Privacy in Alberta is Changing, Again: A Status Update on the Modernization of PIPA

The privacy landscape in Alberta is changing again. Following the substantive changes made to Alberta’s public-sector privacy legislation in 2025, the Government of Alberta is looking to modernize the Personal Information Protection Act (PIPA), first introduced in 2004 and updated in 2010, which governs private sector privacy regulation. As organizations adopt cloud platforms, AI enabled software, and develop increasingly complex data ecosystems, the Government of Alberta has launched a PIPA Modernization Review to evaluate whether the legislation still meets the needs of today’s digital environment.

For Alberta organizations, this indicates more than a legislative update: it’s a signal that privacy expectations are changing across all sectors, and that compliance programs must evolve accordingly.

Expectations are Changing: The Government of Alberta Modernization Review

In February 2025, Alberta’s Standing Committee on Resource Stewardship completed a review of PIPA. The recommendations put forward by the review underscore the current pressures driving this round of modernization:

• Rapid technological change that has outpaced the original legislation

• Growing expectations for transparency and accountability from citizens and consumers

• Alignment pressures with federal and provincial privacy reforms across Canada and remaining up to date with world-leading jurisdictions

• Awareness of the complexity of privacy concerns in an increasingly digital world

• The need for clearer rules around automated systems and AI

The review demonstrates that although the foundational principles of Alberta’s first generation of privacy laws remain sound, the operational realities and potential risks of privacy have increased in complexity.

Future Direction

The Standing Committee Review recommends that future amendments to PIPA may:

• Provide specific protections for minors, aligning with one of the 2024-2027 strategic priorities of the Office of Privacy Commission of Canada

• Maintain substantially similar design to federal private sector privacy law and remain current with world-leading jurisdictions

• Ensure improved alignment between all provincial privacy legislation, including the Access to Information Act, Protection of Privacy Act, and Health Information Act, and associated regulations

• Update provisions of the Act that address nonidentifying information to include deidentified and anonymized data

• Clarify the definition of commercial activity and provide guidelines for non-profits to manage privacy when carrying out non-commercial activities

• Modernize consent rules to better support informed consent

• Enable the OIPC to sanction organizations and individuals under PIPA, and align penalties levied by courts or the regulator with those included in other privacy legislation

• Strengthen accountability for third party service providers

• Define ‘significant harm’ to best support reporting of privacy breaches to the Commissioner

• Address emerging technologies such as AI and automated decision making

For organizations that have not updated their privacy programs in several years, these potential changes could require significant adjustments in governance approach and operational implementation.

Your Opportunity

Engagement with the public and the OIPC took place early in 2026 and amendments to the legislation may be forthcoming. With modernization on the way, private‑sector organizations should treat this moment as an opportunity. Strengthening privacy governance at any time reduces risk, builds trust with clients, and ensures your organization is ready for the next frontier of privacy regulation. You can start by checking on the basics:

• Do you have a Privacy Officer in place?

• What are the roles and responsibilities of staff and leadership?

• What policies do you have in place? Have policies kept pace with technological developments, new tools, or newly implemented processes and services?

• Are you communicating to clients about your privacy practices? If so, does that content need to be updated on your website?

• What is in place for staff training on privacy obligations, breach response, and information security practices? Do you need to refresh that training if there has been significant staff turnover or time elapsed since it was last conducted?

Need Help?

If your privacy program hasn’t kept pace with your organization’s digital transformation, now is the time to get a head start on modernizing your privacy practices.

Cenera can help.

Talk to an expert

If you’d like to talk to an expert about what changes to privacy legislation and expectations mean for your organization, our team is here to help. Reach us at: info@cenera.ca | 403.290-0466 | cenera.ca/contact-us.

NEW Private-Sector Privacy Roundtable

Following the success of our public-sector privacy roundtables in 2024, we’re introducing one for the private sector. If you’re in the private sector, including non-profits or health, our Private Sector Privacy Roundtable is for you.

Launching this September, it’s a confidential virtual forum where privacy professionals connect, compare notes, tackle tough issues, and learn together. If you’re considering how to approach modernizing your organization’s privacy program, connecting with your peers and sharing ideas is a valuable starting point.

Please reach out to us or visit our website to register. We look forward to hosting you and your colleagues with informative and collaborative discussions this fall.