Help › Legal › Keep people’s information private
Keep people’s information private
All provinces stand below. Select your province in settings.
A named person answers for privacy. Personal information is collected only with consent, for purposes a reasonable person would consider appropriate; the person it is about may see it and have it corrected; it is protected while it is held, and destroyed when its purpose is done.
A named person answers for privacy. Personal information is collected only with consent, for purposes a reasonable person would consider appropriate; the person it is about may see it and have it corrected; it is protected while it is held, and destroyed when its purpose is done. Binds: BC organizations, societies among them (Personal Information Protection Act).
The law’s own words
“An organization must designate one or more individuals to be responsible for ensuring that the organization complies with this Act.”
Personal Information Protection Act (BC), s. 4(3) · Read it at BC Laws · Verified 2026-11-10
“An organization must make available to the public (a) the position name or title of each individual designated under subsection (3) or delegated under subsection (4), and (b) contact information for each individual referred to in paragraph (a).”
Personal Information Protection Act (BC), s. 4(5) · Read it at BC Laws · Verified 2026-11-10
“An organization must (a) develop and follow policies and practices that are necessary for the organization to meet the obligations of the organization under this Act, (b) develop a process to respond to complaints that may arise respecting the application of this Act, and (c) make information available on request about (i) the policies and practices referred to in paragraph (a), and (ii) the complaint process referred to in paragraph (b).”
Personal Information Protection Act (BC), s. 5 · Read it at BC Laws · Verified 2026-11-10
“An organization must not (a) collect personal information about an individual, (b) use personal information about an individual, or (c) disclose personal information about an individual.”
Personal Information Protection Act (BC), s. 6(1) · Read it at BC Laws · Verified 2026-11-10
“Subsection (1) does not apply if (a) the individual gives consent to the collection, use or disclosure, (b) this Act authorizes the collection, use or disclosure without the consent of the individual, or (c) this Act deems the collection, use or disclosure to be consented to by the individual.”
Personal Information Protection Act (BC), s. 6(2) · Read it at BC Laws · Verified 2026-11-10
“On or before collecting personal information about an individual from the individual, an organization must disclose to the individual verbally or in writing (a) the purposes for the collection of the information, and (b) on request by the individual, the position name or title and the contact information for an officer or employee of the organization who is able to answer the individual’s questions about the collection.”
Personal Information Protection Act (BC), s. 10(1) · Read it at BC Laws · Verified 2026-11-10
“Subject to this Act, an organization may collect personal information only for purposes that a reasonable person would consider appropriate in the circumstances and that (a) fulfill the purposes that the organization discloses under section 10 (1), or (b) are otherwise permitted under this Act.”
Personal Information Protection Act (BC), s. 11 · Read it at BC Laws · Verified 2026-11-10
“Subject to subsections (2) to (5), on request of an individual, an organization must provide the individual with the following: (a) the individual’s personal information under the control of the organization; (b) information about the ways in which the personal information referred to in paragraph (a) has been and is being used by the organization; (c) the names of the individuals and organizations to whom the personal information referred to in paragraph (a) has been disclosed by the organization.”
Personal Information Protection Act (BC), s. 23(1) · Read it at BC Laws · Verified 2026-11-10
“An organization must make a reasonable effort (a) to assist each applicant, (b) to respond to each applicant as accurately and completely as reasonably possible, and (c) unless section 23 (3), (3.1) or (4) applies, to provide each applicant with (i) the requested personal information, or (ii) if the requested personal information cannot be reasonably provided, with a reasonable opportunity to examine the personal information.”
Personal Information Protection Act (BC), s. 28 · Read it at BC Laws · Verified 2026-11-10
“Subject to this section, an organization must respond to an applicant not later than (a) 30 days after receiving the applicant’s request, or (b) the end of an extended time period if the time period is extended under section 31.”
Personal Information Protection Act (BC), s. 29(1) · Read it at BC Laws · Verified 2026-11-10
“An individual may request an organization to correct an error or omission in the personal information that is (a) about the individual, and (b) under the control of the organization.”
