Alberta, Canada Data Protection & Privacy Regulation

Controller/Processor Duties

Alberta tightened a procedural controller obligation: the Office of the Information and Privacy Commissioner of Alberta mandated a new Privacy Impact Assessment template for public-body submissions under the Protection of Privacy Act, effective May 1, 2026, and the OIPC will not accept PIA submissions in the old format from that date onward. This is an accountability-and-assessment tightening applicable to all public bodies conducting privacy impact assessments, not confined to any single sector. Separately, the Protection of Privacy Act applies the same Real Risk of Significant Harm threshold for breach notification that governs private-sector organizations under the Personal Information Protection Act; public bodies must notify the OIPC and affected individuals where a breach poses a real risk of significant harm, though the precise PIPA breach-notification provision number was not independently re-confirmed. Together, these developments reflect continued procedural tightening of Alberta's public-body accountability framework even as the underlying statutory thresholds for breach notification remain unchanged.

Outlook

Whether public bodies' transition to the new PIA template surfaces any compliance gaps, and whether the RROSH breach-notification threshold is itself revisited as part of any future PIPA or POPA amendment, remain points to watch going forward.

Controller/Processor Duties

Alberta tightened a procedural controller obligation this cycle: the Office of the Information and Privacy Commissioner of Alberta mandated a new Privacy Impact Assessment template for public-body submissions under the Protection of Privacy Act, effective May 1, 2026, and the OIPC will not accept PIA submissions in the old format from that date onward. This is an accountability-and-assessment tightening applicable to all public bodies conducting privacy impact assessments, not confined to any single sector. Separately, the Protection of Privacy Act applies the same Real Risk of Significant Harm threshold for breach notification that governs private-sector organizations under the Personal Information Protection Act; public bodies must notify the OIPC and affected individuals where a breach poses a real risk of significant harm, though the precise PIPA breach-notification provision number was not independently re-confirmed this cycle. Together, these developments reflect continued procedural tightening of Alberta's public-body accountability framework even as the underlying statutory thresholds for breach notification remain unchanged.

Outlook

Whether public bodies' transition to the new PIA template surfaces any compliance gaps, and whether the RROSH breach-notification threshold is itself revisited as part of any future PIPA or POPA amendment, remain points to watch going forward.

Controller/Processor Duties

The standing breach-notification duty under PIPA requires an organisation to notify the OIPC without unreasonable delay of a loss, unauthorized access, or disclosure presenting a real risk of significant harm, with the Commissioner then deciding whether individual notification to affected persons is also required. This cycle's material development sits alongside that standing duty rather than replacing it: Bill 31, the Red Tape Reduction Statutes Amendment Act, 2026, creates a narrow exemption to the Protection of Privacy Act's no-sale rule specifically for the AGLC, permitting the sale or disclosure of PlayAlberta customer personal information where cabinet is satisfied that reasonable protective measures are in place following any such sale. The OIPC publicly characterised this carve-out as setting a concerning precedent, a notable position for the regulator to take against a legislative amendment affecting a public-sector gambling operator's data-handling latitude. The exemption is gambling-sector specific and does not alter the general private-sector no-sale default that continues to apply outside this carve-out.

Outlook

Whether the AGLC carve-out is exercised, and how cabinet assesses what counts as reasonable protective measures in any future sale, remains to be seen; no sale under the new exemption has been evidenced this cycle. The OIPC's concerning-precedent framing suggests continued regulatory attention to how the exemption is used going forward.

Controller/Processor Duties

The Office of the Information and Privacy Commissioner of Alberta mandated a new Privacy Impact Assessment template for public bodies under the Protection of Privacy Act (POPA), effective 1 May 2026. This new template applies specifically to public-body controllers and does not extend to PIPA-governed private-sector organisations, meaning Alberta's private sector continues to operate under whatever PIA practices individual organisations have adopted voluntarily, without a mandated template equivalent to the public-sector one.

This development is understood to be probable rather than confirmed, drawn from a secondary reporting source rather than a directly retrieved primary OIPC or government publication stating the template's mandate in full. It nonetheless represents a tightening of documented accountability expectations for one half of Alberta's dual public/private privacy framework, creating a visible asymmetry between the two sectors' controller/processor duties at a moment when the private-sector PIPA statute itself remains unamended despite years of pending reform recommendations.

