Keep people’s information private

The law’s own words

“An organization must designate one or more individuals to be responsible for ensuring that the organization complies with this Act.”

Personal Information Protection Act (BC), s. 4(3) · Read it at BC Laws · Verified 2026-11-10

“An organization must make available to the public (a) the position name or title of each individual designated under subsection (3) or delegated under subsection (4), and (b) contact information for each individual referred to in paragraph (a).”

Personal Information Protection Act (BC), s. 4(5) · Read it at BC Laws · Verified 2026-11-10

“An organization must (a) develop and follow policies and practices that are necessary for the organization to meet the obligations of the organization under this Act, (b) develop a process to respond to complaints that may arise respecting the application of this Act, and (c) make information available on request about (i) the policies and practices referred to in paragraph (a), and (ii) the complaint process referred to in paragraph (b).”

Personal Information Protection Act (BC), s. 5 · Read it at BC Laws · Verified 2026-11-10

“An organization must not (a) collect personal information about an individual, (b) use personal information about an individual, or (c) disclose personal information about an individual.”

Personal Information Protection Act (BC), s. 6(1) · Read it at BC Laws · Verified 2026-11-10

“Subsection (1) does not apply if (a) the individual gives consent to the collection, use or disclosure, (b) this Act authorizes the collection, use or disclosure without the consent of the individual, or (c) this Act deems the collection, use or disclosure to be consented to by the individual.”

Personal Information Protection Act (BC), s. 6(2) · Read it at BC Laws · Verified 2026-11-10

“On or before collecting personal information about an individual from the individual, an organization must disclose to the individual verbally or in writing (a) the purposes for the collection of the information, and (b) on request by the individual, the position name or title and the contact information for an officer or employee of the organization who is able to answer the individual’s questions about the collection.”

Personal Information Protection Act (BC), s. 10(1) · Read it at BC Laws · Verified 2026-11-10

“Subject to this Act, an organization may collect personal information only for purposes that a reasonable person would consider appropriate in the circumstances and that (a) fulfill the purposes that the organization discloses under section 10 (1), or (b) are otherwise permitted under this Act.”

Personal Information Protection Act (BC), s. 11 · Read it at BC Laws · Verified 2026-11-10

“Subject to subsections (2) to (5), on request of an individual, an organization must provide the individual with the following: (a) the individual’s personal information under the control of the organization; (b) information about the ways in which the personal information referred to in paragraph (a) has been and is being used by the organization; (c) the names of the individuals and organizations to whom the personal information referred to in paragraph (a) has been disclosed by the organization.”

Personal Information Protection Act (BC), s. 23(1) · Read it at BC Laws · Verified 2026-11-10

“An organization must make a reasonable effort (a) to assist each applicant, (b) to respond to each applicant as accurately and completely as reasonably possible, and (c) unless section 23 (3), (3.1) or (4) applies, to provide each applicant with (i) the requested personal information, or (ii) if the requested personal information cannot be reasonably provided, with a reasonable opportunity to examine the personal information.”

Personal Information Protection Act (BC), s. 28 · Read it at BC Laws · Verified 2026-11-10

“Subject to this section, an organization must respond to an applicant not later than (a) 30 days after receiving the applicant’s request, or (b) the end of an extended time period if the time period is extended under section 31.”

Personal Information Protection Act (BC), s. 29(1) · Read it at BC Laws · Verified 2026-11-10

“An individual may request an organization to correct an error or omission in the personal information that is (a) about the individual, and (b) under the control of the organization.”

Personal Information Protection Act (BC), s. 24(1) · Read it at BC Laws · Verified 2026-11-10

“If an organization is satisfied on reasonable grounds that a request made under subsection (1) should be implemented, the organization must (a) correct the personal information as soon as reasonably possible, and (b) send the corrected personal information to each organization to which the personal information was disclosed by the organization during the year before the date the correction was made.”

Personal Information Protection Act (BC), s. 24(2) · Read it at BC Laws · Verified 2026-11-10

“An organization must make a reasonable effort to ensure that personal information collected by or on behalf of the organization is accurate and complete, if the personal information (a) is likely to be used by the organization to make a decision that affects the individual to whom the personal information relates, or (b) is likely to be disclosed by the organization to another organization.”

Personal Information Protection Act (BC), s. 33 · Read it at BC Laws · Verified 2026-11-10

“An organization must protect personal information in its custody or under its control by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification or disposal or similar risks.”

