OIPC Policies

Privacy Management Program

Through the OIPC, the Information and Privacy Commissioner collects information to fulfill its mandate under the laws it oversees.

As an Officer of the Legislature - as that term is defined under the Protection of Privacy Act (POPA) - certain information and records of the Commissioner are excluded from the application of POPA.

For the personal information that is subject to POPA, the OIPC has published on this page the policy instruments that make up its privacy management program, as per the requirements under POPA and associated regulations.

Policy Instruments

Information Governance Policy
Collection, Use and Disclosure of Business Information Policy
Breach and IT Security Incident Management Directive
Information Security Classification Directive
Information Risk Management Policy
Risk Assessment Directive
Information Technology Acceptable Use Directive
Secure Workspace Directive
Electronic Transmission of Information Directive
Information Security Directive
Information Privacy and Security Training and Awareness Directive

Last page update: September 2026

Disclaimer

This document is not intended as, nor is it a substitute for, legal advice, and is not binding on the Information and Privacy Commissioner of Alberta. Responsibility for compliance with the law (and any applicable professional or trade standards or requirements) remains with each organization, custodian or public body. All examples used are provided as illustrations. The official versions of the laws the OIPC oversees and their associated regulations should be consulted for the exact wording and for all purposes of interpreting and applying the legislation. The Acts are available on the website of Alberta King's Printer.