Canada — Alberta PIPA: AI Compliance Requirements
Alberta's Personal Information Protection Act (PIPA Alberta, SA 2003) applies to private sector organizations in Alberta collecting, using, or disclosing personal information through AI systems. Alberta PIPA is substantially similar to PIPEDA and BC PIPA. The Alberta OIPC enforces the law and has published AI-specific guidance on consent, automated decisions, and privacy impact assessments. Alberta is Canada's energy sector hub — AI systems used in energy operations, HR, or customer service for Alberta residents must comply.
Summary of publicly-available regulatory text as of 2026-08-22. Verify against current official sources before relying on this for compliance decisions. Not legal advice.
Key Facts
January 1, 2004
January 1, 2004
CYCLE 20 CLARIFICATION (2026-08-22): CAD 100,000 is the s. 59(2) OFFENCE penalty ceiling for an organization (CAD 10,000 for an individual) — but this applies only to specific statutory OFFENCES (obstructing the Commissioner, making false statements, or failing to comply with a Commissioner order), prosecuted as offences, NOT a general administrative fine OIPC can levy directly for any PIPA violation. OIPC AB currently has no power to impose administrative monetary penalties (AMPs) at all for ordinary contraventions — its remedy is investigation/order (cease, delete, remediate), as the Clearview case shows. A modernization reform is in progress but not yet law: the Legislative Assembly's Standing Committee on Resource Stewardship submitted 12 recommendations (Feb 2025), one of the three most consequential being a NEW AMP power of up to CAD 50,000 (individuals) or the GREATER of CAD 10,000,000 or 2% of worldwide turnover (organizations) — a figure that would dwarf the current CAD 100,000 offence cap. Public engagement ran through Spring 2026; no amendment bill had been introduced as of mid-2026; reform is expected in the 2026-2027 window with no announced timeline. Treat CAD 10M/2%-turnover as a MONITORING figure, not current law.
What Your Business Must Do
2 compliance requirements identified. Critical requirements carry the highest risk of enforcement action.
Alberta PIPA Consent and Disclosure for AI
High PriorityAlberta PIPA requires meaningful consent before using personal information in AI systems. Disclose AI use in privacy policies, obtain appropriate consent for AI-driven profiling or automated decision-making for Alberta residents. Honor individual access requests for data used in AI decisions. Alberta energy sector: pay attention to employee data used in AI safety and productivity monitoring.
Deadline: January 1, 2004
Alberta PIPA (SA 2003)Alberta OIPC AI Guidance Compliance
Medium PriorityThe Alberta OIPC has published guidance on AI and privacy. Conduct a Privacy Impact Assessment for AI systems making consequential decisions about Alberta residents. Review OIPC guidance at oipc.ab.ca.
Deadline: January 1, 2004
Alberta PIPA (SA 2003), reasonable-purposes test, as applied by OIPC AB AI guidanceWho Does This Apply To?
Applies to private-sector organisations in Alberta that collect, use, or disclose personal information — including through AI systems — relating to Alberta employees, customers, or operations. Alberta's PIPA (SA 2003) is substantially similar to PIPEDA and BC PIPA and is enforced by the Alberta OIPC. In scope: any organisation using personal information in AI for Alberta residents (informed, meaningful consent required for NON-public data; bundled consent for AI training on non-public personal data is generally invalid), AI hiring tools (the OIPC's emerging position requires lawful-basis documentation and bias-audit results available to candidates on request), and employee-monitoring AI (reasonable purpose, proportionality, and notice required — covert AI monitoring is generally unlawful, a particular concern for Alberta's energy sector). CYCLE 13 CORRECTION (web-verified 2026-08-22, Torys, McMillan, Norton Rose Fulbright, Dentons, Stillman LLP): the joint Clearview AI investigation produced a 2021 order to cease processing Albertans' images, but on 2025-05-08 the Alberta Court of King's Bench (Clearview AI Inc v Alberta (IPC), 2025 ABKB 287) held that PIPA ss. 12/17/20's consent requirements, combined with PIPA Regulation s. 7(e)'s narrow "publicly available" exception, unjustifiably infringe Charter s. 2(b) freedom of expression — the court struck the regulation's limiting words ("including, but not limited to, magazines, books, and newspapers"), letting "publication" take its ordinary meaning and materially widening what counts as publicly-available (consent-exempt) data, including data scraped from the open internet for AI training. This narrows, but does NOT eliminate, the AI-training-consent duty above: the court separately upheld the Commissioner's order against Clearview specifically because Clearview's PURPOSE (building a commercial facial-recognition product) was not "reasonable" under PIPA's separate reasonable-purposes test — a distinct requirement from the consent question, and one AI training on public data must still satisfy. Maximum exposure: CAD 100,000 per violation (Alberta PIPA does not currently authorise administrative monetary penalties — a modernization review is underway 2025-2026).