Personal Information Protection Act (BC), s. 24(1) · Read it at BC Laws · Verified 2026-11-10
“If an organization is satisfied on reasonable grounds that a request made under subsection (1) should be implemented, the organization must (a) correct the personal information as soon as reasonably possible, and (b) send the corrected personal information to each organization to which the personal information was disclosed by the organization during the year before the date the correction was made.”
Personal Information Protection Act (BC), s. 24(2) · Read it at BC Laws · Verified 2026-11-10
“An organization must make a reasonable effort to ensure that personal information collected by or on behalf of the organization is accurate and complete, if the personal information (a) is likely to be used by the organization to make a decision that affects the individual to whom the personal information relates, or (b) is likely to be disclosed by the organization to another organization.”
Personal Information Protection Act (BC), s. 33 · Read it at BC Laws · Verified 2026-11-10
“An organization must protect personal information in its custody or under its control by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification or disposal or similar risks.”
Personal Information Protection Act (BC), s. 34 · Read it at BC Laws · Verified 2026-11-10
“Despite subsection (2), if an organization uses an individual’s personal information to make a decision that directly affects the individual, the organization must retain that information for at least one year after using it so that the individual has a reasonable opportunity to obtain access to it.”
Personal Information Protection Act (BC), s. 35(1) · Read it at BC Laws · Verified 2026-11-10
“An organization must destroy its documents containing personal information, or remove the means by which the personal information can be associated with particular individuals, as soon as it is reasonable to assume that (a) the purpose for which that personal information was collected is no longer being served by retention of the personal information, and (b) retention is no longer necessary for legal or business purposes.”
Personal Information Protection Act (BC), s. 35(2) · Read it at BC Laws · Verified 2026-11-10
The federal Act runs where a province’s own Act of the same kind does not. Named people answer for compliance, purposes are stated before anything is collected, consent comes first, and the person the information is about can see it, challenge it and have it corrected. Binds: Organizations the federal Act reaches (Personal Information Protection and Electronic Documents Act).
The law’s own words
“An organization is responsible for personal information under its control and shall designate an individual or individuals who are accountable for the organization’s compliance with the following principles.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.1 · Read it at Justice Laws · Verified 2026-11-10
“The identity of the individual(s) designated by the organization to oversee the organization’s compliance with the principles shall be made known upon request.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.1.2 · Read it at Justice Laws · Verified 2026-11-10
“The purposes for which personal information is collected shall be identified by the organization at or before the time the information is collected.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.2 · Read it at Justice Laws · Verified 2026-11-10
“The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.3 · Read it at Justice Laws · Verified 2026-11-10
“For the purposes of clause 4.3 of Schedule 1, the consent of an individual is only valid if it is reasonable to expect that an individual to whom the organization’s activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure of the personal information to which they are consenting.”
Personal Information Protection and Electronic Documents Act, s. 6.1 · Read it at Justice Laws · Verified 2026-11-10
“An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.”
Personal Information Protection and Electronic Documents Act, s. 5(3) · Read it at Justice Laws · Verified 2026-11-10
“The collection of personal information shall be limited to that which is necessary for the purposes identified by the organization. Information shall be collected by fair and lawful means.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.4 · Read it at Justice Laws · Verified 2026-11-10
“Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as necessary for the fulfilment of those purposes.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.5 · Read it at Justice Laws · Verified 2026-11-10
“Personal information that is no longer required to fulfil the identified purposes should be destroyed, erased, or made anonymous. Organizations shall develop guidelines and implement procedures to govern the destruction of personal information.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.5.3 · Read it at Justice Laws · Verified 2026-11-10
“Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.6 · Read it at Justice Laws · Verified 2026-11-10
“Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.7 · Read it at Justice Laws · Verified 2026-11-10
“The security safeguards shall protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. Organizations shall protect personal information regardless of the format in which it is held.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.7.1 · Read it at Justice Laws · Verified 2026-11-10
“An organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.8 · Read it at Justice Laws · Verified 2026-11-10
“Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.9 · Read it at Justice Laws · Verified 2026-11-10
“An organization shall assist any individual who informs the organization that they need assistance in preparing a request to the organization.”
Personal Information Protection and Electronic Documents Act, s. 8(2) · Read it at Justice Laws · Verified 2026-11-10
“An organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request.”
