Request a quote
Breach notification: Alberta

Privacy breach notification in Alberta.

3 notification duties in Alberta and 3 statutory harm tests, with who to tell, the timing the law sets, the threshold and the primary source for each. Last verified 2026-10-29.

Check your breach Assess the harm
At a glance

What applies in Alberta.

  • Alberta PIPA In force. private sector. Threshold: real risk of significant harm. Office of the Information and Privacy Commissioner of Alberta: without unreasonable delay.
  • Alberta POPA In force. public bodies. Threshold: real risk of significant harm. Information and Privacy Commissioner of Alberta: without unreasonable delay.
  • Alberta HIA s. 60.1 In force. health information custodians. Threshold: risk of harm to an individual. Information and Privacy Commissioner of Alberta: as soon as practicable.
The rules

Every notification duty in Alberta.

Each row links the statute or regulator page it comes from and shows when it was last checked. Dataset version 2026-10-29.

Regime Applies to Notify Threshold Verified
Alberta PIPA Personal Information Protection Act, S.A. 2003, c. P-6.5, ss. 34.1 and 37.1 In force since 2010-05-01
Private-sector organizations in Alberta (businesses, non-profits in commercial activity, professional regulatory organizations) with personal information under their control.
  • Office of the Information and Privacy Commissioner of Alberta: without unreasonable delay report
  • Affected individuals: as required by the Commissioner under s. 37.1 (conditional or voluntary) report

Records: No statutory breach register; OIPC expects documentation of the incident and assessment.

Penalties: Offence fines of up to $10,000 for an individual and up to $100,000 for a person other than an individual (PIPA s. 59).

real risk of significant harm

Mandatory breach reporting in force May 1, 2010 (OIPC Alberta). The Alberta legislature's 2025 PIPA review produced recommendations; no amending bill had been introduced as of September 2026 (secondary source) and none was found on October 29, 2026.

2026-10-29
Alberta POPA Protection of Privacy Act, S.A. 2024, c. P-30.5, s. 10(2)-(3), and the Protection of Privacy (Ministerial) Regulation s. 4 In force since 2025-06-11
Alberta public bodies formerly under FOIP: ministries, agencies, boards, health authorities as public bodies, universities, colleges, school boards, municipalities, police services.
  • Each individual to whom there exists a real risk of significant harm: without unreasonable delay report
  • Information and Privacy Commissioner of Alberta: without unreasonable delay report
  • Minister of Technology and Innovation: without any unreasonable delay report

Records: Privacy management program (mandatory from June 11, 2026) must include breach handling and documentation; no fixed statutory retention period identified.

Penalties: Knowingly contravening Part 1 (personal information): fines of up to $125,000 for an individual and up to $750,000 for an organization (Government of Alberta Bill 33 information sheet, November 2024). The King's Printer text was not opened; confirm the section number in the Act.

real risk of significant harm

POPA replaced FOIP on June 11, 2025 (FOIP had no mandatory breach duty). Privacy management program obligations apply from June 11, 2026. Breaches that began under FOIP should still be reported on the POPA form with a note (OIPC).

2026-10-29
Alberta HIA s. 60.1 Health Information Act, R.S.A. 2000, c. H-5, s. 60.1 In force since 2018-08-31
Alberta custodians (Alberta Health Services, physicians, pharmacists, dentists, nursing homes, Alberta Health) and their affiliates.
  • Information and Privacy Commissioner of Alberta: as soon as practicable report
  • Minister of Health: as soon as practicable report
  • Affected individuals: as soon as practicable report

Records: Affiliates must notify the custodian; custodians should document breaches (OIPC assessment tool).

Penalties: Failing to notify is an offence under HIA s. 107 punishable by fine; amounts are set in the Act.

risk of harm to an individual

Section 60.1 has been in force since August 31, 2018.

2026-10-29

Spotted an error or a change in the law? Report a correction with the source. The full dataset is rules.json (CC BY 4.0).

The harm test

When a breach in Alberta has to be reported.

The statutory wording, the factors the law names and the record you have to keep, from the harm thresholds dataset.

