Alberta's PIPA: what small businesses should know in 2026
A plain-language guide to Alberta's PIPA for small businesses: personal information, consent, safeguards, breach reporting, cross-border use and retention.
Updated
The article
What is Alberta PIPA, and does it apply to your business?
The Personal Information Protection Act (PIPA) is Alberta's privacy law for private-sector organisations. For a small business the answer is usually yes: if you operate in Alberta and collect, use or disclose information about customers, employees or job applicants, the Act applies to you, whatever your size or revenue.
PIPA covers provincially regulated businesses, including sole proprietors and partnerships, and it reaches non-profits only for their commercial activities. It also covers personal employee information, such as hiring records and performance notes. The Office of the Information and Privacy Commissioner of Alberta oversees the Act and handles complaints. Public bodies fall under separate public-sector legislation, and health information held by custodians such as physicians falls under the Health Information Act (HIA).
This article is general information, not legal advice. Check the current Act on the Government of Alberta PIPA page and speak to a lawyer about your own situation.
What counts as personal information under PIPA?
Personal information is information about an identifiable individual. That covers names, home addresses, personal phone numbers and email addresses, photos, ID numbers, payment details, notes about a homeowner's property, employee records and opinions recorded about a person. Business contact details used only to reach someone in their work role are treated differently.
Small firms tend to underestimate where this information sits. A typical list includes the contact form inbox, the accounting system, a CRM, contacts on staff phones, job photos showing a house number, signed forms in a truck, résumés in a shared folder and old spreadsheets nobody has opened in years. An inventory of those places is the first useful step.
Consent, purpose and the person responsible
PIPA expects you to collect personal information only for purposes a reasonable person would consider appropriate, to tell people those purposes at or before collection, and to get consent in a form that suits how sensitive the information is. You must also designate someone responsible for compliance, often the owner or office manager in a small firm.
Consent can be express, such as a ticked box or a signature; deemed, where someone volunteers information for an obvious purpose; or opt-out, where people are told and given a fair chance to decline. The more sensitive the information, the stronger the case for express consent. Using information for a new purpose, such as marketing to people who only gave details for a warranty claim, generally needs fresh consent. Commercial email carries a separate set of consent rules under CASL.
PIPA also expects reasonable written policies that staff follow, with information about them available on request.
When does a privacy breach have to be reported?
An organisation must notify the Office of the Information and Privacy Commissioner of Alberta without unreasonable delay when personal information is lost, accessed or disclosed without authority and a reasonable person would consider there is a real risk of significant harm to an individual. The Commissioner can then require you to notify the people affected.
Real risk of significant harm weighs two things: how damaging the exposure could be, such as identity theft, financial loss or humiliation, and how likely that harm is. A spreadsheet of customer banking details emailed to the wrong address is a very different event from an encrypted laptop left in a taxi. Record your assessment either way.
Safeguards are the other half of this obligation. PIPA requires reasonable security arrangements against unauthorised access, use, disclosure, copying and disposal. For a small team that usually means multi-factor sign-in, current software, encrypted devices, tested backups, access limited by role and a written plan for the day something goes wrong. Our cyber security review, from $1,800, covers those basics, and we refer specialist security testing to firms that do it.
Service providers, cloud tools and processing outside Canada
PIPA does not ban storing or processing personal information outside Canada. It does keep you responsible for what service providers do with it, and it requires your policies and notices to explain when a provider outside Canada collects or handles personal information for you, and who can answer questions about that.
Most small businesses already depend on service providers: an email host, accounting software, a CRM, a form tool, a payroll service and, increasingly, an AI model provider. Find out where each one stores and processes data, write that into your privacy notice, and make sure the terms limit the provider to your purposes. Our guide to Canadian data residency covers when keeping data in Canada matters and what it does not change.
Federal law can apply too. PIPEDA, the federal private-sector privacy law, governs federally regulated businesses such as banks, airlines, telecommunications and interprovincial transport, and personal information that crosses provincial or national borders in commercial activity. An Alberta company selling online to customers in other provinces may deal with both laws.
How long can you keep personal information, and what should software do?
Keep personal information only as long as it is reasonably needed for legal or business purposes. Within a reasonable time after that, destroy the records or make the information non-identifying. Hold back anything that is the subject of an open access request or complaint until that matter is resolved, then apply the same rule.