The practical effect for organisations operating across both public and private capacities, or contracting with public bodies as processors, is that the new PIA template may create downstream documentation expectations even for private-sector processors supporting public-body controllers, though no evidence this cycle addresses that specific processor-facing question directly.

Outlook

Whether Alberta eventually extends an equivalent PIA template requirement to PIPA-governed private-sector controllers is the key structural question raised by this cycle's public-sector-only measure. Confirming the POPA PIA template's full requirements from a primary OIPC or government source, rather than the secondary reporting currently supporting this finding, would also usefully firm up the current probable-confidence assessment.

Cross-Border & Adequacy

Bill C-36, the Protecting Privacy and Consumer Data Act, was introduced in the House of Commons on 15 June 2026 and had reached second reading as of this cycle. The bill would replace Part 1 of the federal Personal Information Protection and Electronic Documents Act with a modernized federal framework, overseen by a new Digital Safety and Data Protection Commission of Canada. For Alberta specifically, the bill's most consequential provision is its express preservation of the substantially-similar exemption, meaning Alberta's Personal Information Protection Act would continue to govern intra-Alberta commercial activity even after the federal successor statute takes effect, with the new federal framework instead governing cross-provincial and international data flows touching Alberta organisations.

The bill also creates a private right of action under the federal framework: once a contravention is established through the regulatory process, whether by a Commissioner's finding, a Commission review decision, or a Federal Court ruling on appeal, an affected individual may bring a claim within two years of becoming aware of the contravention. This is a federal mechanism rather than a direct PIPA amendment, but it would apply to Alberta organisations' cross-border data handling once the bill passes and the private right of action becomes operative.

As of this cycle, Bill C-36 remains at second reading, meaning both the substantially-similar exemption's final wording and the private-right-of-action mechanism remain subject to amendment before passage.

Outlook

The principal item to watch is Bill C-36's progress through the House of Commons beyond second reading. Any amendment affecting the substantially-similar exemption would have direct consequences for whether Alberta's PIPA continues to govern intra-Alberta commercial activity independently, or whether the federal framework's reach expands.

Cross-Border & Adequacy

Federal Bill C-36, the Protecting Privacy and Consumer Data Act, had its first reading on 15 June 2026 and explicitly preserves Alberta PIPA's substantially-similar provincial exemption from the federal PIPEDA standard. Alberta and British Columbia are the only two provinces whose private-sector privacy statutes have been deemed substantially similar to PIPEDA, a designation that allows Alberta organisations to be governed by PIPA rather than the federal statute for most private-sector purposes.

However, the preservation clause in C-36 is understood to carry a maintenance risk: if Alberta does not amend PIPA to keep pace with the new requirements C-36 would introduce federally, the substantially-similar designation could, over time, come under pressure, since the designation depends on Alberta's statute remaining broadly equivalent to the federal standard as that standard evolves. This risk sits alongside the separate, longer-running fact that no PIPA amendment bill has been introduced in Alberta despite the Standing Committee's 12 recommendations having been published in February 2025, meaning Alberta's statute has not moved in step with reform pressure even before C-36's first reading raised this new federal-alignment consideration.

This finding is probable rather than confirmed, since it rests on a secondary legal-commentary source's reading of C-36's preservation clause rather than a directly retrieved primary text of the bill itself; the practical mechanics of how and when the substantially-similar designation might be reassessed have not been established in the evidence available this cycle.

Outlook

Whether Alberta responds to C-36's first reading by initiating its own PIPA amendment process, potentially folding in the Standing Committee's 12 recommendations alongside any changes needed to keep pace with the new federal standard, is the central cross-border question to watch. Confirming the exact preservation and reassessment mechanics of C-36's provincial-exemption clause from the bill's primary text, rather than secondary commentary, would also usefully firm up this cycle's probable-confidence assessment.

