BC PIPA for private organizations

Section 3 says the Act applies to every organization, subject to exceptions. The key exceptions for most businesses are: collection, use or disclosure covered by the federal Act (PIPEDA); personal information covered by BC's public-sector Freedom of Information and Protection of Privacy Act; personal or domestic purposes; and journalistic, artistic or literary purposes.

In practice, a BC company, non-profit, professional practice or association handling customer, client, member or employee information within the province generally falls under PIPA. Federally regulated businesses such as banks, airlines and telecommunications companies, and personal information that crosses provincial or national borders in the course of commercial activity, bring PIPEDA into play. Many organizations deal with both, so it is worth confirming with counsel which law covers which activity.

One practical difference: PIPA covers employee personal information in BC private organizations, with its own rules for collecting, using and disclosing it for managing the employment relationship.

PIPA's foundation is section 4(1): in meeting its responsibilities, an organization must consider what a reasonable person would consider appropriate in the circumstances. That standard runs through the collection, use and disclosure rules. Sections 11 and 14, for example, limit collection and use to purposes that a reasonable person would consider appropriate in the circumstances and that fulfil the purposes disclosed or otherwise permitted.

Consent is generally required, but PIPA recognizes deemed consent in section 8: where a person volunteers information for an obvious purpose, consent is deemed for that purpose. Opt-out consent is also possible in limited circumstances. Organizations remain responsible for personal information under their control, including information not in their custody, such as data held by a service provider (section 4(2)).

Section 34 requires an organization to protect personal information in its custody or under its control by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification or disposal or similar risks. 'Reasonable' is judged against the sensitivity of the information and the risks, so a clinic or financial adviser is held to a higher standard than a small retailer holding names and emails.

For most BC organizations reasonable security today means at least: multi-factor authentication on email and remote access, encryption on laptops and mobile devices, timely patching, endpoint protection, least-privilege access, logging, tested backups, staff training and vendor oversight.

Unlike PIPEDA, Alberta's PIPA and Quebec's law, BC's PIPA does not, in the version current as of October 2026, contain a mandatory requirement to notify the commissioner or individuals of a privacy breach. That does not mean a breach can be ignored. Failing to make reasonable security arrangements is itself a contravention, individuals can complain to the Office of the Information and Privacy Commissioner for BC (OIPC BC), and the OIPC publishes privacy breach guidance and a breach checklist that it expects organizations to follow, including voluntary reporting to the OIPC and notifying affected individuals where appropriate.

If the same breach also affects people whose information is governed by PIPEDA or another province's law, those mandatory rules may apply. In practice, BC organizations should run the same disciplined process as everyone else: contain, preserve evidence, assess risk to individuals, decide on notification with counsel, and keep a record.

Individuals have a right to access their personal information and to ask how it has been used and to whom it has been disclosed. Under section 29, an organization must respond within 30 days of receiving the request, unless the time is extended under section 31, which allows up to an additional 30 days in specified circumstances, or longer with the commissioner's permission.

There is also a retention rule tied to access: section 35(1) says that if an organization uses personal information to make a decision that directly affects an individual, it must keep that information for at least one year after using it, so the individual has a reasonable opportunity to request access. Section 35(2) then requires destruction or anonymization once the purpose is no longer served and retention is no longer necessary for legal or business purposes.

Our Vancouver office supports BC organizations with the technical side of these steps.

1. 01

   Confirm which law applies

   Map your activities to PIPA and PIPEDA with counsel, including any cross-border flows.

2. 02

   Name a responsible person

   PIPA requires organizations to designate someone responsible for compliance; publish how to contact them.

3. 03

   Inventory your data

   Know what you hold, where, and why, including employee records and data with vendors.

4. 04

   Document reasonable security

   Record the controls in place and why they fit the sensitivity of the information.

5. 05

   Write a breach procedure

   Follow the OIPC BC checklist structure even though notification isn't mandatory under PIPA, and keep a breach log.

6. 06

   Set up an access process

   Intake, search, review and response within 30 days.

7. 07

   Apply the retention rules

   One-year minimum for decision records, then destruction when no longer needed.