Personal Information Protection and Electronic Documents Act, s. 8(3) · Read it at Justice Laws · Verified 2026-11-10
“When an individual successfully demonstrates the inaccuracy or incompleteness of personal information, the organization shall amend the information as required.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.9.5 · Read it at Justice Laws · Verified 2026-11-10
“An individual shall be able to address a challenge concerning compliance with the above principles to the designated individual or individuals accountable for the organization’s compliance.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.10 · Read it at Justice Laws · Verified 2026-11-10
“An organization shall report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual.”
Personal Information Protection and Electronic Documents Act, s. 10.1(1) · Read it at Justice Laws · Verified 2026-11-10
“Unless otherwise prohibited by law, an organization shall notify an individual of any breach of security safeguards involving the individual’s personal information under the organization’s control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual.”
Personal Information Protection and Electronic Documents Act, s. 10.1(3) · Read it at Justice Laws · Verified 2026-11-10
“An organization shall, in accordance with any prescribed requirements, keep and maintain a record of every breach of security safeguards involving personal information under its control.”
Personal Information Protection and Electronic Documents Act, s. 10.3(1) · Read it at Justice Laws · Verified 2026-11-10
Newfoundland and Labrador has no privacy Act of its own reaching a society’s records — its access and privacy Act binds public bodies, and says so. The federal Act’s ground rules attach to personal information handled in the course of a commercial activity, and the Corporations Act itself limits what a list of members may be used for. Binds: Newfoundland and Labrador corporations; organizations under the Personal Information Protection and Electronic Documents Act (Canada).
The law’s own words
“PIPEDA applies to private-sector organizations across Canada that collect, use, or disclose personal information in the course of a commercial activity. The law defines a commercial activity as any particular transaction, act, or conduct, or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists.”
Personal Information Protection and Electronic Documents Act (Canada) — Office of the Privacy Commissioner of Canada, PIPEDA requirements in brief · Read it at Justice Laws · Verified 2026-11-11
“It applies to all public bodies (defined in the ATIPP Act), including government departments, agencies, health boards and municipalities. The ATIPP Act does not apply to the private sector.”
Access to Information and Protection of Privacy Act, 2015 (Newfoundland and Labrador) — Access to Information and Protection of Privacy Office · Read it at Justice Laws · Verified 2026-11-11
“A list of shareholders obtained under section 43 shall not be used by a person except in connection with (a) an effort to influence the voting of shareholders of the corporation; (b) an offer to acquire shares of the corporation; or (c) other matters relating to the affairs of the corporation.”
Corporations Act (Newfoundland and Labrador), s. 45 · Read it at Newfoundland and Labrador · Verified 2026-11-11
Nova Scotia has no privacy Act of its own reaching a society’s records: the province’s access and privacy Acts govern public bodies, and its health privacy Act binds health information custodians. The federal Act’s ground rules attach to personal information a society handles in the course of a commercial activity. Binds: Nova Scotia societies; organizations under the Personal Information Protection and Electronic Documents Act (Canada).
The law’s own words
“PIPEDA applies to private-sector organizations across Canada that collect, use, or disclose personal information in the course of a commercial activity. The law defines a commercial activity as any particular transaction, act, or conduct, or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists.”
Personal Information Protection and Electronic Documents Act (Canada) — Office of the Privacy Commissioner of Canada, PIPEDA requirements in brief · Read it at Justice Laws · Verified 2026-11-11
“The Acts only apply to provincial and municipal bodies. They do not apply to private companies, banks, credit bureaus, doctors’ records or federal public bodies.”
Freedom of Information and Protection of Privacy Act (Nova Scotia) — Office of the Information and Privacy Commissioner for Nova Scotia, Frequently Asked Questions · Read it at Justice Laws · Verified 2026-11-11
Privacy in Nova Scotia — the Acts reach public bodies
“The Acts only apply to provincial and municipal bodies. They do not apply to private companies, banks, credit bureaus, doctors’ records or federal public bodies.”
Source: Office of the Information and Privacy Commissioner for Nova Scotia — Frequently Asked Questions · Checked 2026-11-11
Manitoba has no privacy Act of its own reaching a society’s records: its freedom of information and protection of privacy Act governs public bodies, and its personal health information Act binds trustees of health information. The federal Act’s ground rules attach to personal information a society handles in the course of a commercial activity. Binds: Manitoba societies; organizations under the Personal Information Protection and Electronic Documents Act (Canada).
