Help › Legal › Keep people’s information private
Keep people’s information private
Showing Alberta. Select your province in settings.
Alberta stands fully covered: its own filings and guidance stand in the books beside the federal ones.
A named person answers for privacy. Personal information is collected only with consent, for purposes a reasonable person would consider appropriate; the person it is about may see it and have it corrected; it is protected while it is held, and destroyed when its purpose is done.
The federal Act runs where a province’s own Act of the same kind does not. Named people answer for compliance, purposes are stated before anything is collected, consent comes first, and the person the information is about can see it, challenge it and have it corrected. Binds: Organizations the federal Act reaches (Personal Information Protection and Electronic Documents Act).
The law’s own words
“An organization is responsible for personal information under its control and shall designate an individual or individuals who are accountable for the organization’s compliance with the following principles.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.1 · Read it at Justice Laws · Verified 2026-11-10
“The identity of the individual(s) designated by the organization to oversee the organization’s compliance with the principles shall be made known upon request.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.1.2 · Read it at Justice Laws · Verified 2026-11-10
“The purposes for which personal information is collected shall be identified by the organization at or before the time the information is collected.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.2 · Read it at Justice Laws · Verified 2026-11-10
“The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.3 · Read it at Justice Laws · Verified 2026-11-10
“For the purposes of clause 4.3 of Schedule 1, the consent of an individual is only valid if it is reasonable to expect that an individual to whom the organization’s activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure of the personal information to which they are consenting.”
Personal Information Protection and Electronic Documents Act, s. 6.1 · Read it at Justice Laws · Verified 2026-11-10
“An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.”
Personal Information Protection and Electronic Documents Act, s. 5(3) · Read it at Justice Laws · Verified 2026-11-10
“The collection of personal information shall be limited to that which is necessary for the purposes identified by the organization. Information shall be collected by fair and lawful means.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.4 · Read it at Justice Laws · Verified 2026-11-10
“Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as necessary for the fulfilment of those purposes.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.5 · Read it at Justice Laws · Verified 2026-11-10
“Personal information that is no longer required to fulfil the identified purposes should be destroyed, erased, or made anonymous. Organizations shall develop guidelines and implement procedures to govern the destruction of personal information.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.5.3 · Read it at Justice Laws · Verified 2026-11-10
“Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.6 · Read it at Justice Laws · Verified 2026-11-10
“Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.7 · Read it at Justice Laws · Verified 2026-11-10
“The security safeguards shall protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. Organizations shall protect personal information regardless of the format in which it is held.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.7.1 · Read it at Justice Laws · Verified 2026-11-10
“An organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.8 · Read it at Justice Laws · Verified 2026-11-10
“Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.9 · Read it at Justice Laws · Verified 2026-11-10
“An organization shall assist any individual who informs the organization that they need assistance in preparing a request to the organization.”
Personal Information Protection and Electronic Documents Act, s. 8(2) · Read it at Justice Laws · Verified 2026-11-10
“An organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request.”
Personal Information Protection and Electronic Documents Act, s. 8(3) · Read it at Justice Laws · Verified 2026-11-10
“When an individual successfully demonstrates the inaccuracy or incompleteness of personal information, the organization shall amend the information as required.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.9.5 · Read it at Justice Laws · Verified 2026-11-10
“An individual shall be able to address a challenge concerning compliance with the above principles to the designated individual or individuals accountable for the organization’s compliance.”
Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.10 · Read it at Justice Laws · Verified 2026-11-10
“An organization shall report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual.”
Personal Information Protection and Electronic Documents Act, s. 10.1(1) · Read it at Justice Laws · Verified 2026-11-10
“Unless otherwise prohibited by law, an organization shall notify an individual of any breach of security safeguards involving the individual’s personal information under the organization’s control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual.”
Personal Information Protection and Electronic Documents Act, s. 10.1(3) · Read it at Justice Laws · Verified 2026-11-10
“An organization shall, in accordance with any prescribed requirements, keep and maintain a record of every breach of security safeguards involving personal information under its control.”