Recent Enforcement Actions
Against:
Against:
Recent Regulatory Guidance
OIPC Alberta — Artificial Intelligence and Privacy (2024)
OIPC AB AI guidance laid out PIPA application: (1) Alberta organizations must apply the reasonable-purposes test before deploying AI to process Albertans' personal information; (2) consent must be informed and meaningful — bundled consent for AI training is generally invalid; (3) DPIAs are expected for high-risk AI processing; (4) individuals have the right to access information used in AI-driven decisions and to challenge inaccuracies; (5) employee monitoring AI requires reasonable purpose, proportionality, and notice — covert AI monitoring is generally unlawful. Aligned with sister-province OIPC BC interpretation under parallel PIPA framework.
Key Case Law & Precedent
OPC + OIPC BC + OIPC AB + CAI QC v. Clearview AI Inc. (Joint Investigation, February 2021)
Joint Federal-Provincial Privacy Authorities of Canada · 2021Foundational joint Canadian privacy authorities' investigation finding Clearview AI's facial-image scraping violated federal PIPEDA and provincial Alberta PIPA. OIPC AB's portion of the order required Clearview to cease processing Albertans' images. The investigation is the leading Canadian precedent OIPC AB applies in subsequent AI-profiling enforcement under PIPA's reasonable-purposes test, and shapes the DPA's expectations for AI hiring tools, AI biometric systems, and AI advertising platforms operating in Alberta.
Outcome: Cease-and-desist orders from federal OPC and provincial DPAs; mandatory deletion of Canadians' facial-image data
Case referenceFrequently Asked Questions
Does Canada — Alberta PIPA apply to my business?
Alberta's Personal Information Protection Act (PIPA Alberta, SA 2003) applies to private sector organizations in Alberta collecting, using, or disclosing personal information through AI systems. Alberta PIPA is substantially similar to PIPEDA and BC… Use Aegis Firma's free scanner to get a personalized assessment in under 5 minutes.
What is the penalty for non-compliance?
The maximum penalty under Canada — Alberta PIPA is: CYCLE 20 CLARIFICATION (2026-08-22): CAD 100,000 is the s. 59(2) OFFENCE penalty ceiling for an organization (CAD 10,000 for an individual) — but this applies only to specific statutory OFFENCES (obstructing the Commissioner, making false statements, or failing to comply with a Commissioner order), prosecuted as offences, NOT a general administrative fine OIPC can levy directly for any PIPA violation. OIPC AB currently has no power to impose administrative monetary penalties (AMPs) at all for ordinary contraventions — its remedy is investigation/order (cease, delete, remediate), as the Clearview case shows. A modernization reform is in progress but not yet law: the Legislative Assembly's Standing Committee on Resource Stewardship submitted 12 recommendations (Feb 2025), one of the three most consequential being a NEW AMP power of up to CAD 50,000 (individuals) or the GREATER of CAD 10,000,000 or 2% of worldwide turnover (organizations) — a figure that would dwarf the current CAD 100,000 offence cap. Public engagement ran through Spring 2026; no amendment bill had been introduced as of mid-2026; reform is expected in the 2026-2027 window with no announced timeline. Treat CAD 10M/2%-turnover as a MONITORING figure, not current law.. Fines are typically scaled by company size, severity of violation, and whether violations were willful or accidental.
How do I comply with Canada — Alberta PIPA?
The 2 requirements above cover the core obligations. The fastest path to compliance is: (1) conduct an AI risk assessment, (2) document your AI systems, (3) implement transparency disclosures where required. Aegis Firma generates all required documents automatically.
Official Source
https://www.oipc.ab.ca/resources/artificial-intelligence/Last updated: 2026-08-22 — verify at source before relying on this information.
Don't leave compliance to chance
Aegis Firma scans your AI tools, tells you exactly which regulations apply, and generates all required documents — in 30 minutes.
Start your free compliance scan