If personal information your organization holds is lost, stolen or accessed without authorization, you may have a legal duty to report it. Here's a plain-language overview of the rules that apply to most private-sector organizations in Alberta. It's general information, not legal advice — talk to a lawyer about your specific situation.
Which law applies?
Most private-sector organizations in Alberta are covered by Alberta's Personal Information Protection Act (PIPA). Federally regulated businesses, and personal information that crosses provincial or national borders in the course of commercial activity, can fall under the federal Personal Information Protection and Electronic Documents Act (PIPEDA). Some organizations are subject to both, and health information held by health custodians has its own rules.
The key test: a real risk of significant harm
Both laws focus on whether a reasonable person would consider that the breach creates a real risk of significant harm to the people affected. Harm can include identity theft, financial loss, humiliation or damage to reputation or relationships. Two factors matter most:
- How sensitive is the information? Banking details, government ID numbers, health information and passwords are highly sensitive.
- How likely is misuse? Information taken by a criminal is riskier than an email sent to the wrong colleague who deleted it.
What PIPA requires
Under PIPA, if a breach creates a real risk of significant harm, you must notify the Office of the Information and Privacy Commissioner of Alberta without unreasonable delay. The Commissioner can then require you to notify the affected individuals.
What PIPEDA requires, where it applies
- Report the breach to the Office of the Privacy Commissioner of Canada as soon as feasible.
- Notify affected individuals, and any organizations that could help reduce the harm.
- Keep a record of every breach of security safeguards for at least 24 months — even those you don't report.
Knowingly failing to report a qualifying breach, or to keep breach records, can lead to fines of up to $100,000 under PIPEDA.
A practical sequence
- Contain: stop the breach — lock accounts, retrieve information, isolate affected systems.
- Assess: work out what information was involved, how many people are affected and whether there's a real risk of significant harm.
- Notify: report to the regulator and notify individuals where required, clearly and promptly.
- Prevent: fix the root cause and record what happened and what you changed.
Key takeaways
- Decide in advance who assesses breaches and who makes the call on reporting.
- Record every breach, even small ones.
- When in doubt, get legal advice quickly — the clock starts when you discover the breach.