Alberta and British Columbia Each Have a Personal Information Protection Act. They Are Not the Same Law

Substantially Similar: What the Exemption Orders Do

The mechanism sits in section 26(2)(b) of the Personal Information Protection and Electronic Documents Act. If the Governor in Council is satisfied that provincial legislation substantially similar to Part 1 applies to an organization, activity or class, it may by order exempt them from Part 1 for collection, use or disclosure that occurs within that province.

Two orders were made under that power and registered on 12 October 2004: the Organizations in the Province of Alberta Exemption Order (SOR/2004-219) and the Organizations in the Province of British Columbia Exemption Order (SOR/2004-220). Each has one operative section, and the two are worded identically apart from the province and statute named. Three limits are built into that single sentence:

• It exempts organizations to which the provincial Act applies, so the provincial statute's own scope decides who benefits
• It excludes federal works, undertakings or businesses, which stay under PIPEDA inside either province
• It covers collection, use and disclosure that occurs within the province, so activity crossing the provincial border is outside the exemption

British Columbia's statute states the same boundary from its side. Section 3(2)(c) of the BC Act provides that it does not apply to collection, use or disclosure of personal information if PIPEDA applies to it.

Two Statutes With the Same Name

Alberta's Personal Information Protection Act is SA 2003, c. P-6.5. British Columbia's is SBC 2003, c. 63, assented to on 23 October 2003. The currency of the official versions differs by a year, and the difference matters for anyone reading them side by side.

The Alberta King's Printer office consolidation is current as of 1 September 2025, and the King's Printer catalogue listed the same date on 21 September 2026. Its section histories record 2025 changes (cited as 2025 c6 and AR 141/2025), and the definitions of the Commissioner, public body and local government body now point to Alberta's Access to Information Act. The Legislative Assembly of Alberta's list of bills for the Second Session of the 31st Legislature (2025 to 2026) contains no bill with "privacy" or "personal information" in its title; this publication did not read the text of every bill on that list.

The BC Laws consolidation is current to 15 September 2026. Its table of legislative changes for 2024 onward records one change in force (to section 3, effective 15 January 2024) and a set of changes not yet in force, discussed below.

Who Each Act Reaches

The organization definitions diverge at the edges. Alberta's section 1(1)(i) includes corporations, unincorporated associations, trade unions, partnerships and individuals acting in a commercial capacity, and excludes individuals acting in a personal or domestic capacity. Section 56 then carves non-profits back out: the Act does not apply to a non-profit organization, as defined by reference to Alberta's Societies Act, Agricultural Societies Act and Part 9 of the Companies Act, except for personal information collected, used or disclosed in connection with a commercial activity. Selling or leasing membership, donor or fund-raising lists is listed as commercial.

British Columbia's section 1 includes a person, an unincorporated association, a trade union, a trust or a not for profit organization, and excludes individuals acting in a personal or domestic capacity or as employees, public bodies, the courts, the Nisg̱a'a Government and certain private family trusts. BC also narrows what counts as personal information: the definition excludes contact information and work product information, meaning information an individual prepares or collects as part of their employment or business responsibilities.

Employee Personal Information

Both Acts let an organization collect, use and disclose information about its workforce without consent, within limits. They draw the category differently, and they attach the notice requirement to different people.

Alberta's term is personal employee information. Section 1(1)(j) defines it by reference to a potential, current or former employee, as information reasonably required to establish, manage or terminate an employment or volunteer-work relationship, or to manage a post-employment or post-volunteer-work relationship. The definition of employee in section 1(1)(e) extends to partners, directors, officers, apprentices, volunteers, participants, students and those working under a contract or agency relationship. Section 15 permits collection without consent if the information is collected solely for those purposes and it is reasonable for the particular purpose, and, for a current employee only, after reasonable notification that the information is going to be collected and why. Sections 18 and 21 apply the same structure to use and disclosure.

British Columbia's term is employee personal information: information collected, used or disclosed solely for purposes reasonably required to establish, manage or terminate an employment relationship, excluding information not about the individual's employment. Employee includes a volunteer. Sections 13, 16 and 19 permit collection, use and disclosure without consent where reasonable for those purposes, and each requires the organization to notify the individual, before acting without consent, that it will do so and for what purposes. BC's notice rule is not limited to current employees in the way Alberta's is, and BC's definition has no express post-employment limb.

