Alberta’s Personal Information Protection Act (PIPA) sets the rules for how most private businesses in Alberta collect, use and share personal information, and that includes the data your website gathers through contact forms, bookings, newsletters and analytics. In practice, it means telling people what you collect and why, protecting it, and reporting serious breaches. This guide explains what PIPA means for a typical business website in plain language. It is general information, not legal advice.
Key takeaways
- Alberta’s PIPA applies to most provincially regulated private-sector organizations in Alberta.
- Tell visitors what you collect through forms and analytics, and why, in a clear privacy policy.
- Protect the personal information your website collects with reasonable security.
- Breaches that create a real risk of significant harm must be reported to the Alberta privacy commissioner without unreasonable delay.
- Marketing emails and texts also fall under Canada’s anti-spam law (CASL).
Does PIPA apply to my business?
PIPA covers provincially regulated private-sector organizations in Alberta, which the Government of Alberta describes as typically any business that collects, uses or discloses personal information in Alberta. Some non-profits are covered when they carry out commercial activities.
Federally regulated businesses, such as banks, airlines and telecommunications companies, fall under the federal law, PIPEDA, instead. If you are unsure which law applies to you, check with a privacy lawyer.
What personal information does a website collect?
Even a simple business website usually collects personal information. Common examples include:
- Names, emails and phone numbers from contact and quote forms.
- Booking or appointment details.
- Newsletter sign-ups.
- Analytics and advertising data, such as IP addresses and cookie identifiers.
- Job applications and uploaded files.
Start by listing every form, tool and plugin on your site that collects or shares data, including third-party services like analytics, chat widgets and booking systems.
Privacy policies and consent on your website
PIPA generally requires organizations to have consent to collect, use and disclose personal information, and to explain the purposes. On a website, that usually means:
- A clear privacy policy that explains what you collect, why, who you share it with and how people can contact you.
- A short note on each form explaining how the information will be used, with a link to the privacy policy.
- Only asking for the information you actually need. Fewer fields also improve form completion.
- Telling visitors about analytics and advertising tools, and offering cookie choices where needed.
Keeping website data secure
Organizations must protect personal information in their custody or control with reasonable security arrangements. For a website, practical steps include HTTPS on every page, strong admin passwords with two-factor sign-in, keeping your CMS and plugins updated, limiting who can see form submissions and deleting old data you no longer need.
What happens if there is a privacy breach?
Under PIPA, an organization must notify Alberta’s Information and Privacy Commissioner without unreasonable delay when a loss of, unauthorized access to or disclosure of personal information creates a real risk of significant harm to an individual. The OIPC encourages organizations to notify as soon as possible, even before their investigation is complete.
The OIPC’s guidance notes that failing to notify the Commissioner is an offence, with fines of up to $100,000 for organizations. The Commissioner can also require you to notify affected individuals. Having a simple breach plan before anything goes wrong makes it much easier to respond quickly.
Access requests from website users
People have the right to ask an organization for access to their own personal information. The Government of Alberta notes that individuals can complain to the OIPC if an organization does not respond within 45 days, unless the time is properly extended. Know where your website data is stored, so you can find it when someone asks.
PIPA and email marketing: where CASL fits in
PIPA covers personal information, while Canada’s Anti-Spam Legislation (CASL) covers commercial electronic messages such as marketing emails and texts. If your website signs people up for a newsletter, you need CASL-compliant consent as well. Our guide to CASL rules for businesses explains the requirements.
How Perfect Digital Solution can help
We build and maintain websites for Alberta businesses with privacy in mind: clear form notices, secure setup, careful analytics configuration and CASL-ready sign-up forms. We are not lawyers, so we work alongside your legal adviser. See our digital marketing in Alberta page or contact our team.
Related reading: digital marketing in Alberta · CASL rules for businesses · Calgary website checklist · web design and development
Frequently asked questions
Is PIPA the same as PIPEDA?
No. PIPA is Alberta’s private-sector privacy law and covers most provincially regulated businesses in Alberta. PIPEDA is the federal law that covers federally regulated businesses, such as banks and airlines, and private-sector organizations in provinces without their own substantially similar law. The principles are similar, but the details and regulators differ.
Does a small Alberta business really need a privacy policy?
If your website collects any personal information, such as names and emails through a contact form, a clear privacy policy is the simplest way to explain what you collect and why. It also builds trust with visitors. It does not need to be long, but it must be accurate and kept up to date.
Do I need consent to use Google Analytics on my website?
Analytics tools can collect personal information such as IP addresses and online identifiers. You should explain this in your privacy policy and consider offering cookie choices. The right approach depends on how you configure the tools and what you use the data for, so confirm the details with a privacy professional.
Who do I report a website data breach to in Alberta?
For organizations covered by PIPA, breaches that create a real risk of significant harm must be reported to the Office of the Information and Privacy Commissioner of Alberta, which provides an online breach notification form. Federally regulated organizations report to the federal Privacy Commissioner instead.
How long should I keep contact form submissions?
Keep personal information only as long as you reasonably need it for business or legal purposes, then delete or anonymize it. For many small businesses, that means clearing old enquiries that never became customers after a set period. Write your chosen retention period into your privacy policy and stick to it.
Sources
- Personal Information Protection Act – Government of Alberta
- Guidance for Notifying the OIPC about a Privacy Breach Under PIPA (April 2024) – OIPC Alberta
- Personal Information Protection Act (PIPA) – OIPC Alberta
- Accessing your personal information – Government of Alberta
- Frequently Asked Questions about Canada’s Anti-Spam Legislation – CRTC
Written by the Perfect Digital Solution team. We use AI tools to support research and drafting, and every fact in this article is checked by our team against the sources listed above.
