Skip to content

Alberta POPA

In force Alberta, Canada · In force Jun 11, 2025 · no upcoming deadlines

Deadlines

DateWhat happens
Jun 11, 20263 months agoPrivacy management programs required
Jun 11, 20251 year agoPOPA in force

Summaries for reference, not legal advice. Check the official text.

What it does

Replaces the privacy part of Alberta's FOIP Act for public bodies. It adds mandatory breach notification where there is a real risk of significant harm, privacy management programs, privacy impact assessments, rules for creating and using non-personal data, and notice when personal information will be fed into automated systems. It also bans selling personal information and adds large offence fines.

Who it applies to
Alberta public bodies (ministries, agencies, municipalities, school boards, post-secondary and health bodies covered by the Act). Private sector stays under PIPA.
Penalties
Offence fines up to $125,000 for individuals and $750,000 for other persons, and up to $200,000 and $1,000,000 for the most serious contraventions (s. 57).
Enforced by
Information and Privacy Commissioner of Alberta
Official name
Protection of Privacy Act
Citation
SA 2024, c P-28.5
Topics
privacy, breach-notification, ai
Verified 2026-09-25 alberta.ca open.alberta.ca
Research notes

Assent date not confirmed on an official page, so enacted_date is left blank. Alberta PIPA (private sector) reform was not confirmed as enacted and is not included.

Related

Questions about Alberta POPA
What are the Alberta POPA compliance deadlines?
Jun 11, 2025: POPA in force. Jun 11, 2026: Privacy management programs required.
When does Alberta POPA take effect?
Alberta POPA took effect on Jun 11, 2025.
Who does Alberta POPA apply to?
Alberta public bodies (ministries, agencies, municipalities, school boards, post-secondary and health bodies covered by the Act). Private sector stays under PIPA.
What are the penalties under Alberta POPA?
Offence fines up to $125,000 for individuals and $750,000 for other persons, and up to $200,000 and $1,000,000 for the most serious contraventions (s. 57).

Rule changes by email

The morning after a new data, privacy or AI law, or a deadline change; nothing in quiet weeks.

Double opt-in. Unsubscribe any time.