The law’s own words
“PIPEDA applies to private-sector organizations across Canada that collect, use, or disclose personal information in the course of a commercial activity. The law defines a commercial activity as any particular transaction, act, or conduct, or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists.”
Personal Information Protection and Electronic Documents Act (Canada) — Office of the Privacy Commissioner of Canada, PIPEDA requirements in brief · Read it at Justice Laws · Verified 2026-11-11
“The Freedom of Information and Protection of Privacy Act (FIPPA) is an information rights law that gives an individual a legal right of access to records held by Manitoba public bodies, subject to specific and limited exceptions.”
The Freedom of Information and Protection of Privacy Act (Manitoba) — Manitoba Ombudsman, FIPPA frequently asked questions · Read it at Justice Laws · Verified 2026-11-11
The Freedom of Information and Protection of Privacy Act (Manitoba) — public bodies
“The Freedom of Information and Protection of Privacy Act (FIPPA) is an information rights law that gives an individual a legal right of access to records held by Manitoba public bodies, subject to specific and limited exceptions. The act also requires that public bodies protect the privacy of an individual’s personal information existing in records held by public bodies.”
Source: Manitoba Ombudsman — More about the Freedom of Information and Protection of Privacy Act (FIPPA), frequently asked questions · Checked 2026-11-11
No Saskatchewan Act sets a society’s duties over its own member and donor records — the province’s privacy Acts reach government institutions, local authorities and health trustees. Two limits do stand in Saskatchewan law: a member list serves only the corporation’s affairs, and a donor list stays the charitable organization’s own. Binds: Saskatchewan corporations under The Non-profit Corporations Act, 2022, and charitable organizations under The Charitable Fund-raising Businesses Act (Saskatchewan).
The law’s own words
“A list of members obtained pursuant to this section shall not be used by any person except in connection with: (a) an effort to influence the voting of members of the corporation; or (b) any other matter relating to the affairs of the corporation.”
The Non-profit Corporations Act, 2022 (Saskatchewan), s. 4-3(7) · Read it at Publications Saskatchewan · Verified 2026-11-11
“A donor list is the property of and under the control of the charitable organization that compiled the list, or on whose behalf it was compiled.”
The Charitable Fund-raising Businesses Act (Saskatchewan), s. 25(2) · Read it at Justice Laws · Verified 2026-11-11
“the licensee or representative shall not use or in any way deal with the donor list, except with respect to a solicitation made on behalf of that charitable organization”
The Charitable Fund-raising Businesses Act (Saskatchewan), s. 25(3)(b) · Read it at Justice Laws · Verified 2026-11-11
Alberta’s privacy Act reaches a society only for personal information it handles in a commercial activity — trading in membership or donor lists is named as one — and where it reaches, its consent, access and safeguard duties apply in full. Binds: Alberta societies, for personal information handled as part of a commercial activity (Personal Information Protection Act, RSA 2003, c P-6.5).
The law’s own words
“Subject to subsection (3), this Act does not apply to a non-profit organization or any personal information that is in the custody of or under the control of a non-profit organization.”
Personal Information Protection Act (Alberta), s. 56(2) · Read it at Alberta.ca · Verified 2026-11-11
“This Act applies to a non-profit organization in the case of personal information that is collected, used or disclosed by the non-profit organization in connection with any commercial activity carried out by the non-profit organization.”
Personal Information Protection Act (Alberta), s. 56(3) · Read it at Alberta.ca · Verified 2026-11-11
“non-profit organization” means an organization (i) that is incorporated under the Societies Act or the Agricultural Societies Act or that is registered under Part 9 of the Companies Act, or (ii) that meets the criteria established under the regulations to qualify as a non-profit organization.”
Personal Information Protection Act (Alberta), s. 56(1)(b) · Read it at Alberta.ca · Verified 2026-11-11
“commercial activity” means (i) any transaction, act or conduct, or (ii) any regular course of conduct, that is of a commercial character and, without restricting the generality of the foregoing, includes the following: (iii) the selling, bartering or leasing of membership lists or of donor or other fund-raising lists …”
Personal Information Protection Act (Alberta), s. 56(1)(a) · Read it at Alberta.ca · Verified 2026-11-11
“Except as provided in this Act and subject to the regulations, this Act applies to every organization and in respect of all personal information.”
