Alberta PIPA and BC PIPA: Which Privacy Law Actually Applies to You

A Calgary software company I spoke with last year was sure they had privacy compliance handled. They'd read up on PIPEDA, drafted a policy, named someone to field complaints. Then they hired their first employee in Vancouver, opened a small office, and started keeping HR records there. Nobody warned them that the moment they did, a second privacy law switched on. And it wasn't the federal one.

This is the part of Canadian privacy that catches careful businesses off guard. PIPEDA is not the whole map. Three provinces, Alberta, British Columbia, and Quebec, have their own private-sector privacy statutes that displace PIPEDA inside their borders for most commercial activity. If you operate in any of them, the rules you actually answer to may not be the federal ones you studied.

Why Provincial Laws Exist At All

PIPEDA, the Personal Information Protection and Electronic Documents Act, is the federal baseline. The Act has a built-in off-ramp, though. Under section 26(2)(b), the federal Cabinet can declare a provincial law "substantially similar" to PIPEDA, and where it does, that provincial law governs intra-provincial commercial activity instead.

Three provinces cleared that bar. Alberta and British Columbia each passed a Personal Information Protection Act, both confusingly abbreviated PIPA, that took effect on January 1, 2004. Quebec's private-sector law is older still, dating to 1994, and was overhauled top to bottom by Law 25. All three were declared substantially similar, which means a business operating purely within Alberta is regulated by Alberta PIPA, not PIPEDA, and answers to the Office of the Information and Privacy Commissioner of Alberta rather than the federal OPC.

That phrase "substantially similar" does a lot of quiet work. It does not mean identical. The provincial regulators, the OIPC in Alberta and the OIPC in BC, enforce their own statutes, issue their own orders, and have interpreted key terms differently than Ottawa has. Treating Alberta PIPA and BC PIPA as carbon copies of PIPEDA is exactly how compliance gaps form.

Alberta PIPA BC PIPA: Who Actually Falls Under Them

Here's the rule of thumb that matters. The provincial Acts apply to private-sector organizations collecting, using, or disclosing personal information in the course of activities entirely within that province. PIPEDA reasserts itself the moment data crosses a provincial or national border in the course of commercial activity, or when a federally regulated work (a bank, airline, telecom, or interprovincial transport company) is involved.

So a Lethbridge accounting firm serving Lethbridge clients lives under Alberta PIPA. A Victoria retailer selling only to walk-in BC customers lives under BC PIPA. But the second that Victoria retailer ships an order to a customer in Ontario, the transaction is interprovincial, and PIPEDA governs it. Most real businesses end up straddling both, which is the genuinely awkward part.

There's a second, bigger reason Alberta PIPA and BC PIPA matter more than people expect: employee personal information. PIPEDA largely does not cover the personnel records of provincially regulated employees. The provincial PIPAs do. If you have staff in Alberta or BC, their HR files, performance reviews, background checks, and payroll data sit squarely under provincial law even when your customer-facing data does not. That Calgary company tripped this exact wire by hiring in BC.

A few distinctions worth knowing:

• Alberta PIPA has the tougher breach-reporting trigger of the two. Since 2010 it has required organizations to notify the Commissioner of any breach posing a "real risk of significant harm," after which the Commissioner decides whether individuals must be told. Alberta mandated breach reporting a full eight years before PIPEDA caught up in 2018.
• BC PIPA still has no mandatory breach-notification requirement for private organizations. The BC OIPC recommends voluntary notification and has urged the legislature to add a mandatory regime harmonized with Alberta and PIPEDA, but as of mid-2026 that amendment has not passed. Don't read the gap as a free pass: a serious breach you sit on can still surface as a complaint and an investigation.
• Both Acts cover non-profit organizations to a degree PIPEDA does not. PIPEDA only catches non-profits when they engage in commercial activity. BC PIPA in particular reaches non-commercial organizations like clubs, associations, and charities far more broadly. An Alberta or BC non-profit that assumed it was exempt because PIPEDA spared it can be badly wrong.

The Quebec Outlier

Quebec belongs in this conversation but stands apart. Its private-sector regime, supercharged by Law 25, is now the most demanding privacy law in the country, more onerous than anything in Alberta or BC. The Commission d'accès à l'information, the CAI, enforces it, and it carries administrative monetary penalties of up to $10 million or 2% of worldwide turnover, whichever is greater, plus penal fines that can run higher and a private right of action for damages. Mandatory privacy impact assessments, a designated privacy officer by default, explicit consent standards, data portability, the works.

If you have any operations, customers, or staff in Quebec, you are not in PIPEDA territory or even in the comfortable "substantially similar" zone. You're in a stricter regime with its own French-language and consent rules. Treat Quebec as a separate compliance project, not a footnote.

How To Figure Out Which Law Is Yours

The honest answer for most businesses is: more than one. A mid-sized firm with a head office in Calgary, warehouse staff in BC, online customers across Canada, and a sales rep in Montreal is simultaneously subject to Alberta PIPA for its Alberta operations and employees, BC PIPA for its BC employees, PIPEDA for interprovincial customer transactions, and Quebec's Law 25 for any Quebec data. That is not an exotic edge case. It's an ordinary Canadian SMB.

Work through it in this order:

1. Where are your employees physically located? Staff in Alberta or BC pull you into those provincial PIPAs for HR data, full stop.
2. Where do your customers and their data live, and does data cross borders? Intra-provincial stays provincial; interprovincial or international flips to PIPEDA.
3. Do you touch Quebec at all? If yes, Law 25 applies and it's the strictest thing you'll face.
4. Are you a federally regulated business? Banks, airlines, telecoms, and interprovincial transport stay under PIPEDA regardless of province.

The penalties are no longer theoretical. On prosecution, Alberta's Act allows fines up to $100,000 against an organization, though those are imposed by a court, not levied by the Commissioner. Quebec's ceiling runs into the millions. The federal picture is more static than you might assume: Bill C-27, which would have given the OPC order-making and fining powers through the Consumer Privacy Protection Act, died on the Order Paper when Parliament was prorogued in January 2025 and has not been reintroduced. For now the federal OPC still investigates and recommends rather than fines, but provincial regulators and Quebec's CAI already have real teeth, and the day of the strongly worded letter is ending.

What makes this genuinely hard for smaller companies isn't the reading. It's that the answer shifts every time you hire someone in a new province, open a location, or sign a customer across a border. The legal map is a moving target, and most owners only discover they've crossed a line after a complaint lands.

That's the gap we built Valdra to close, and it's why a quick assessment beats guessing. If you're not certain whether Alberta PIPA, BC PIPA, PIPEDA, or Law 25 governs your business, find out exactly which Canadian privacy laws apply to you before a regulator does it for you.