Personal Information Protection and Electronic Documents Act, s. 10.3(1) · Read it at Justice Laws · Verified 2026-11-10
Alberta’s privacy Act reaches a society only for personal information it handles in a commercial activity — trading in membership or donor lists is named as one — and where it reaches, its consent, access and safeguard duties apply in full. Binds: Alberta societies, for personal information handled as part of a commercial activity (Personal Information Protection Act, RSA 2003, c P-6.5).
The law’s own words
“Subject to subsection (3), this Act does not apply to a non-profit organization or any personal information that is in the custody of or under the control of a non-profit organization.”
Personal Information Protection Act (Alberta), s. 56(2) · Read it at Alberta.ca · Verified 2026-11-11
“This Act applies to a non-profit organization in the case of personal information that is collected, used or disclosed by the non-profit organization in connection with any commercial activity carried out by the non-profit organization.”
Personal Information Protection Act (Alberta), s. 56(3) · Read it at Alberta.ca · Verified 2026-11-11
“non-profit organization” means an organization (i) that is incorporated under the Societies Act or the Agricultural Societies Act or that is registered under Part 9 of the Companies Act, or (ii) that meets the criteria established under the regulations to qualify as a non-profit organization.”
Personal Information Protection Act (Alberta), s. 56(1)(b) · Read it at Alberta.ca · Verified 2026-11-11
“commercial activity” means (i) any transaction, act or conduct, or (ii) any regular course of conduct, that is of a commercial character and, without restricting the generality of the foregoing, includes the following: (iii) the selling, bartering or leasing of membership lists or of donor or other fund-raising lists …”
Personal Information Protection Act (Alberta), s. 56(1)(a) · Read it at Alberta.ca · Verified 2026-11-11
“Except as provided in this Act and subject to the regulations, this Act applies to every organization and in respect of all personal information.”
Personal Information Protection Act (Alberta), s. 4(1) · Read it at Alberta.ca · Verified 2026-11-11
“personal information” means information about an identifiable individual.”
Personal Information Protection Act (Alberta), s. 1(1)(k) · Read it at Alberta.ca · Verified 2026-11-11
“An organization is responsible for personal information that is in its custody or under its control.”
Personal Information Protection Act (Alberta), s. 5(1) · Read it at Alberta.ca · Verified 2026-11-11
“An organization must designate one or more individuals to be responsible for ensuring that the organization complies with this Act.”
Personal Information Protection Act (Alberta), s. 5(3) · Read it at Alberta.ca · Verified 2026-11-11
“An organization must develop and follow policies and practices that are reasonable for the organization to meet its obligations under this Act.”
Personal Information Protection Act (Alberta), s. 6(1) · Read it at Alberta.ca · Verified 2026-11-11
“Except where this Act provides otherwise, an organization shall not, with respect to personal information about an individual, (a) collect that information unless the individual consents to the collection of that information … (d) disclose that information unless the individual consents to the disclosure of that information.”
Personal Information Protection Act (Alberta), s. 7(1) · Read it at Alberta.ca · Verified 2026-11-11
“An organization may collect personal information only for purposes that are reasonable.”
Personal Information Protection Act (Alberta), s. 11(1) · Read it at Alberta.ca · Verified 2026-11-11
“Before or at the time of collecting personal information about an individual from the individual, an organization must notify that individual in writing or orally (a) as to the purposes for which the information is collected, and (b) of the name or position name or title of a person who is able to answer on behalf of the organization the individual’s questions about the collection.”
Personal Information Protection Act (Alberta), s. 13(1) · Read it at Alberta.ca · Verified 2026-11-11
“An organization may collect personal employee information about an individual without the consent of the individual if (a) the information is collected solely for the purposes of (i) establishing, managing or terminating an employment or volunteer-work relationship, or (ii) managing a post-employment or post-volunteer-work relationship, between the organization and the individual …”
Personal Information Protection Act (Alberta), s. 15(1) · Read it at Alberta.ca · Verified 2026-11-11
“An organization may use personal information only for purposes that are reasonable.”
Personal Information Protection Act (Alberta), s. 16(1) · Read it at Alberta.ca · Verified 2026-11-11
“An organization may disclose personal information only for purposes that are reasonable.”
Personal Information Protection Act (Alberta), s. 19(1) · Read it at Alberta.ca · Verified 2026-11-11
“An individual may, in accordance with section 26, request an organization (a) to provide the individual with access to personal information about the individual, or (b) to provide the individual with information about the use or disclosure of personal information about the individual.”