Personal Information Protection Act (Alberta), s. 4(1) · Read it at Alberta.ca · Verified 2026-11-11
“personal information” means information about an identifiable individual.”
Personal Information Protection Act (Alberta), s. 1(1)(k) · Read it at Alberta.ca · Verified 2026-11-11
“An organization is responsible for personal information that is in its custody or under its control.”
Personal Information Protection Act (Alberta), s. 5(1) · Read it at Alberta.ca · Verified 2026-11-11
“An organization must designate one or more individuals to be responsible for ensuring that the organization complies with this Act.”
Personal Information Protection Act (Alberta), s. 5(3) · Read it at Alberta.ca · Verified 2026-11-11
“An organization must develop and follow policies and practices that are reasonable for the organization to meet its obligations under this Act.”
Personal Information Protection Act (Alberta), s. 6(1) · Read it at Alberta.ca · Verified 2026-11-11
“Except where this Act provides otherwise, an organization shall not, with respect to personal information about an individual, (a) collect that information unless the individual consents to the collection of that information … (d) disclose that information unless the individual consents to the disclosure of that information.”
Personal Information Protection Act (Alberta), s. 7(1) · Read it at Alberta.ca · Verified 2026-11-11
“An organization may collect personal information only for purposes that are reasonable.”
Personal Information Protection Act (Alberta), s. 11(1) · Read it at Alberta.ca · Verified 2026-11-11
“Before or at the time of collecting personal information about an individual from the individual, an organization must notify that individual in writing or orally (a) as to the purposes for which the information is collected, and (b) of the name or position name or title of a person who is able to answer on behalf of the organization the individual’s questions about the collection.”
Personal Information Protection Act (Alberta), s. 13(1) · Read it at Alberta.ca · Verified 2026-11-11
“An organization may collect personal employee information about an individual without the consent of the individual if (a) the information is collected solely for the purposes of (i) establishing, managing or terminating an employment or volunteer-work relationship, or (ii) managing a post-employment or post-volunteer-work relationship, between the organization and the individual …”
Personal Information Protection Act (Alberta), s. 15(1) · Read it at Alberta.ca · Verified 2026-11-11
“An organization may use personal information only for purposes that are reasonable.”
Personal Information Protection Act (Alberta), s. 16(1) · Read it at Alberta.ca · Verified 2026-11-11
“An organization may disclose personal information only for purposes that are reasonable.”
Personal Information Protection Act (Alberta), s. 19(1) · Read it at Alberta.ca · Verified 2026-11-11
“An individual may, in accordance with section 26, request an organization (a) to provide the individual with access to personal information about the individual, or (b) to provide the individual with information about the use or disclosure of personal information about the individual.”
Personal Information Protection Act (Alberta), s. 24(1) · Read it at Alberta.ca · Verified 2026-11-11
“An individual may, in accordance with section 26, request an organization to correct an error or omission in the personal information about the individual that is under the control of the organization.”
Personal Information Protection Act (Alberta), s. 25(1) · Read it at Alberta.ca · Verified 2026-11-11
“Subject to this section, an organization must respond to an applicant not later than (a) 45 days from the day that the organization receives the applicant’s written request referred to in section 26 …”
Personal Information Protection Act (Alberta), s. 28(1) · Read it at Alberta.ca · Verified 2026-11-11
“An organization must make a reasonable effort to ensure that any personal information collected, used or disclosed by or on behalf of an organization is accurate and complete to the extent that is reasonable for the organization’s purposes in collecting, using or disclosing the information.”
Personal Information Protection Act (Alberta), s. 33 · Read it at Alberta.ca · Verified 2026-11-11
“An organization must protect personal information that is in its custody or under its control by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction.”
Personal Information Protection Act (Alberta), s. 34 · Read it at Alberta.ca · Verified 2026-11-11
“An organization having personal information under its control must, without unreasonable delay, provide notice to the Commissioner of any incident involving the loss of or unauthorized access to or disclosure of the personal information where a reasonable person would consider that there exists a real risk of significant harm to an individual as a result of the loss or unauthorized access or disclosure.”