Sectoral Watch

Two sectoral developments are active in Alberta this cycle. In the health sector, Bill 11 introduces significant amendments to the Health Information Act that raise privacy, accountability and AI-in-healthcare concerns, and the OIPC has issued Privacy Impact Assessment guidance specifically addressing AI scribe tools used in clinical settings. This pairing of a legislative amendment with targeted regulator guidance on a specific AI application indicates the health sector overlay is actively moving, with the OIPC positioning itself to address AI-driven clinical documentation tools as they are adopted by Alberta health providers.

In the education sector, the OIPC reported 31 breach notices from Alberta schools using the PowerSchool platform, forming part of a cyberattack reported to have affected 5.2 million Canadians nationally. The scale of the national impact suggests this is not an Alberta-specific vulnerability but rather Alberta's share of a broader Canadian education-sector incident; the 31 notices from Alberta schools represent the locally reportable portion of a much larger cross-jurisdictional breach event.

Both developments are assessed at probable confidence, drawn from secondary reporting rather than directly retrieved primary OIPC breach-notification or health-ministry sources; the exact number of Alberta individuals affected by the PowerSchool breach, as distinct from the national figure, has not been separately confirmed in the evidence available this cycle.

Outlook

Confirming the Alberta-specific individual-count impact of the PowerSchool breach, as distinct from the 5.2 million national figure, from a primary OIPC source would clarify the scale of this cycle's most significant sectoral data event. On the health-sector track, watching how Bill 11 progresses through the Legislature and whether the OIPC's AI scribe guidance evolves into a more formal instrument would clarify whether the health-sector overlay is moving toward a durable new compliance requirement or remains guidance-level for now.

Algorithmic, Biometric & Surveillance Governance

Alberta continues to apply the national framework in a non-binding, principles-level way through the Office of the Information and Privacy Commissioner's participation in a federal, provincial and territorial joint resolution on responsible artificial-intelligence use in health and health research, issued 29 October 2026. The resolution addresses the use of AI systems in clinical and research contexts involving health information, an area where Alberta's Health Information Act already governs the handling of personal health information more broadly. No new statutory obligation has been created by the resolution itself; it remains a non-binding statement of shared intent among the participating regulators rather than a binding rule with force under Alberta law.

The significance of the resolution lies less in its immediate legal effect and more in what it discloses about where the Commissioner's attention is directed. By joining counterparts in other jurisdictions on this specific topic, the Office signals that AI use in health and health research is an area it considers warrants coordinated attention, even ahead of any Alberta-specific rule addressing it directly.

Outlook

Whether the resolution will be followed by any Alberta-specific instrument touching the Health Information Act, such as updated guidance for health-sector AI use, has not been established. For organisations in Alberta's health sector, the resolution is best read as an indication of the direction regulatory expectation is moving in, rather than as a rule that currently applies to their activities. No compliance step is required by the resolution as it stands; the development to watch for is any follow-on Alberta-specific guidance or amendment that would convert this shared principle into an enforceable requirement.

Algorithmic, Biometric & Surveillance Governance

Bill C-36, the federal government's current privacy-reform vehicle introduced 15 June 2026, does not include any equivalent to the former Bill C-27's Artificial Intelligence and Data Act, which would have created a dedicated framework for regulating high-impact artificial-intelligence systems through risk assessments, record-keeping obligations and published system descriptions. This is a negative finding of direct relevance to Alberta organisations deploying or considering algorithmic decision-making systems that interact with personal information: in the absence of a standalone AI statute, any algorithmic-governance obligations for such systems would need to be found, if at all, within the general privacy framework rather than a dedicated AI-risk track.

This omission is the second consecutive instance of a federal privacy-reform bill declining to carry forward a standalone AI-risk framework, following the earlier lapse of Bill C-27's AIDA component. For Alberta organisations, this means that as of this cycle, there is no indication that automated-decision-making or high-impact AI systems will face a dedicated statutory risk-assessment and disclosure regime at the federal level in the near term, leaving general PIPA and (for public bodies) POPA obligations as the operative framework for any algorithmic processing of personal information.

Outlook

Watch whether amendments are introduced to Bill C-36 as it proceeds past second reading that would reintroduce AI-specific obligations, and whether Alberta's own PIPA reform process, expected to produce a bill later in 2026, addresses algorithmic decision-making separately from the federal track.

