's PlayAlberta carve-out. The Red Tape Reduction Statutes Amendment Act, 2026, passed May 7-8, 2026, amended the Gaming, Liquor and Cannabis Act to let AGLC sell and disclose PlayAlberta customer personal information notwithstanding the Protection of Privacy Act's general no-sale rule for public bodies, conditional on Cabinet satisfaction of reasonable protective measures and limited to the original collection purpose. Because this creates a potential commercial dataset, drawn from a public body's own customer base, that may now be sold subject to conditions, it is the closest Alberta has come to a commercial-data-monetisation development, even though no general adtech-specific transparency or consent rule has itself changed. The precise statutory provision amended was not confirmed, and no indication has emerged of any actual sale having occurred or being imminent; the development is, for now, an enabling framework rather than a completed transaction. #### Outlook Whether AGLC proceeds to an actual sale or disclosure of PlayAlberta customer data under the new exception, and under what conditions Cabinet would be satisfied that reasonable protective measures are in place, are the key questions determining whether this remains a framework-level development or becomes an operative commercial-privacy event. ### Alberta, Canada: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Strong enforcement precedent on biometrics exists, but no codified statutory ADM-transparency or profiling-restriction provision was confirmed; AI-specific rules are emergent/sector-limited (health). Primary framework Personal Information Protection Act, SA 2003, c P-6.5 (PIPA); Health Information Act (AI-in-healthcare overlay) Supervisory authority [Office of the Information and Privacy Commissioner of Alberta (OIPC)](https://oipc.ab.ca/) Traffic-light rationale — Amber Strong enforcement precedent on biometrics exists, but no codified statutory ADM-transparency or profiling-restriction provision was confirmed; AI-specific rules are emergent/sector-limited (health). Periodic update · new data 2026-11-04 #### Algorithmic, Biometric & Surveillance Governance Alberta continues to apply the national framework in a non-binding, principles-level way through the Office of the Information and Privacy Commissioner's participation in a federal, provincial and territorial joint resolution on responsible artificial-intelligence use in health and health research, issued 29 October 2026. The resolution addresses the use of AI systems in clinical and research contexts involving health information, an area where Alberta's Health Information Act already governs the handling of personal health information more broadly. No new statutory obligation has been created by the resolution itself; it remains a non-binding statement of shared intent among the participating regulators rather than a binding rule with force under Alberta law. The significance of the resolution lies less in its immediate legal effect and more in what it discloses about where the Commissioner's attention is directed. By joining counterparts in other jurisdictions on this specific topic, the Office signals that AI use in health and health research is an area it considers warrants coordinated attention, even ahead of any Alberta-specific rule addressing it directly. #### Outlook Whether the resolution will be followed by any Alberta-specific instrument touching the Health Information Act, such as updated guidance for health-sector AI use, has not been established. For organisations in Alberta's health sector, the resolution is best read as an indication of the direction regulatory expectation is moving in, rather than as a rule that currently applies to their activities. No compliance step is required by the resolution as it stands; the development to watch for is any follow-on Alberta-specific guidance or amendment that would convert this shared principle into an enforceable requirement. Periodic update · new data 2026-10-11 #### Algorithmic, Biometric & Surveillance Governance Bill C-36, the federal government's current privacy-reform vehicle introduced 15 June 2026, does not include any equivalent to the former Bill C-27's Artificial Intelligence and Data Act, which would have created a dedicated framework for regulating high-impact artificial-intelligence systems through risk assessments, record-keeping obligations and published system descriptions. This is a negative finding of direct relevance to Alberta organisations deploying or considering algorithmic decision-making systems that interact with personal information: in the absence of a standalone AI statute, any algorithmic-governance obligations for such systems would need to be found, if at all, within the general privacy framework rather than a dedicated AI-risk track. This omission is the second consecutive instance of a federal privacy-reform bill declining to carry forward a standalone AI-risk framework, following the earlier lapse of Bill C-27's AIDA component. For Alberta organisations, this means that as of this cycle, there is no indication that automated-decision-making or high-impact AI systems will face a dedicated statutory risk-assessment and disclosure regime at the federal level in the near term, leaving general PIPA and (for public bodies) POPA obligations as the operative framework for any algorithmic processing of personal information. #### Outlook Watch whether amendments are introduced to Bill C-36 as it proceeds past second reading that would reintroduce AI-specific obligations, and whether Alberta's own PIPA reform process, expected to produce a bill later in 2026, addresses algorithmic decision-making separately from the federal track. Periodic update · new data 2026-09-28 #### Algorithmic, Biometric & Surveillance Governance The OIPC alerted Alberta citizens to privacy risks arising from 23andMe's asset sale to TTAM, a matter that falls under PIPA given the