New resources will also be a useful reference for other jurisdictions.
The Office of the Information and Privacy Commissioner (OIPC) of Alberta has launched a Privacy Impact Assessment (PIA) Template and a PIA Completion Guide that align with the current requirements of the Protection of Privacy Act (POPA) and its regulations, which came into effect in 2025.
The completion of PIAs by public bodies is mandatory under POPA in certain circumstances. Some of these PIAs must be submitted to the Commissioner for review and comment. The purpose of a review by the OIPC is to assess whether the public body has adequately turned its attention to its compliance obligations under POPA and will, as represented in the PIA, be compliant with POPA when implementing the project.
The template and guide will assist public bodies in completing privacy impact assessments under POPA and help ensure that any PIAs submitted to the OIPC for review and comment contain the information necessary for our review. Any public body that is required to submit a PIA to the OIPC under POPA must use the template.
The two documents are now available on the OIPC website.
“We developed the template and guide specifically to assist public bodies in Alberta,” said Information and Privacy Commissioner Diane McLeod. “However, at recent events that I have attended across Canada, in speaking about our launch of these resources, I have been approached by others looking to leverage these resources for completing PIAs in their respective jurisdictions. While this template was designed specifically to align with POPA, it contains basic PIA requirements and will also be a useful reference for those in the field of privacy responsible for completing PIAs, regardless of location.”
This set of PIA resources is the first of three to be issued by the OIPC. Once Alberta’s health information law and private sector privacy law are amended and the amendments proclaimed in force, the OIPC will create similar resources for use by custodians and organizations to meet PIA requirements under those laws.
A Notice to Public Bodies has been published on the News and Events page of the OIPC website, describing the template and guide. From there, public bodies can link to the template and guide. They may also access the tools via the Resources page of the website, or by clicking on the Submit A Privacy Impact Assessment link on the website’s home page.
The completion guide will help public bodies in filling out the template. The guide aligns with the template on a question-by-question basis and provides additional context, a description of and what is expected of each question.
The template and guide will be updated from time to time as additional guidance becomes available, based on feedback from public bodies, or when otherwise necessary.
“We welcome feedback from public bodies regarding their experiences using the template and guide,” added McLeod. “We will take any suggestions or comments into consideration when making changes. Public bodies may provide feedback when they submit their PIAs and in addition, we will host an online engagement forum after the PIA template has been in use for some time, so that public bodies may share their experiences with the template and provide feedback and suggestions.”
Through the OIPC, the Information and Privacy Commissioner performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act. The Commissioner operates independently of government.
For more information:
Elaine Schiman
Communications Manager
Office of the Information and Privacy Commissioner of Alberta
communications@oipc.ab.ca
Mobile: (587) 983-8766