Alberta PIPA

Personal Information Protection Act, S.A. 2003, c. P-6.5, ss. 34.1 and 37.1

An organization having personal information under its control must, without unreasonable delay, provide notice to the Commissioner of any incident involving the loss of or unauthorized access to or disclosure of the personal information where a reasonable person would consider that there exists a real risk of significant harm to an individual as a result of the loss or unauthorized access or disclosure (s. 34.1(1)).

Factors the law names

  • The nature (sensitivity) of the information involved
  • Who obtained, or could have obtained, the information
  • How many persons the information was exposed to
  • Any personal or professional relationship between the affected individual and the unauthorized recipient
  • Security measures in place, such as encryption, and any known flaws in them
  • How long the information was exposed
  • Evidence of malicious intent, such as theft, hacking or malware
  • Whether the information could be used for criminal purposes, such as identity theft or fraud
  • Whether the information was recovered
  • How many individuals were affected
  • Whether vulnerable individuals, such as youth or seniors, are involved
  • The Commissioner's decisions add: absence of reported identity theft or fraud is not a mitigating factor, because identity theft can happen months or years after a breach; compromise by the malicious action of an unknown third party increases the likelihood of harm; safeguards added after the breach do not reduce the risk to affected individuals

Records: No statutory breach register. The notice to the Commissioner must be in writing and include the circumstances, the date or period, the information involved, an assessment of the risk of harm to individuals, the estimated number of individuals at real risk of significant harm, the steps taken to reduce harm and to notify individuals, and a contact person (PIPA Regulation s. 19).

Verified 2026-10-29: OIPC Alberta: Guidance for Notifying the OIPC about a Privacy Breach Under PIPA (April 2024) ; OIPC Alberta: PIPA Privacy Breach Process (April 2024) ; OIPC Alberta Breach Notification Decision P2023-ND-001 ; OIPC Alberta: Breach Notification Requirements

Alberta POPA

Protection of Privacy Act, S.A. 2024, c. P-30.5, s. 10, and the Protection of Privacy (Ministerial) Regulation s. 4

Where a reasonable person would consider that there exists a real risk of significant harm to an individual as a result of the loss of, or unauthorized access to or disclosure of, personal information or data derived from it, the public body must notify the Commissioner, the Minister and the affected individuals.

Factors the law names

  • Whether there is a reasonable basis to believe the information has been or may be misused
  • Whether the loss, access or disclosure was the result of malicious intent
  • The sensitivity of the information
  • Mitigating measures taken, including recovery and encryption

Records: The privacy management program (mandatory from June 11, 2026) must include breach handling and documentation.

Verified 2026-10-29: Government of Alberta fact sheet: POPA Privacy Incident Notifications ; OIPC Alberta POPA Breach Notification Assessment Tool (June 2025)

Alberta HIA

Health Information Act, R.S.A. 2000, c. H-5, s. 60.1, and the Health Information Regulation s. 8.1

A custodian must, as soon as practicable, give notice of any loss of, or unauthorized access to or disclosure of, individually identifying health information in its custody or control where the custodian determines there is a risk of harm to an individual as a result (s. 60.1(2)).

Factors the law names

  • (a) whether there is a reasonable basis to believe that the information has been or may be accessed by a person
  • (b) whether there is a reasonable basis to believe that the information has been misused or will be misused
  • (c) whether the information could be used for the purpose of identity theft or to commit fraud
  • (d) whether the information is of a type that could cause embarrassment or physical, mental or financial harm to the individual
  • (e) whether the loss or unauthorized access or disclosure has adversely affected or will adversely affect the provision of a health service to the individual
  • (f) for electronic information, whether the custodian can demonstrate it was encrypted or otherwise secured in a manner that would prevent unauthorized access or render it unintelligible
  • (g) for lost information, whether it was destroyed or rendered inaccessible or unintelligible
  • (h) for recovered lost information, whether the custodian can demonstrate it was not accessed before it was recovered
  • (i) for unauthorized access or disclosure, whether the only recipient was a custodian or affiliate subject to confidentiality policies who acted within their duties, did not use the information for an improper purpose and used it only to address the error

Records: No general breach record duty in s. 60.1; a decision not to notify an individual because notice could harm their mental or physical health must be reported to the Commissioner immediately with the breach report (Regulation s. 8.3). Affiliates must notify the custodian as soon as practicable (s. 60.1(1)).