Personal Information Protection Act (Alberta), s. 34.1(1) · Read it at Alberta.ca · Verified 2026-11-11
“An organization may retain personal information only for as long as the organization reasonably requires the personal information for legal or business purposes.”
Personal Information Protection Act (Alberta), s. 35(1) · Read it at Alberta.ca · Verified 2026-11-11
“Within a reasonable period of time after an organization no longer reasonably requires personal information for legal or business purposes, the organization must (a) destroy the records containing the personal information, or (b) render the personal information non-identifying so that it can no longer be used to identify an individual.”
Personal Information Protection Act (Alberta), s. 35(2) · Read it at Alberta.ca · Verified 2026-11-11
“Some non-profit organizations are not subject to the Personal Information Protection Act (PIPA), except for information collected, used or disclosed for commercial activity.”
Personal Information Protection Act (Alberta) — Government of Alberta, Personal information for non-profits and other organizations · Read it at Alberta.ca · Verified 2026-11-11
“Notwithstanding section 36, a society may disclose the register or an annual list of members or an excerpt of either or both of them to a member of the society only if the information contained in the register, list or excerpt is to be used by the member for matters relating to the affairs of the society.”
Societies Act (Alberta), s. 36.1(2) · Read it at King’s Printer for Alberta · Verified 2026-11-11
“A member of a society may use personal information about another member of the society that is contained in the register, list or excerpt for any matter not referred to in subsection (2) if that other member gives consent to that use.”
Societies Act (Alberta), s. 36.1(3) · Read it at King’s Printer for Alberta · Verified 2026-11-11
Personal Information Protection Act (Alberta), sections 4(1), 56(2) and 56(3)
“Except as provided in this Act and subject to the regulations, this Act applies to every organization and in respect of all personal information.” “Subject to subsection (3), this Act does not apply to a non-profit organization or any personal information that is in the custody of or under the control of a non-profit organization.” “This Act applies to a non-profit organization in the case of personal information that is collected, used or disclosed by the non-profit organization in connection with any commercial activity carried out by the non-profit organization.”
Source: Personal Information Protection Act (Alberta), ss. 4(1), 56(2), 56(3) · Checked 2026-11-11
Personal Information Protection Act (Alberta), section 56(1)(a)
“commercial activity” means (i) any transaction, act or conduct, or (ii) any regular course of conduct, that is of a commercial character and, without restricting the generality of the foregoing, includes the following: (iii) the selling, bartering or leasing of membership lists or of donor or other fund-raising lists.” “Accepting donations for charitable purposes is not a commercial activity.”
Source: Personal Information Protection Act (Alberta), s. 56(1)(a); Government of Alberta, Personal information for non-profits and other organizations · Checked 2026-11-11
Yukon has no privacy Act of its own reaching a society’s records — its privacy Acts bind public bodies and the health sector. The federal Act reaches the society instead: the Privacy Commissioner counts organizations in the territories as federally regulated and covered by PIPEDA, whose ground rules attach to personal information handled in the course of a commercial activity. Binds: Yukon societies, under the Personal Information Protection and Electronic Documents Act (Canada).
The law’s own words
“Note: Organizations in the Northwest Territories, Yukon, and Nunavut are considered federally regulated, and are therefore also covered by PIPEDA (Personal Information Protection and Electronic Documents Act).”
Personal Information Protection and Electronic Documents Act (Canada) — Office of the Privacy Commissioner of Canada, PIPEDA requirements in brief · Read it at Justice Laws · Verified 2026-11-11
“PIPEDA applies to private-sector organizations across Canada that collect, use, or disclose personal information in the course of a commercial activity. The law defines a commercial activity as any particular transaction, act, or conduct, or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists.”
Personal Information Protection and Electronic Documents Act (Canada) — Office of the Privacy Commissioner of Canada, PIPEDA requirements in brief · Read it at Justice Laws · Verified 2026-11-11
Personal Information Protection and Electronic Documents Act (Canada) — application to Yukon organizations
“Note: Organizations in the Northwest Territories, Yukon, and Nunavut are considered federally regulated, and are therefore also covered by PIPEDA (Personal Information Protection and Electronic Documents Act).” “PIPEDA applies to private-sector organizations across Canada that collect, use, or disclose personal information in the course of a commercial activity. The law defines a commercial activity as any particular transaction, act, or conduct, or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists.”
