What does Alberta's PIPA ask a business to do after a breach?

Who does this apply to?

The Act applies to every organization and all personal information, except where the Act or its regulations say otherwise. Section 34 says an organization must make reasonable security arrangements to protect the personal information it holds or controls.

Except as provided in this Act and subject to the regulations, this Act applies to every organization and in respect of all personal information.

An organization must protect personal information that is in its custody or under its control by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction.

When must a breach be reported?

When personal information is lost, accessed without authority or disclosed without authority. The test is whether a reasonable person would consider that there is a real risk of significant harm to an individual.

Commissioner of any incident involving the loss of or unauthorized access to or disclosure of the personal information where a reasonable person would consider that there exists a real risk of significant harm to an individual as a result of the loss or unauthorized access or disclosure.

Who must be told?

The Act says the organization notifies the Information and Privacy Commissioner. The Commissioner may then direct the organization to notify the individuals who face a real risk of significant harm, in the form the regulations set and within a time the Commissioner decides.

Where an organization suffers a loss of or unauthorized access to or disclosure of personal information that the organization is required to provide notice of under section 34.1, the Commissioner may require the organization to notify individuals to whom there is a real risk of significant harm as a result of the loss or unauthorized access or disclosure

How fast?

The Act's words are "without unreasonable delay". It gives no fixed number of days.

An organization having personal information under its control must, without unreasonable delay, provide notice to the

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.