Privacy law changes for Alberta public bodies

From FOIP to two new acts

For many years, Alberta public bodies worked under the Freedom of Information and Protection of Privacy Act, known as FOIP. In 2025 the province replaced it with two separate statutes. The Access to Information Act deals with requests for records, while the Protection of Privacy Act deals with how public bodies collect, use, disclose and protect personal information.

For IT teams and the managers who oversee them, the privacy statute matters most day to day. It sets expectations for safeguarding personal information and includes requirements for responding to privacy breaches. Policies, training material and vendor contracts that still refer to FOIP should be updated so staff are working from current terminology and rules.

Breach notification and security

The Protection of Privacy Act includes mandatory breach notification requirements, which means public bodies need a reliable way to detect, assess and report incidents involving personal information. That depends on IT basics such as centralized logging, clear ownership of systems and a documented incident response process that names who makes the notification decision.

Reasonable security for a public body is not a single product. It is a combination of controls applied consistently across offices, recreation facilities, field staff and elected officials, who often use personal devices or separate email accounts that fall outside normal IT management. Bringing these groups into the same managed environment is often the single most valuable step a smaller public body can take.

• Multi-factor authentication for all staff and council or board members
• Managed devices for anyone handling personal information
• Central log collection with enough retention to investigate
• A named privacy lead and a written incident response plan

Records, access requests and IT

Access requests under the Access to Information Act depend on being able to find records. When information is scattered across personal inboxes, text messages and unmanaged file shares, responding accurately and on time becomes difficult. Good records management is therefore an IT design question as much as a policy question.

Consider consolidating files into a managed platform with consistent folder structures, retention labels and search capability. Make sure you can place records on hold when a request or legal matter requires it, and that departing staff accounts are preserved rather than deleted until records have been reviewed. These steps also reduce the cost and stress of large or complex requests.

Vendors and cloud services

Public bodies rely heavily on software vendors for permitting, payroll, recreation booking and utility billing. Each contract should address where personal information is stored, how it is protected, how breaches will be reported to you and what happens to the data when the contract ends. Review older contracts that were signed before the new legislation took effect.

Where privacy impact assessments are part of your process, use them for new systems and major changes. They help surface questions about data location, access and retention before a system is in production, when changes are still inexpensive. Even where an assessment is not formally required, working through the same questions for a new system is a low-cost way to catch privacy and security gaps before they become incidents.

Where to go for guidance

The Office of the Information and Privacy Commissioner of Alberta and the Government of Alberta both publish guidance on the new legislation. Your municipal association or school authority network may also share templates and lessons learned. Because the law is still relatively new, interpretations will continue to develop. Check these sources periodically for updates.

Your legal counsel should confirm how specific provisions apply to your organization. Your IT provider's role is to make sure the systems underneath your policies can actually support them, from logging and access control to retention and secure disposal. When IT and legal work from the same understanding, policies are far more likely to hold up when they are tested by a real request or incident.