Personal Information Protection Act (Alberta), s. 24(1) · Read it at Alberta.ca · Verified 2026-11-11
“An individual may, in accordance with section 26, request an organization to correct an error or omission in the personal information about the individual that is under the control of the organization.”
Personal Information Protection Act (Alberta), s. 25(1) · Read it at Alberta.ca · Verified 2026-11-11
“Subject to this section, an organization must respond to an applicant not later than (a) 45 days from the day that the organization receives the applicant’s written request referred to in section 26 …”
Personal Information Protection Act (Alberta), s. 28(1) · Read it at Alberta.ca · Verified 2026-11-11
“An organization must make a reasonable effort to ensure that any personal information collected, used or disclosed by or on behalf of an organization is accurate and complete to the extent that is reasonable for the organization’s purposes in collecting, using or disclosing the information.”
Personal Information Protection Act (Alberta), s. 33 · Read it at Alberta.ca · Verified 2026-11-11
“An organization must protect personal information that is in its custody or under its control by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction.”
Personal Information Protection Act (Alberta), s. 34 · Read it at Alberta.ca · Verified 2026-11-11
“An organization having personal information under its control must, without unreasonable delay, provide notice to the Commissioner of any incident involving the loss of or unauthorized access to or disclosure of the personal information where a reasonable person would consider that there exists a real risk of significant harm to an individual as a result of the loss or unauthorized access or disclosure.”
Personal Information Protection Act (Alberta), s. 34.1(1) · Read it at Alberta.ca · Verified 2026-11-11
“An organization may retain personal information only for as long as the organization reasonably requires the personal information for legal or business purposes.”
Personal Information Protection Act (Alberta), s. 35(1) · Read it at Alberta.ca · Verified 2026-11-11
“Within a reasonable period of time after an organization no longer reasonably requires personal information for legal or business purposes, the organization must (a) destroy the records containing the personal information, or (b) render the personal information non-identifying so that it can no longer be used to identify an individual.”
Personal Information Protection Act (Alberta), s. 35(2) · Read it at Alberta.ca · Verified 2026-11-11
“Some non-profit organizations are not subject to the Personal Information Protection Act (PIPA), except for information collected, used or disclosed for commercial activity.”
Personal Information Protection Act (Alberta) — Government of Alberta, Personal information for non-profits and other organizations · Read it at Alberta.ca · Verified 2026-11-11
“Notwithstanding section 36, a society may disclose the register or an annual list of members or an excerpt of either or both of them to a member of the society only if the information contained in the register, list or excerpt is to be used by the member for matters relating to the affairs of the society.”
Societies Act (Alberta), s. 36.1(2) · Read it at King’s Printer for Alberta · Verified 2026-11-11
“A member of a society may use personal information about another member of the society that is contained in the register, list or excerpt for any matter not referred to in subsection (2) if that other member gives consent to that use.”
Societies Act (Alberta), s. 36.1(3) · Read it at King’s Printer for Alberta · Verified 2026-11-11
Personal Information Protection Act (Alberta), sections 4(1), 56(2) and 56(3)
“Except as provided in this Act and subject to the regulations, this Act applies to every organization and in respect of all personal information.” “Subject to subsection (3), this Act does not apply to a non-profit organization or any personal information that is in the custody of or under the control of a non-profit organization.” “This Act applies to a non-profit organization in the case of personal information that is collected, used or disclosed by the non-profit organization in connection with any commercial activity carried out by the non-profit organization.”
Source: Personal Information Protection Act (Alberta), ss. 4(1), 56(2), 56(3) · Checked 2026-11-11
Personal Information Protection Act (Alberta), section 56(1)(a)
“commercial activity” means (i) any transaction, act or conduct, or (ii) any regular course of conduct, that is of a commercial character and, without restricting the generality of the foregoing, includes the following: (iii) the selling, bartering or leasing of membership lists or of donor or other fund-raising lists.” “Accepting donations for charitable purposes is not a commercial activity.”
Source: Personal Information Protection Act (Alberta), s. 56(1)(a); Government of Alberta, Personal information for non-profits and other organizations · Checked 2026-11-11