OIPC Launches POPA PIA Template and POPA PIA Guide for use by public bodies.
Since the enactment of the Protection of Privacy Act (POPA), the Office of the Information and Privacy Commissioner (OIPC) has developed a new Privacy Impact Assessment (PIA) Template (POPA PIA Template) and a POPA PIA Completion Guide (POPA PIA Guide) that align with the current requirements of POPA and its regulations.
The completion of PIAs by public bodies is mandatory under POPA in certain circumstances. Some of these PIAs must be submitted to the Commissioner for review and comment.
The POPA PIA Template and POPA PIA Guide will assist public bodies in completing a PIA, as required, and help ensure that any PIAs submitted to the OIPC for review and comment contain the necessary information.
The two documents are now available on the OIPC website.
Table of Contents
Who should use the POPA PIA Template
The purpose of a review by the OIPC is to assess whether the public body has adequately turned its attention to its compliance obligations under POPA and will, as represented in the PIA, be compliant with POPA when implementing the project.
Any public body that is required to submit a PIA to the OIPC under POPA must use the POPA PIA Template. The OIPC will not accept a PIA from a public body that does not use the template.
The template is also available for public bodies to use when completing PIAs that are prescribed under POPA but are not required to be submitted to the Commissioner. Since the Commissioner may request copies of those PIAs under section 26(3) of POPA, the OIPC strongly recommends that public bodies use the template for completing these PIAs as well.
As well, the template is available and recommended for those bodies doing POPA-related PIAs voluntarily.
Be sure to use ONLY the POPA PIA Template and POPA PIA Guide when submitting a PIA to the Commissioner under POPA. Other material on our website that deals with PIAs, such as the Privacy Impact Assessment Requirements Guide, is directed toward PIA submissions under the Health Information Act (HIA).
How the POPA PIA Template will help
The POPA PIA Template provides overarching guidance in the first few sections, entitled Introduction, Common Questions, and Read Before Completing Your PIA.
In some cases, the need to complete certain parts of the template depends on the type of project and whether it includes aspects such as data matching, a common or integrated program or service, or the use of automated decision systems such as artificial intelligence (AI).
Public bodies should download a new copy of the template from the OIPC website each time they submit a new PIA to the Commissioner, rather than relying on previous versions of the template, as changes may have been made to the template since their last download.
PIAs should be submitted by attaching the completed PIA template, along with associated appendices, to an email, to be sent to PIA@oipc.ab.ca. Email is not a secure form of communication, so the OIPC recommends that security measures be applied to attachments sent by email.
IMPORTANT: If the POPA PIA Template is not completed appropriately, the PIA submission will be deemed incomplete and will not be reviewed by the OIPC. If this occurs, the OIPC will notify public bodies in writing.
The POPA PIA Guide
The OIPC has prepared a supplementary POPA PIA Completion Guide to assist public bodies in filling out the template. The guide aligns with the template on a question-by-question basis and provides additional context, a description of and what is expected of each question.
The POPA PIA Template and POPA PIA Completion Guide will be updated from time to time as additional guidance becomes available, based on feedback from public bodies, or when otherwise necessary.
A brief transition period: PIAs previously prepared and ready for submission
If a public body has a PIA ready for submission, which was created without access to the POPA PIA Template and POPA PIA Completion Guide, it is still advisable for those public bodies to refer to these new documents and submit their PIA using the new OIPC template.
During the first few weeks after the launch of the template by OIPC, if public bodies do not use the template, they should, at the very least, review these POPA PIA resources and make sure the requirements identified in those resources have been addressed in the PIA. The key issue is to ensure section 7(3) of the M-Regulation is met, i.e. a privacy impact assessment must provide a level of detail commensurate with the complexity of the practice, program, project or service the privacy impact assessment relates to.
If a public body submits the PIA without use of these materials, there is a risk it will not meet the OIPC requirements for review.
AS OF MAY 1, 2026, THE OIPC WILL NOT ACCEPT ANY PIA SUBMISSION THAT DOES NOT USE THE POPA PIA TEMPLATE.
Moving forward: What to expect next
The OIPC welcomes feedback from public bodies regarding their experiences using the POPA PIA Template and POPA PIA Completion Guide. We will take any suggestions or comments into consideration when making changes to the template. Public bodies may provide feedback when they submit their PIAs. Please include feedback in a separate document and attach it to the email that includes your PIA submission.
In addition to accepting this type of feedback, the OIPC will be hosting an online engagement forum after the PIA template has been in use by public bodies for some time, so that public bodies may share their experiences with the template and provide feedback and suggestions.
The PIA FAQ on the OIPC website is currently being revised and once complete, it will be posted on the OIPC website.
The POPA PIA Template references Privacy Management Programs (PMPs). The duty for public bodies to have an operational PMP will come into effect on June 11, 2026. The OIPC is currently developing PMP guidance to assist public bodies. Once available, the PMP guidance will be published on the OIPC website.
Need help?
If you have questions, please contact the OIPC at generalinfo@oipc.ab.ca or call 780-422-6860 (tollfree 1-888-878-4044).