Personal Information Protection Act (BC), s. 34 · Read it at BC Laws · Verified 2026-11-10

“Despite subsection (2), if an organization uses an individual’s personal information to make a decision that directly affects the individual, the organization must retain that information for at least one year after using it so that the individual has a reasonable opportunity to obtain access to it.”

Personal Information Protection Act (BC), s. 35(1) · Read it at BC Laws · Verified 2026-11-10

“An organization must destroy its documents containing personal information, or remove the means by which the personal information can be associated with particular individuals, as soon as it is reasonable to assume that (a) the purpose for which that personal information was collected is no longer being served by retention of the personal information, and (b) retention is no longer necessary for legal or business purposes.”

Personal Information Protection Act (BC), s. 35(2) · Read it at BC Laws · Verified 2026-11-10

The law’s own words

“An organization is responsible for personal information under its control and shall designate an individual or individuals who are accountable for the organization’s compliance with the following principles.”

Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.1 · Read it at Justice Laws · Verified 2026-11-10

“The identity of the individual(s) designated by the organization to oversee the organization’s compliance with the principles shall be made known upon request.”

Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.1.2 · Read it at Justice Laws · Verified 2026-11-10

“The purposes for which personal information is collected shall be identified by the organization at or before the time the information is collected.”

Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.2 · Read it at Justice Laws · Verified 2026-11-10

“The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.”

Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.3 · Read it at Justice Laws · Verified 2026-11-10

“For the purposes of clause 4.3 of Schedule 1, the consent of an individual is only valid if it is reasonable to expect that an individual to whom the organization’s activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure of the personal information to which they are consenting.”

Personal Information Protection and Electronic Documents Act, s. 6.1 · Read it at Justice Laws · Verified 2026-11-10

“An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.”

Personal Information Protection and Electronic Documents Act, s. 5(3) · Read it at Justice Laws · Verified 2026-11-10

“The collection of personal information shall be limited to that which is necessary for the purposes identified by the organization. Information shall be collected by fair and lawful means.”

Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.4 · Read it at Justice Laws · Verified 2026-11-10

“Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as necessary for the fulfilment of those purposes.”

Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.5 · Read it at Justice Laws · Verified 2026-11-10

“Personal information that is no longer required to fulfil the identified purposes should be destroyed, erased, or made anonymous. Organizations shall develop guidelines and implement procedures to govern the destruction of personal information.”

Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.5.3 · Read it at Justice Laws · Verified 2026-11-10

“Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.”

Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.6 · Read it at Justice Laws · Verified 2026-11-10

“Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.”

Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.7 · Read it at Justice Laws · Verified 2026-11-10

“The security safeguards shall protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. Organizations shall protect personal information regardless of the format in which it is held.”

Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.7.1 · Read it at Justice Laws · Verified 2026-11-10

“An organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.”

Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.8 · Read it at Justice Laws · Verified 2026-11-10

“Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.”

Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.9 · Read it at Justice Laws · Verified 2026-11-10

“An organization shall assist any individual who informs the organization that they need assistance in preparing a request to the organization.”

Personal Information Protection and Electronic Documents Act, s. 8(2) · Read it at Justice Laws · Verified 2026-11-10

“An organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request.”

Personal Information Protection and Electronic Documents Act, s. 8(3) · Read it at Justice Laws · Verified 2026-11-10

“When an individual successfully demonstrates the inaccuracy or incompleteness of personal information, the organization shall amend the information as required.”

Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.9.5 · Read it at Justice Laws · Verified 2026-11-10

“An individual shall be able to address a challenge concerning compliance with the above principles to the designated individual or individuals accountable for the organization’s compliance.”

Personal Information Protection and Electronic Documents Act, Schedule 1, cl. 4.10 · Read it at Justice Laws · Verified 2026-11-10

“An organization shall report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual.”

Personal Information Protection and Electronic Documents Act, s. 10.1(1) · Read it at Justice Laws · Verified 2026-11-10

“Unless otherwise prohibited by law, an organization shall notify an individual of any breach of security safeguards involving the individual’s personal information under the organization’s control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual.”

Personal Information Protection and Electronic Documents Act, s. 10.1(3) · Read it at Justice Laws · Verified 2026-11-10

“An organization shall, in accordance with any prescribed requirements, keep and maintain a record of every breach of security safeguards involving personal information under its control.”

Personal Information Protection and Electronic Documents Act, s. 10.3(1) · Read it at Justice Laws · Verified 2026-11-10