Verified 2026-10-29: OIPC Alberta: Breach Reporting (HIA s. 60.1 and Regulation s. 8.1) ; OIPC Alberta: Breach Notification Requirements ; OIPC Alberta: Mandatory privacy breach reporting in Alberta's health sector

Work through the test for your breach

Federal law

Federal rules that can apply in Alberta too.

Federal duties follow the organization, not the province: a bank, a telecom or a private company in a province without its own private sector law reports under these as well.

  • PIPEDA Private-sector organizations that collect, use or disclose personal information in the course of commercial activity anywhere in Canada, federal works, undertakings and businesses (banks, telecoms, airlines, inter-provincial transport) and their employee data, and organizations in provinces without substantially similar private-sector law (every province except BC, Alberta and Quebec; health custodians in Ontario, NB, NS and NL are also substantially similar for health information).
  • Privacy Act / TBS Directive on Privacy Practices Federal government institutions subject to the Privacy Act (departments, agencies, Crown corporations listed in the schedule).
  • CCSPA (Bill C-8) Designated operators in federally regulated vital services and systems (telecommunications, interprovincial/international pipelines and power lines, nuclear, transportation, banking, clearing and settlement) once classes of operators are designated by regulation and listed in Schedule 2.
  • OSFI Incident Reporting Advisory Federally regulated financial institutions (banks, foreign bank branches, federal credit unions, life and P&C insurers, trust and loan companies). Administrators of federally regulated private pension plans have a separate OSFI advisory (2023) with the same 24-hour window, reported to pensions@osfi-bsif.gc.ca.
  • CIRO Rule 3703 CIRO investment dealer members. Mutual fund dealer members should confirm whether an equivalent reporting rule applies to them.
  • CSA continuous disclosure Reporting issuers (public companies) in Canadian jurisdictions.
Questions

Breach reporting in Alberta, answered from the rules.

Do I have to report a privacy breach in Alberta?

It depends on the kind of organization and the information involved. Alberta PIPA (in force, private sector): the threshold is real risk of significant harm. Alberta POPA (in force, public bodies): the threshold is real risk of significant harm. Alberta HIA s. 60.1 (in force, health information custodians): the threshold is risk of harm to an individual. Federal rules such as PIPEDA can apply as well, depending on the organization.

How long do I have to report a breach in Alberta?

Alberta PIPA: Office of the Information and Privacy Commissioner of Alberta, without unreasonable delay. Alberta POPA: Information and Privacy Commissioner of Alberta, without unreasonable delay. Alberta POPA: Minister of Technology and Innovation, without any unreasonable delay. Alberta HIA s. 60.1: Information and Privacy Commissioner of Alberta, as soon as practicable. Alberta HIA s. 60.1: Minister of Health, as soon as practicable. Where a law sets a fixed number of hours or days, the breach notification tool shows a countdown.

Who has to be notified about a breach in Alberta?

Alberta PIPA: Office of the Information and Privacy Commissioner of Alberta; Affected individuals (conditional or voluntary). Alberta POPA: Each individual to whom there exists a real risk of significant harm; Information and Privacy Commissioner of Alberta; Minister of Technology and Innovation. Alberta HIA s. 60.1: Information and Privacy Commissioner of Alberta; Minister of Health; Affected individuals. Conditional recipients apply only in the circumstances the law sets out; the rules table above gives the detail for each.

What harm test applies in Alberta?

Alberta PIPA: An organization having personal information under its control must, without unreasonable delay, provide notice to the Commissioner of any incident involving the loss of or unauthorized access to or disclosure of the personal information where a reasonable person would consider that there exists a real risk of significant harm to an individual as a result of the loss or unauthorized access or disclosure (s. 34.1(1)). Alberta POPA: Where a reasonable person would consider that there exists a real risk of significant harm to an individual as a result of the loss of, or unauthorized access to or disclosure of, personal information or data derived from it, the public body must notify the Commissioner, the Minister and the affected individuals. Alberta HIA: A custodian must, as soon as practicable, give notice of any loss of, or unauthorized access to or disclosure of, individually identifying health information in its custody or control where the custodian determines there is a risk of harm to an individual as a result (s. 60.1(2)).

This page summarizes the law; it is not legal advice. Confirm the decision with counsel for anything you will act on.

Other jurisdictions

Breach notification across Canada.