Alberta privacy watchdog issues guidance ahead of new compliance deadline

By Your Southwest Media Group

Public bodies in Alberta are being given a clearer path to meet new privacy requirements set to take full effect next year.

The Office of the Information and Privacy Commissioner has released guidance to help organizations establish privacy management programs under the Protection of Privacy Act and related regulations. The requirement becomes mandatory in June 2026, following a one-year transition period after the law came into force in June 2025.

Information and Privacy Commissioner Diane McLeod said the new resources are designed to help public bodies meet legal obligations while improving how personal information is handled.

The guidance outlines how organizations can build and implement privacy management programs using a step-by-step framework. It also includes a checklist of requirements, with additional expectations for organizations that manage large volumes of data or sensitive personal information.

Public bodies are expected to ensure privacy protections extend beyond their own staff to include third-party service providers. A separate companion document has been released to guide organizations in managing those contractual relationships.

The commissioner pointed to the 2024 data breach involving PowerSchool systems used in educational institutions as a reminder of the risks tied to external providers and the importance of strong safeguards.

The Office of the Information and Privacy Commissioner operates independently and oversees compliance with Alberta’s access to information and privacy laws, including the Protection of Privacy Act and the Health Information Act.