OIPC Policies

Privacy Management Program

The Commissioner performs the responsibilities set out in Alberta's access to information and privacy laws through the Office of the Information and Privacy Commissioner of Alberta (OIPC), which involves the collection, use, disclosure and retention of information.

As an officer of the Legislature, a term defined in the Protection of Privacy Act (POPA), most of the the Commissioner's information and records are excluded from the application of POPA.

For the personal information that is subject to POPA, the OIPC has published on this page the policy instruments that make up its privacy management program, as required under POPA and its associated regulations.

Policy Instruments

Information Governance Policy
Collection, Use and Disclosure of Business Information Policy
Breach and IT Security Incident Management Directive
Information Security Classification Directive
Information Risk Management Policy
Risk Assessment Directive
Information Technology Acceptable Use Directive
Secure Workspace Directive
Electronic Transmission of Information Directive
Information Security Directive
Information Privacy and Security Training and Awareness Directive

Last page update: September 2026

Disclaimer

This document is not intended as, nor is it a substitute for, legal advice, and is not binding on the Information and Privacy Commissioner of Alberta. Responsibility for compliance with the law (and any applicable professional or trade standards or requirements) remains with each organization, custodian or public body. All examples used are provided as illustrations. The official versions of the laws the OIPC oversees and their associated regulations should be consulted for the exact wording and for all purposes of interpreting and applying the legislation. The Acts are available on the website of Alberta King's Printer.