Most Alberta business owners assume the law makes them call their customers after a breach. It doesn't. It makes them call the regulator — and that difference decides how your worst week goes.
Under Alberta's PIPA, when a breach creates a real risk of significant harm — even to a single person — you must report it to the Privacy Commissioner, in writing, without unreasonable delay (s. 34.1). Telling the people whose data you lost is a separate step: under s. 37.1, that's a decision the Commissioner can make for you.
So why have at least 80% of organizations already notified the affected individuals by the time they reported to the Commissioner — every year since 2012–13, per the OIPC's own data?
Because the companies that survive a breach understand something the others learn in court: notification isn't a legal chore. It's the opening move of your defence. Regulators and courts look at what you did and when you did it — and a prompt, documented response is the record you get to point at. Concealment and delay are what turn an incident into a lawsuit.
The duty you actually have
When a breach creates a real risk of significant harm — even to a single person — PIPA s. 34.1 requires you to report it to Alberta's Privacy Commissioner. In writing. Without unreasonable delay.
There is no fixed number of days. The delay itself is one of the things the regulator weighs against you.
PIPA s. 34.1 · PIPA Regulation s. 19 · oipc.ab.ca/breach-notification
Your customers are step two
Telling the people whose data you lost is not automatic. Under s. 37.1, it is the Commissioner who can order you to notify them.
The law leaves that call one step away from you. Most owners have no idea.
PIPA s. 37.1 — the notification decision rests with the Commissioner
80%
or more of Alberta organizations had already told the affected individuals by the time they reported the breach to the Commissioner — every year since 2012–13.
OIPC of Alberta, PIPA Breach Report (2022) — ~2,000 breaches, 2010–2021
Why they don't wait
Voluntary notice is expressly allowed — s. 37.1(7). Regulators and courts look at what you did and when you did it — and a prompt, documented response is the record you get to point at. Concealment and delay are what turn an incident into a lawsuit.
The trap: a voluntary notice must still meet the content rules of the PIPA Regulation (s. 19.1). The OIPC has made organizations notify twice for getting it wrong.
PIPA s. 37.1(7) · PIPA Regulation s. 19.1 · OIPC guidance (Apr 2024)
Sell outside Alberta? The rule flips
Under federal PIPEDA, notifying affected individuals is mandatory once the same risk threshold is met — "as soon as feasible."
Many Alberta businesses sit under both regimes at once. Know which law owns you before the breach — not during.
PIPEDA s. 10.1 · priv.gc.ca (OPC breach guidance)
What changes on Monday
1.Know which law owns you — PIPA, PIPEDA, or both. Decide this while nothing is on fire.
2.Put the two-step in writing: who assesses "real risk of significant harm", who reports to the OIPC, who drafts the customer notice — in the Regulation's format, so you never notify twice.
3.Treat notification as strategy decided in advance — not a 2 a.m. panic call.
PIPA is under legislative review — a 2025 committee recommended 12 changes, including direct fining powers for the Commissioner. Rules tighten; they don't loosen.
The breach is the trigger. The days after are the event.