PIPEDA Compliance in BC: PIPA BC and Federal Law Guide

Quick links

PIPEDA Compliance Guide CASL Compliance Guide Quebec Law 25 Guide Free compliance check

British Columbia's Personal Information Protection Act (PIPA BC) has been in force since 2004 and — like Alberta's PIPA — is deemed "substantially similar" to federal PIPEDA. BC businesses must understand which law applies to their activities and how to satisfy both.

Last updated: April 2026

Which Law Applies in BC?

PIPA BC applies to:

Private-sector organisations operating within British Columbia
Collection, use, and disclosure of personal information in provincial commercial activities
Employee information for BC-regulated employers

PIPEDA (federal) applies when:

Your business is federally regulated (banks, telecoms, airlines, broadcasting)
You conduct cross-provincial or international commercial activities
You collect data from customers in other provinces

For most BC businesses, both laws apply simultaneously to different aspects of their operations.

Enforcement: PIPA BC is enforced by the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) at oipc.bc.ca. PIPEDA is enforced by the federal OPC.

PIPA BC vs PIPEDA: Notable Differences

Feature	PIPA BC	PIPEDA
Regulator	OIPC BC	OPC Canada
Employee data	Yes — explicitly covered	Limited (federally regulated employers)
Access request deadline	30 days (PIPA's definition of "day" excludes Saturdays and holidays)	30 calendar days
Mandatory breach reporting	No mandatory breach-notification provision in the Act	Yes — real risk of significant harm
Penalties	Offence fines up to $10,000 (individuals) / $100,000 (others)	Up to $100,000 (criminal)
Orders	Commissioner can issue binding orders	Federal Court orders

Key difference from PIPEDA: Under PIPA BC, a "day" does not include a holiday or a Saturday, so BC's 30-day access request deadline effectively runs in business days (not 30 calendar days like PIPEDA). This gives BC businesses more calendar time in practice.

Key Obligations Under PIPA BC

Privacy Policy

Your BC business must have a privacy policy that:

Describes the types of personal information you collect
Explains why you collect it and how you use it
Identifies who you share it with
Explains how individuals can access their information
Provides contact information for your privacy officer

Make your policy accessible — post it on your website and provide it to individuals on request.

Consent Requirements

PIPA BC consent rules closely mirror PIPEDA:

Express consent for sensitive personal information
Implied consent acceptable in many commercial contexts
Cannot bundle consent for unrelated purposes
Withdrawal of consent must be honoured

Employee Privacy

PIPA BC explicitly covers workplace personal information, including:

Recruitment and hiring records
Performance management and disciplinary records
Payroll, benefits, and health information related to employment
Workplace monitoring (email, internet, video)

BC employers must inform employees what information is collected and why. Employees have the right to access their employment records held by their employer.

Video surveillance in the workplace: Covert surveillance is only permitted in limited investigative circumstances. If you use CCTV in your workplace, employees must be informed.

Security Safeguards and Breaches

PIPA BC requires organisations to protect personal information in their custody or under their control by making reasonable security arrangements against unauthorized access, collection, use, disclosure, copying, modification or disposal (s. 34). The Act does not currently contain a mandatory breach-notification provision. However, where your activities fall under PIPEDA, its breach reporting, notification and record-keeping requirements apply to those activities.

Privacy Impact Assessments

PIPA BC does not mandate PIAs for private sector organisations, but PIAs are best practice before implementing new programs or technologies involving personal information, and may be required by contract with government clients.

BC-Specific Considerations

Strata Corporations

Strata corporations in BC (condo corporations) are subject to PIPA BC for the personal information they collect about owners and residents. Common strata privacy issues include surveillance cameras, access to unit owner information, and sharing personal information with property management companies.

Real Estate and Property Management

BC real estate professionals handle significant amounts of personal information (SINs for mortgage applications, financial records, personal details).

Healthcare in BC

Unlike Alberta, BC does not have a separate health information act for the private sector. Health information collected by private healthcare providers (chiropractors, physiotherapists, private clinics) is governed by PIPA BC. The standard for health information is elevated — it's treated as sensitive personal information requiring express consent and robust safeguards.

Compliance Checklist for BC Businesses

Designate a Privacy Officer
Publish a PIPA BC-compliant privacy policy
Create an employee privacy notice
Audit consent mechanisms (website, intake forms, contracts)
Implement security safeguards appropriate to data sensitivity
Establish a breach response procedure
Set up access request response procedures (30 days, excluding Saturdays and holidays)
Review vendor contracts for data protection clauses
Train staff on PIPA BC basics annually

Frequently Asked Questions

Q: I'm a BC business but I also sell across Canada through my website. What law applies? A: Your BC operations fall under PIPA BC; your sales to customers in other provinces fall under PIPEDA. In practice, building a programme that satisfies both simultaneously is straightforward since the requirements are closely aligned.

Q: Does PIPA BC have a right to deletion (erasure)? A: PIPA BC doesn't have an explicit right to erasure equivalent to GDPR's, but it does require that personal information be retained only as long as necessary for the purpose of collection. You must destroy or anonymise information that is no longer needed.

Q: Does the OPC or OIPC BC investigate complaints against BC businesses? A: For purely provincial BC commercial activities, the OIPC BC has jurisdiction. For cross-provincial or federally regulated activities, the OPC steps in. Both can receive complaints; they coordinate where appropriate.

Q: Does PIPA BC apply to customer reviews? A: Reviews posted publicly are generally not considered "personal information collected by an organisation" for PIPA purposes. However, if you collect customer feedback through a form and store it, that data is subject to PIPA BC.

Manage Your BC Compliance Confidently

Canada Compliance AI helps Canadian SMEs work through CASL, PIPEDA and Quebec Law 25: a free two-minute compliance check, readiness scores, a prioritized task plan, a 24-month breach register and an exportable audit log. See what's live and what's planned.

Start your free trial today — compliance built for Canadian businesses in every province.

PIPEDA Compliance for BC Businesses: PIPA BC & Federal Law Guide