Alberta's Mandatory Breach Notification

This is the sharpest difference between the two statutes. Section 34.1 of Alberta's Act requires an organization with personal information under its control to notify the Commissioner, without unreasonable delay, of any incident involving loss of or unauthorized access to or disclosure of that information where a reasonable person would consider that there exists a real risk of significant harm to an individual. The provision was added by 2009 c. 50.

Notice to individuals works differently from the federal model. Under section 37.1 it is the Commissioner who may require the organization to notify individuals facing a real risk of significant harm, within a time the Commissioner sets and on any added terms, and section 37.1(3) requires an expedited process where the risk is obvious and immediate. Section 37.1(7) preserves an organization's ability to notify on its own initiative. The Personal Information Protection Act Regulation (current as of 25 June 2026) fills in the content. Section 19 requires a written notice to the Commissioner covering the circumstances, the date or period, the information involved, an assessment of the risk of harm, an estimate of the number of individuals at real risk of significant harm, steps taken to reduce the risk, steps taken to notify individuals, and a contact person. Section 19.1 requires direct notice to individuals with a narrower list, unless the Commissioner accepts indirect notice.

Section 59(1)(e.1) makes failure to notify the Commissioner under section 34.1 an offence.

British Columbia's Act has no counterpart. Its care-of-information part consists of section 33 (accuracy), section 34 (reasonable security arrangements) and section 35 (retention, including a one-year minimum where the information was used to make a decision directly affecting the individual). Nothing in the consolidation current to 15 September 2026 requires notice of a breach to the Commissioner or to affected individuals, and none of the pending amendments adds one.

Offences and Fines

The fine ceilings match to the dollar. Alberta's section 59(2) and British Columbia's section 56(2) each set a maximum of $10,000 for an individual and $100,000 for a person other than an individual. What triggers them does not match.

Both statutes add a private damages action that opens only after the regulatory process ends. Alberta's section 60 gives an individual affected by a final Commissioner order, or by conduct leading to a final conviction, a cause of action for loss or injury suffered as a result. BC's section 57 does the same for actual harm suffered.

British Columbia's Credit-Reporting Amendments, Not Yet in Force

The pending BC changes come from a consumer protection bill. Bill 28, the Business Practices and Consumer Protection Amendment Act (No. 2), 2025, passed third reading on 3 December 2025 and appears in the BC Act's table of legislative changes as SBC 2025, c. 31. Sections 16 to 26 amend the Personal Information Protection Act, and the table lists every one of those changes as coming into force on 1 August 2027 under B.C. Reg. 126/2026.

• A credit reporting agency answering an access request must also provide the individual's credit score, in substantially the same form it would give a person requesting that score (amended section 23(2))
• A new section 24.1 gives individuals a right to ask a credit reporting agency to correct errors or omissions; the agency must correct and send the correction to organizations it disclosed the information to in the prior year, or annotate the record with the correction requested, within a period to be prescribed
• A credit reporting agency may not charge for access to non-employee personal information unless less than a month has passed since the individual's previous request (new section 32(2.1))
• Contravening the credit-score or fee rules becomes an offence for a credit reporting agency (new section 56(1.1))
• Withdrawal of consent under section 9(6) is displaced while a credit freeze request under the consumer protection statute is in effect

Where the Two Provinces Differ From Each Other

Consent is where the two Acts sit closest. Both deem consent where an individual voluntarily provides information for an obvious or reasonable purpose (Alberta section 8(2), BC section 8(1)), both deem consent for enrolment in insurance, pension and benefit plans by a non-applicant beneficiary, and both allow collection, use or disclosure on notice with a reasonable opportunity to decline (Alberta section 8(3), BC section 8(3)). The joint consent guidance the two commissioners issued with the federal office in 2018 notes that PIPEDA's section 6.1 test of understanding the consequences of consent is not currently written into either provincial Act.

Frequently Asked Questions