Alberta has its own private-sector privacy law (PIPA), public-sector access and privacy laws (the Access to Information Act and the Protection of Privacy Act, which replaced FOIP in June 2025), and a dedicated health privacy law (HIA). The OIPC Alberta oversees all of them.
TL;DR
Alberta PIPA applies to private-sector organizations instead of PIPEDA. The Access to Information Act (ATIA) and Protection of Privacy Act (POPA), in force June 11, 2025, cover provincial and municipal public bodies and replaced FOIP. HIA covers health information. Complaints go to the OIPC Alberta, which has extensive order-making powers.
Four statutes that apply in Alberta
Alberta has divided its privacy law into focused statutes:
PIPA (Personal Information Protection Act) for private-sector organizations.
ATIA (Access to Information Act) for access to records held by provincial and municipal public bodies, and POPA (Protection of Privacy Act) for how those bodies handle personal information, including breach notification. Both replaced the former FOIP Act on June 11, 2025.
HIA (Health Information Act) for custodians who handle personal health information, such as Alberta Health Services, physicians, and pharmacies.
Breach notification in Alberta
Alberta was the first Canadian jurisdiction to require mandatory breach notification (since 2010). Organizations must report to the OIPC any incident involving a real risk of significant harm.
The OIPC can require the organization to notify affected individuals and, if the organization fails to do so, compel notification.
Order-making powers
The OIPC Alberta has broad order-making powers under PIPA, ATIA, POPA, and HIA, including ordering organizations to stop a practice, disclose records, or destroy records.
An OIPC order can be taken to the Court of King's Bench on judicial review within 45 days (PIPA s.54.1).