Alberta Personal Information Protection Act (PIPA)

Alberta PIPA scope and obligations

PIPA applies to organisations engaged in commercial activity in Alberta. ITAD-relevant obligations: collection-limited-to-purpose, use-limited-to-purpose, destruction-when-purpose-fulfilled, safeguards appropriate to sensitivity, mandatory breach notification.

Mandatory breach notification

PIPA requires notification to the Privacy Commissioner of Alberta where there is a real risk of significant harm. The notification timeline is "without unreasonable delay". ITAD-relevant breaches in scope.

Energy-sector engagement profile

Alberta hosts the head offices of Suncor, Cenovus, TC Energy, Enbridge — major energy-sector IT estates. Refresh cycles produce predictable retiring volumes: head-office IT on 4-5 year cycles, OT/IT separated retirement for plant-floor systems, ICS/SCADA hardware on longer cycles.

Provincial-government engagement profile

Alberta provincial-government IT, Alberta Health Services, the University of Alberta system. Federation-of-public-sector-bodies procurement is the dominant pattern. Engagement model: programme-level master service agreements, witness destruction protocols.