People can ask for access to their own information, and PIPA generally gives an organisation 45 days to respond, with extensions only in limited cases. Retention and access both work better when built into systems rather than left to memory. The table maps each main obligation to practice and to software.
| Obligation | What it means in practice | What a website or software build should do |
|---|---|---|
| Purpose and notice | Tell people why you collect each item, at or before collection | Short purpose notes beside form fields and a privacy notice linked from every form |
| Consent | Match the form of consent to the sensitivity and the use | Unticked opt-in boxes for marketing and a record of when and how consent was given |
| Collect only what is needed | Every field should serve a stated purpose | No unused optional fields and no open text boxes that invite sensitive detail |
| Safeguards | Security suited to how sensitive the data is | Role-based access, multi-factor sign-in, encryption, access logs and tested backups |
| Breach reporting | Assess real risk of significant harm and notify without unreasonable delay | Logs that show who viewed or exported what, so the affected records can be identified |
| Service providers and cross-border processing | You stay responsible and must explain providers outside Canada | A documented list of every provider, the data it sees and the region it uses |
| Retention and disposal | Keep only as long as needed, then destroy or de-identify | Scheduled deletion or de-identification, with the rule written down |
| Access and correction | Individuals can see and correct their information | A way to find and export one person's records quickly |
If you are not sure where your gaps are, an IT consulting assessment, from $1,500 over one to three weeks, maps where personal information lives across your systems and what to fix first.
Is PIPA changing in 2026?
Changes are being considered, but no new law is confirmed in this article. A legislative committee reviewing PIPA made 12 recommendations in February 2025, and the Government of Alberta ran a public engagement on updating the Act from 2 February to 1 May 2026. PIPA has not had a major revision since 2010.
Before acting on a headline, check the Government of Alberta PIPA engagement page for the current status. The sensible preparation is the same whatever the outcome: know what personal information you hold, why, who can see it, where it is processed and when it is deleted. To map that for your own systems, contact Glasshead Tech and we will reply within 24 hours.
Asked before they write.
Does PIPA apply to a small business with only a few employees?
Yes. PIPA applies to private-sector organisations in Alberta regardless of size, including sole proprietors and partnerships acting commercially. It also covers personal employee information, so even a business with two staff and a short customer list has duties around consent, safeguards, breach reporting and retention. The effort scales with how much information you hold and how sensitive it is.
Do I have to report every privacy breach in Alberta?
No. PIPA requires notice to the Office of the Information and Privacy Commissioner of Alberta when a reasonable person would consider there is a real risk of significant harm to an individual. You still need to contain the incident, assess the risk and keep a record of your reasoning. Get advice quickly when unsure, because notice must come without unreasonable delay.
Can my business use cloud software hosted outside Canada under PIPA?
Generally yes. PIPA does not prohibit storage or processing outside Canada, but you stay responsible for the information, and your policies and notices must explain the use of service providers outside Canada and who can answer questions about it. Some businesses choose Canadian hosting for sensitive systems; that is a business decision, and PIPA itself does not require it.
What is the difference between PIPA and PIPEDA?
PIPA is Alberta's privacy law for provincially regulated private-sector organisations. PIPEDA is the federal law: it covers federally regulated businesses, such as banks and airlines, and personal information that crosses provincial or national borders in commercial activity. An Alberta business handling data only within the province usually deals with PIPA, while one selling across Canada may meet both.
Is Alberta updating PIPA in 2026?
Possibly. The government ran a public engagement on updating PIPA from 2 February to 1 May 2026, after a legislative committee made 12 recommendations in February 2025. No new law is confirmed in this article. Check the Government of Alberta's PIPA pages for the current position before acting on any proposed change.
Where this goes next.
Glasshead Tech provides IT consulting in Edmonton for companies without an IT department: a written assessment and costed technology roadmap covering what you run now, what to change, in what order and at what cost. Assessments start from $1,500 and take 1–3 weeks. It is advice and planning; day-to-day help desk work sits under IT support.
Glasshead Tech provides baseline cyber security for Edmonton small businesses: a review of sign-in, Microsoft 365, backups, patching, email and access, then a written fix list in priority order. Reviews start from $1,800 and take 1–2 weeks. We do not run attack simulations or a monitoring centre; we refer those to specialists.
Glasshead Tech does custom software development in Edmonton, building the systems Alberta companies run daily operations on: quoting, scheduling, job costing, safety documentation, field capture, client portals and booking. Builds cost $18,000 to $50,000 CAD and take 8 to 16 weeks, with a fixed quote before coding starts. You own the code, data and accounts at handover.
Tell us what is slowing you down.
A short conversation is usually enough to tell whether we are the right fit. We reply within 24 hours.