Algorithmic, Biometric & Surveillance Governance

The OIPC alerted Alberta citizens to privacy risks arising from 23andMe's asset sale to TTAM, a matter that falls under PIPA given the genetic data involved in the transaction. Genetic data of this kind sits among the most sensitive categories of personal information Alberta's private-sector statute addresses, and an asset sale involving a genetic-testing company's data holdings raises the kind of downstream-use and consent questions that biometric and algorithmic governance frameworks are generally designed to anticipate.

This alert is assessed at probable confidence, drawn from secondary reporting rather than a directly retrieved primary OIPC alert page, and the specific scope of the OIPC's warning, including whether it addresses consent-transfer mechanics, data-retention obligations on the acquiring entity, or simply flags the transaction for public awareness, has not been established in the evidence available this cycle.

This development sits alongside, but is evidentially distinct from, the health-sector AI scribe guidance the OIPC has issued this cycle; both reflect an active OIPC posture toward emerging categories of sensitive-data risk, genetic data on one hand and AI-processed clinical data on the other, without yet amounting to a new statutory instrument specific to either category.

Outlook

Confirming the specific content and legal basis of the OIPC's 23andMe/TTAM alert from a primary OIPC source would clarify what, if any, concrete guidance Alberta residents or affected organisations should draw from it. More broadly, whether the OIPC's active posture toward genetic and AI-processed data this cycle develops into a more formal algorithmic or biometric governance instrument, rather than case-by-case alerts and guidance, is the structural question to watch.

Enforcement & Redress

Alberta's enforcement toolkit remains structurally limited: the Office of the Information and Privacy Commissioner of Alberta can investigate complaints, issue findings, and order compliance, but cannot impose administrative monetary penalties directly, a gap the February 2025 Standing Committee on Resource Stewardship review proposed remedying by granting AMP authority with defined criteria and an appeal mechanism. British Columbia's Office of the Information and Privacy Commissioner already holds such authority, underscoring the contrast. At the federal level, Bill C-36, the Protecting Privacy and Consumer Data Act, received first reading on June 15, 2026; it proposes federal administrative monetary penalties of up to the greater of $10 million or 3% of gross global revenue for serious violations, and explicitly preserves the substantially-similar provincial exemption, meaning Alberta's Personal Information Protection Act would continue to govern intra-provincial commercial activity while Bill C-36 would apply to cross-provincial and international activity. The combination of a continuing provincial enforcement gap and an advancing federal AMP regime creates structural pressure on Alberta to consider aligning its own enforcement powers, though no Alberta amendment bill addressing this has yet been introduced.

Outlook

Whether Alberta introduces its own AMP-authority amendment to PIPA before or after Bill C-36 progresses federally, and whether Bill C-36's own legislative status advances beyond first reading, are the two developments most likely to reshape Alberta's enforcement and redress landscape going forward.

Enforcement & Redress

Alberta's enforcement toolkit remains structurally limited this cycle: the Office of the Information and Privacy Commissioner of Alberta can investigate complaints, issue findings, and order compliance, but cannot impose administrative monetary penalties directly, a gap the February 2025 Standing Committee on Resource Stewardship review proposed remedying by granting AMP authority with defined criteria and an appeal mechanism. British Columbia's Office of the Information and Privacy Commissioner already holds such authority, underscoring the contrast. At the federal level, Bill C-36, the Protecting Privacy and Consumer Data Act, received first reading on June 15, 2026; it proposes federal administrative monetary penalties of up to the greater of $10 million or 3% of gross global revenue for serious violations, and explicitly preserves the substantially-similar provincial exemption, meaning Alberta's Personal Information Protection Act would continue to govern intra-provincial commercial activity while Bill C-36 would apply to cross-provincial and international activity. The combination of a continuing provincial enforcement gap and an advancing federal AMP regime creates structural pressure on Alberta to consider aligning its own enforcement powers, though no Alberta amendment bill addressing this has yet been introduced.

Outlook

Whether Alberta introduces its own AMP-authority amendment to PIPA before or after Bill C-36 progresses federally, and whether Bill C-36's own legislative status advances beyond first reading, are the two developments most likely to reshape Alberta's enforcement and redress landscape going forward.