genetic data involved in the transaction. Genetic data of this kind sits among the most sensitive categories of personal information Alberta's private-sector statute addresses, and an asset sale involving a genetic-testing company's data holdings raises the kind of downstream-use and consent questions that biometric and algorithmic governance frameworks are generally designed to anticipate. This alert is assessed at probable confidence, drawn from secondary reporting rather than a directly retrieved primary OIPC alert page, and the specific scope of the OIPC's warning, including whether it addresses consent-transfer mechanics, data-retention obligations on the acquiring entity, or simply flags the transaction for public awareness, has not been established in the evidence available this cycle. This development sits alongside, but is evidentially distinct from, the health-sector AI scribe guidance the OIPC has issued this cycle; both reflect an active OIPC posture toward emerging categories of sensitive-data risk, genetic data on one hand and AI-processed clinical data on the other, without yet amounting to a new statutory instrument specific to either category. #### Outlook Confirming the specific content and legal basis of the OIPC's 23andMe/TTAM alert from a primary OIPC source would clarify what, if any, concrete guidance Alberta residents or affected organisations should draw from it. More broadly, whether the OIPC's active posture toward genetic and AI-processed data this cycle develops into a more formal algorithmic or biometric governance instrument, rather than case-by-case alerts and guidance, is the structural question to watch. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 81 words · 13 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Alberta, Canada: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Age-of-majority baseline is confirmed, but dedicated minor-specific consent/profiling provisions in PIPA are absent or reform-stage only. Primary framework Personal Information Protection Act, SA 2003, c P-6.5 (PIPA) Supervisory authority [Office of the Information and Privacy Commissioner of Alberta (OIPC)](https://oipc.ab.ca/) Traffic-light rationale — Amber Age-of-majority baseline is confirmed, but dedicated minor-specific consent/profiling provisions in PIPA are absent or reform-stage only. D9 · Children's Privacy — Full Module Record 5 sub-modules · 56 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Alberta, Canada: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Strong order-making and offence provisions are in force with active joint enforcement, but the absence of an AMPs regime is a material capability gap relative to peer regimes (Quebec, EU, UK). Primary framework Personal Information Protection Act, SA 2003, c P-6.5 (PIPA) Supervisory authority [Office of the Information and Privacy Commissioner of Alberta (OIPC)](https://oipc.ab.ca/) Traffic-light rationale — Amber Strong order-making and offence provisions are in force with active joint enforcement, but the absence of an AMPs regime is a material capability gap relative to peer regimes (Quebec, EU, UK). Periodic update · new data 2026-10-25 #### Enforcement & Redress Alberta's enforcement toolkit remains structurally limited: the Office of the Information and Privacy Commissioner of Alberta can investigate complaints, issue findings, and order compliance, but cannot impose administrative monetary penalties directly, a gap the February 2025 Standing Committee on Resource Stewardship review proposed remedying by granting AMP authority with defined criteria and an appeal mechanism. British Columbia's Office of the Information and Privacy Commissioner already holds such authority, underscoring the contrast. At the federal level, Bill C-36, the Protecting Privacy and Consumer Data Act, received first reading on June 15, 2026; it proposes federal administrative monetary penalties of up to the greater of $10 million or 3% of gross global revenue for serious violations, and explicitly preserves the substantially-similar provincial exemption, meaning Alberta's Personal Information Protection Act would continue to govern intra-provincial commercial activity while Bill C-36 would apply to cross-provincial and international activity. The combination of a continuing provincial enforcement gap and an advancing federal AMP regime creates structural pressure on Alberta to consider aligning its own enforcement powers, though no Alberta amendment bill addressing this has yet been introduced. #### Outlook Whether Alberta introduces its own AMP-authority amendment to PIPA before or after Bill C-36 progresses federally, and whether Bill C-36's own legislative status advances beyond first reading, are the two developments most likely to reshape Alberta's enforcement and redress landscape going forward. Periodic update · new data 2026-10-18 #### Enforcement & Redress Alberta's enforcement toolkit remains structurally limited this cycle: the Office of the Information and Privacy Commissioner of Alberta can investigate complaints, issue findings, and order compliance, but cannot impose administrative monetary penalties directly, a gap the February 2025 Standing Committee on Resource Stewardship review proposed remedying by granting AMP authority with defined criteria and an appeal mechanism. British Columbia's Office of the Information and Privacy Commissioner already holds such authority, underscoring the contrast. At the federal level, Bill C-36, the Protecting Privacy and Consumer Data Act, received first reading on June 15, 2026; it proposes federal administrative monetary penalties of up to the greater of $10 million or 3% of gross global revenue for serious violations, and explicitly preserves the substantially-similar provincial exemption, meaning Alberta's Personal Information Protection Act would continue to govern intra-provincial commercial activity while Bill C-36 would apply to cross-provincial