Source: Office of the Privacy Commissioner of Canada, PIPEDA requirements in brief · Checked 2026-11-11
The person exercising the highest authority in the enterprise answers for the protection of the personal information it holds, and the title and contact information of the person in charge are published. Only the information necessary for purposes determined before collecting it is collected, by lawful means; consent is clear, free and informed, and given for specific purposes; when the purposes are achieved the information is destroyed or anonymized; and a request for access or rectification is answered in writing within 30 days. Binds: Quebec enterprises (Act respecting the protection of personal information in the private sector, CQLR c. P-39.1).
The law’s own words
“Any person carrying on an enterprise is responsible for protecting the personal information held by the person.”
Act respecting the protection of personal information in the private sector (Quebec), s. 3.1 · Read it at LégisQuébec · Verified 2026-11-10
“Within the enterprise, the person exercising the highest authority shall see to ensuring that this Act is implemented and complied with.”
Act respecting the protection of personal information in the private sector (Quebec), s. 3.1 · Read it at LégisQuébec · Verified 2026-11-10
“That person shall exercise the function of person in charge of the protection of personal information; he may delegate all or part of that function in writing to any person. The title and contact information of the person in charge of the protection of personal information must be published on the enterprise’s website or, if the enterprise does not have a website, be made available by any other appropriate means.”
Act respecting the protection of personal information in the private sector (Quebec), s. 3.1 · Read it at LégisQuébec · Verified 2026-11-10
“Personal information is any information which relates to a natural person and directly or indirectly allows that person to be identified.”
Act respecting the protection of personal information in the private sector (Quebec), s. 2 · Read it at LégisQuébec · Verified 2026-11-10
“Any person collecting personal information on another person may collect only the information necessary for the purposes determined before collecting it. Such information must be collected by lawful means.”
Act respecting the protection of personal information in the private sector (Quebec), s. 5 · Read it at LégisQuébec · Verified 2026-11-10
“Consent under this Act must be clear, free and informed and be given for specific purposes. It must be requested for each such purpose, in clear and simple language. Consent is valid only for the time necessary to achieve the purposes for which it was requested. Consent not given in accordance with this Act is without effect.”
Act respecting the protection of personal information in the private sector (Quebec), s. 14 · Read it at LégisQuébec · Verified 2026-11-10
“A person carrying on an enterprise must keep a register of confidentiality incidents.”
Act respecting the protection of personal information in the private sector (Quebec), s. 3.8 · Read it at LégisQuébec · Verified 2026-11-10
“Where the purposes for which personal information was collected or used are achieved, the person carrying on an enterprise must destroy the information, or anonymize it to use it for serious and legitimate purposes, subject to any preservation period provided for by an Act.”
Act respecting the protection of personal information in the private sector (Quebec), s. 23 · Read it at LégisQuébec · Verified 2026-11-10
“The person in charge of the protection of personal information must reply in writing to the request for access or rectification, promptly and not later than 30 days after the date the request is received. Failure to respond within 30 days of the receipt of a request is deemed to be a refusal to grant the request.”
Act respecting the protection of personal information in the private sector (Quebec), s. 32 · Read it at LégisQuébec · Verified 2026-11-10
Act respecting the protection of personal information in the private sector (Quebec), sections 3.1 and 3.8
“Any person carrying on an enterprise is responsible for protecting the personal information held by the person.” “Within the enterprise, the person exercising the highest authority shall see to ensuring that this Act is implemented and complied with.” “That person shall exercise the function of person in charge of the protection of personal information; he may delegate all or part of that function in writing to any person. The title and contact information of the person in charge of the protection of personal information must be published on the enterprise’s website or, if the enterprise does not have a website, be made available by any other appropriate means.” “A person carrying on an enterprise must keep a register of confidentiality incidents.”
Source: Act respecting the protection of personal information in the private sector (Quebec), ss. 3.1, 3.8 · Checked 2026-11-10