Enforcement & Redress

The Office of the Information and Privacy Commissioner of Alberta issued decision PIPA2026-03 on 19 August 2026, in which an OIPC Adjudicator determined that The Wawanesa Mutual Insurance Company had not failed to meet any PIPA obligation in responding to an access request concerning a coverage-denial letter. This decision illustrates the OIPC's ordinary complaint-adjudication function operating within its current statutory authority, which allows it to investigate complaints, issue findings, and order compliance, but not to impose administrative monetary penalties directly.

That enforcement-authority gap is itself under active reform consideration: Recommendation 3 of the Standing Committee's February 2025 report would grant the OIPC direct AMP authority, though that change had not been enacted as of this cycle. Separately, at the federal level, Bill C-36 would introduce a private right of action distinct from Alberta's provincial enforcement mechanism: once a contravention is established through the regulatory process, whether a Commissioner's finding, a Commission review decision, or a Federal Court ruling on appeal, an individual would have two years from becoming aware of the contravention to bring a claim. This federal mechanism would operate alongside, rather than replace, Alberta's PIPA complaint-and-adjudication process for matters falling within PIPA's intra-provincial scope.

Outlook

Watch for whether Alberta's expected PIPA reform bill, later in 2026, incorporates Recommendation 3's direct AMP authority for the OIPC, and for whether Bill C-36 proceeds past second reading with its private-right-of-action provision intact.

Enforcement & Redress

The OIPC's authority to impose administrative monetary penalties under PIPA remains an unresolved and disputed point in the record this cycle. The Commissioner does not currently have confirmed statutory authority to impose such penalties; the 2025 Standing Committee review of PIPA recommended granting the OIPC AMP authority with clear criteria, but that recommendation has not been enacted into the statute. Separately, a secondary source asserted that an existing penalty cap of $100,000 per breach already applies under PIPA, but this could not be reconciled against the primary statute text within this cycle's research, leaving the claim disputed rather than confirmed. The practical position for now is that PIPA's enforcement toolkit continues to rest primarily on the OIPC's order-making and investigative powers, illustrated this cycle by Order PIPA2026-03, rather than on a settled administrative-penalty regime.

Outlook

Direct retrieval and reading of the PIPA statute's enforcement provisions would resolve whether an administrative-penalty cap is currently in force or whether penalty authority remains solely a pending legislative recommendation. Until that is resolved, the disputed status stands.

Enforcement & Redress

Alberta's enforcement-and-redress landscape continues to be shaped by a standing structural constraint: the OIPC lacks direct fining power under PIPA, with its authority limited to investigating complaints, issuing findings, and ordering compliance. The Standing Committee has recommended new sanctioning powers as part of its broader PIPA reform package, but these have not been enacted, meaning the OIPC's enforcement toolkit remains investigatory and declaratory rather than punitive for private-sector matters.

Against that standing backdrop, the OIPC is this cycle actively handling an incident involving the List of Electors that was made public on 30 April 2026. This is a live matter under active OIPC handling, sourced directly from a primary OIPC resource page, though the incident's ultimate disposition, including any findings or recommendations the OIPC may issue, has not yet been reported in the evidence available this cycle. The List of Electors sits within the public-sector, ATIA-adjacent side of Alberta's tri-statute privacy framework rather than the private-sector PIPA track where the OIPC's fining-power limitation applies.

The juxtaposition of a well-documented structural enforcement-power gap on the private-sector side with an active, ongoing public-sector-adjacent incident illustrates the breadth of matters the OIPC handles despite its limited sanctioning authority: it can investigate and report on incidents across all three statutes it supervises, but its power to compel remedy differs materially depending on which statute and which sector is implicated.

Outlook

The disposition of the List of Electors incident is the clearest near-term development to watch, since any findings or recommendations the OIPC issues will clarify how the regulator handles a live incident within its declaratory but non-punitive authority. Separately, whether the Standing Committee's recommended sanctioning powers are ever introduced as part of a future PIPA amendment bill remains the standing structural question for Alberta's enforcement-and-redress framework generally.