Canadian Privacy Laws (Part 4): Alberta Privacy Laws
Alberta is one of the provinces that has its own private-sector privacy law. That makes it similar to British Columbia, and different from Ontario, where PIPEDA is still the main law for most private businesses.
The Alberta privacy laws:
- Personal Information Protection Act (PIPA).
- vProtection of Privacy Act (POPA).
- Health Information Act (HIA).
Together, these laws set rules for how organizations, public bodies, and health custodians collect, use, share, protect, and give access to personal information.
PIPA: Alberta’s Private-Sector Privacy Law
The Personal Information Protection Act (PIPA) applies to provincially regulated private-sector organizations in Alberta.
Who it applies to: businesses and, in some cases, non-profit organizations that collect, use, or disclose personal information in Alberta. Federally regulated businesses, such as banks, airlines, and telecommunications companies, are generally still covered by federal privacy law.
What it does: PIPA sets rules for how private organizations collect, use, disclose, protect, and provide access to personal information. Organizations are expected to have reasonable policies and practices, collect information for reasonable purposes, protect personal information, and allow people to request access to their own information.
Why businesses should care: Alberta has its own private-sector privacy law, so businesses operating in the province need to understand PIPA, not just PIPEDA. PIPA can affect how customer information, employee information, marketing data, online forms, service records, and vendor systems are managed.
POPA: Alberta’s Public-Sector Privacy Law
The Protection of Privacy Act (POPA) applies to public bodies in Alberta.
Who it applies to: Alberta public bodies, such as government departments, public agencies, and other public-sector organizations.
What it does: POPA governs how public bodies collect, use, disclose, and protect personal information. It also gives individuals the right to request corrections to personal information about themselves and provides a framework for independent review and privacy complaints.
Why businesses should care: If your company works with Alberta public-sector clients, POPA may influence what those clients expect from you. This could show up in contracts, privacy management requirements, security expectations, data handling rules, privacy incident response, or reporting processes.
HIA: Alberta’s Health Privacy Law
The Health Information Act (HIA) applies to health information in Alberta.
Who it applies to: health custodians and their affiliates, including Alberta Health Services, physicians, pharmacists, nurses, ambulance operators, and organizations or individuals that provide services for custodians.
What it does: HIA sets rules for how health information is collected, used, disclosed, accessed, and protected. It also gives individuals the right to request access to their own health information held by custodians.
Why businesses should care: Health information is highly sensitive. If your business supports a health custodian, manages health-related systems, stores health data, or provides services under contract, HIA may affect privacy, security, access, breach response, and compliance expectations.
How Alberta Privacy Lats Fit with PIPEDA
The biggest difference between Alberta and some other provinces is that Alberta has its own private-sector privacy law.
For many Alberta businesses, PIPA is the main law to understand for local commercial activity. PIPEDA may still matter when personal information crosses provincial or national borders, or when the organization is federally regulated.
That means businesses should not assume one law covers every situation. The right privacy framework depends on where the organization operates, what type of data it handles, whether it is federally regulated, and whether the information is used locally, nationally, or internationally.
Why This Matters for Your Business
If your business operates in Alberta, serves Alberta customers, or supports Alberta organizations, privacy responsibilities may look different than they do in Ontario.
A good starting point is to know what personal information you collect, why you collect it, where it is stored, who can access it, and how long it is kept. It is also important to have clear consent practices, reasonable safeguards, documented privacy policies, and a plan for responding to privacy incidents.
In short, Alberta has a strong provincial privacy framework because it regulates private-sector organizations, public bodies, and health information.
For businesses, that means privacy compliance is not only about following federal rules. It is also about understanding Alberta’s PIPA, POPA, and HIA requirements and building privacy into everyday operations.
Stay tuned for the next entry in our series, where we will look at how privacy laws differ across the Canadian provinces.
Part 4: Provincial Laws – Alberta: Review Alberta’s PIPA framework for private sector accountability and local consent rules.
Part 5: Provincial Laws – Nova Scotia: Learn how Nova Scotia’s regional frameworks shape commercial privacy and administrative accountability.
Part 6: Provincial Laws – Quebec: Dive into Quebec’s Law 25, focusing on strict corporate transparency and severe penalties.
Part 7: Provincial Laws – Manitoba: Map out Manitoba’s legislative landscape to keep regional digital operations compliant.