Alberta: Alberta’s PIPA, and the breach notice that goes to the Commissioner
In Alberta, a business suffering a breach notifies the Commissioner, and the Commissioner decides whether affected individuals are told. The opposite of the federal reflex, and the opposite of the neighbouring province whose statute carries the same name.
Which law applies to an Alberta business whose calls are answered by software?
Alberta’s Personal Information Protection Act, in force since 1 January 2004, together with its regulation. Federal order SOR/2004-219 sets aside Part 1 of the federal statute for activity taking place inside the province.
Provincial law governs what happens inside Alberta; federal law governs information transferred outside the province or outside the country. Federal law also keeps reaching federal works and undertakings, everywhere in the country.
One feature deserves reading before anything else. On a breach, an Alberta business notifies the provincial Commissioner, and it is then the Commissioner who may require that affected individuals be notified. Writing it the other way round is a substantive error, and it is the commonest error on this subject.
This is not legal advice. It is a summary of what we read, written for a business owner, carrying its reading date below.
Where you probably are
You run a business in Alberta, and you may already have read a page about British Columbia law thinking it described yours. Both statutes carry the same name, use much the same words, and part company on the point with the heaviest consequences: what you do when something goes wrong.
This page describes Alberta law, says what it asks at the moment a call is answered and recorded, and draws an explicit line between the Alberta mechanism, the federal one, and the one next door.
Who Alberta law reaches
The statute reaches provincially regulated private-sector organizations: corporations, unincorporated associations, professional regulatory organizations, trade unions, partnerships, private schools and colleges, and any person acting in a commercial capacity. It applies in a limited way to non-profits carrying on commercial activity.
In other words an ordinary Alberta small business is subject to it, and provincial law — rather than federal law — governs what it does with customer information inside the province.
A separate Alberta statute frames health information held by the custodians it lists, among them a number of regulated health professionals. We do not stretch it past what that list names.
The notice required at collection time
Section 13 requires an organization, before or at the time of collecting personal information, to notify the individual of its intention to collect and of the purposes for doing so, and to give the name, position or title of a person able to answer that individual’s questions.
On a call, that is exactly the shape of a disclosure spoken at the opening: what is collected, why, and who answers if a person wants to know more. The part most often forgotten is the last one — your business must be able to name somebody.
What you write into your instructions is what a receptionist says on your behalf. Good place to put your purpose into one sentence, in your own words.
Three forms of consent, and what each commits you to
Consent may be express. Under section 8(2) it may be implied where a person voluntarily provides information for a stated purpose and it is reasonable that a person would volunteer it that way. Under section 8(3) it may follow from a notice offering an opportunity to opt out.
That third form carries a consequence people often miss: section 8(4) then limits use to the purposes stated in the notice. A notice drafted around “service quality” does not later authorise marketing or profiling.
Collection itself must stay within reasonable purposes, and within what is reasonably necessary for them. A call recording and its transcript are a collection: they fall under this rule like everything else.
Breaches: who notifies whom, and why it differs elsewhere
Section 34.1 requires an organization having personal information under its control to notify the provincial Commissioner, without unreasonable delay, of a breach where a reasonable person would consider there exists a real risk of significant harm to an individual. That notice must include an assessment of the risk of harm.
Section 37.1 then lets the Commissioner require the organization to notify affected individuals. Section 37.1(7) says nothing prevents an organization from notifying them itself, and many do. The duty, though, runs to the Commissioner.
Federal law uses a comparable threshold — a real risk of significant harm — with different routing: there, an organization notifies the federal commissioner and the individuals, and keeps a record of every breach for 24 months. And British Columbia law, sharing a name with Alberta’s, carries no breach-reporting duty at all. Three regimes, three answers: which one applies depends on where the information sat.
Recording a call, and where a complaint goes
The Criminal Code does not forbid a business party to a call from recording it: consent from one of the people in the conversation is enough to take it out of the offence. Privacy law, for its part, requires a caller to be told at the start of a call about the recording and its purpose, and requires that purpose to be the only one used. Both regimes apply at once.
The provincial regulator is the Office of the Information and Privacy Commissioner of Alberta, OIPC AB. It administers the private-sector statute, the health information statute, and public-sector access statutes. For what leaves the province, a complaint goes to the Office of the Privacy Commissioner of Canada.
Alberta’s public-sector legislation was recently rewritten; it does not apply to a small business, and a page citing it at you would be aiming at the wrong target.
What the product does, and what it will not do for you
What it does: the disclosure is spoken before the microphone opens; access is logged; exporting and deleting a record are operations inside the app; a role per teammate limits what each one sees. These are the pieces you will want if a commissioner asks what happened.
What it will not do: appoint the person who answers questions about collection, write your policy, set your retention period, assess a risk of harm for you, or draft the notice you owe the Commissioner. Those are obligations of your business, and a vendor suggesting otherwise is doing you harm.
Federal law in force remains the Personal Information Protection and Electronic Documents Act. Bill C-36, given first reading on 15 June 2026, sat at second reading on 23 October 2026 without royal assent: none of its content is in force.
What we read, and when
- OIPC AB — overview of Alberta’s private-sector statute
- OIPC AB — breach notification: threshold, delay, who notifies whom
- Alberta.ca — notice required when collecting personal information
- Canada Gazette — consolidated index of statutory instruments, exemption orders
- Canada Gazette — regulatory analysis: what an exemption order leaves untouched
Checked on
Related product pages
Pages describing measures taken, processing locations and known limits.