and international activity. The combination of a continuing provincial enforcement gap and an advancing federal AMP regime creates structural pressure on Alberta to consider aligning its own enforcement powers, though no Alberta amendment bill addressing this has yet been introduced. #### Outlook Whether Alberta introduces its own AMP-authority amendment to PIPA before or after Bill C-36 progresses federally, and whether Bill C-36's own legislative status advances beyond first reading, are the two developments most likely to reshape Alberta's enforcement and redress landscape going forward. Periodic update · new data 2026-10-11 #### Enforcement & Redress The Office of the Information and Privacy Commissioner of Alberta issued decision PIPA2026-03 on 19 August 2026, in which an OIPC Adjudicator determined that The Wawanesa Mutual Insurance Company had not failed to meet any PIPA obligation in responding to an access request concerning a coverage-denial letter. This decision illustrates the OIPC's ordinary complaint-adjudication function operating within its current statutory authority, which allows it to investigate complaints, issue findings, and order compliance, but not to impose administrative monetary penalties directly. That enforcement-authority gap is itself under active reform consideration: Recommendation 3 of the Standing Committee's February 2025 report would grant the OIPC direct AMP authority, though that change had not been enacted as of this cycle. Separately, at the federal level, Bill C-36 would introduce a private right of action distinct from Alberta's provincial enforcement mechanism: once a contravention is established through the regulatory process, whether a Commissioner's finding, a Commission review decision, or a Federal Court ruling on appeal, an individual would have two years from becoming aware of the contravention to bring a claim. This federal mechanism would operate alongside, rather than replace, Alberta's PIPA complaint-and-adjudication process for matters falling within PIPA's intra-provincial scope. #### Outlook Watch for whether Alberta's expected PIPA reform bill, later in 2026, incorporates Recommendation 3's direct AMP authority for the OIPC, and for whether Bill C-36 proceeds past second reading with its private-right-of-action provision intact. Periodic update · new data 2026-10-04 #### Enforcement & Redress The OIPC's authority to impose administrative monetary penalties under PIPA remains an unresolved and disputed point in the record this cycle. The Commissioner does not currently have confirmed statutory authority to impose such penalties; the 2025 Standing Committee review of PIPA recommended granting the OIPC AMP authority with clear criteria, but that recommendation has not been enacted into the statute. Separately, a secondary source asserted that an existing penalty cap of $100,000 per breach already applies under PIPA, but this could not be reconciled against the primary statute text within this cycle's research, leaving the claim disputed rather than confirmed. The practical position for now is that PIPA's enforcement toolkit continues to rest primarily on the OIPC's order-making and investigative powers, illustrated this cycle by Order PIPA2026-03, rather than on a settled administrative-penalty regime. #### Outlook Direct retrieval and reading of the PIPA statute's enforcement provisions would resolve whether an administrative-penalty cap is currently in force or whether penalty authority remains solely a pending legislative recommendation. Until that is resolved, the disputed status stands. Periodic update · new data 2026-09-28 #### Enforcement & Redress Alberta's enforcement-and-redress landscape continues to be shaped by a standing structural constraint: the OIPC lacks direct fining power under PIPA, with its authority limited to investigating complaints, issuing findings, and ordering compliance. The Standing Committee has recommended new sanctioning powers as part of its broader PIPA reform package, but these have not been enacted, meaning the OIPC's enforcement toolkit remains investigatory and declaratory rather than punitive for private-sector matters. Against that standing backdrop, the OIPC is this cycle actively handling an incident involving the List of Electors that was made public on 30 April 2026. This is a live matter under active OIPC handling, sourced directly from a primary OIPC resource page, though the incident's ultimate disposition, including any findings or recommendations the OIPC may issue, has not yet been reported in the evidence available this cycle. The List of Electors sits within the public-sector, ATIA-adjacent side of Alberta's tri-statute privacy framework rather than the private-sector PIPA track where the OIPC's fining-power limitation applies. The juxtaposition of a well-documented structural enforcement-power gap on the private-sector side with an active, ongoing public-sector-adjacent incident illustrates the breadth of matters the OIPC handles despite its limited sanctioning authority: it can investigate and report on incidents across all three statutes it supervises, but its power to compel remedy differs materially depending on which statute and which sector is implicated. #### Outlook The disposition of the List of Electors incident is the clearest near-term development to watch, since any findings or recommendations the OIPC issues will clarify how the regulator handles a live incident within its declaratory but non-punitive authority. Separately, whether the Standing Committee's recommended sanctioning powers are ever introduced as part of a future PIPA amendment bill remains the standing structural question for Alberta's enforcement-and-redress framework generally. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 106 words · 15 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) data localisation Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties