Alberta
Alberta: Protection of Privacy Act and Health Information Act
Applies to: Public bodies (POPA); health custodians such as physicians, clinics and Alberta Health Services (HIA).
The Protection of Privacy Act came into force on 2025-06-11, replacing FOIP's privacy rules. It has no data-residency requirement. Public bodies need a privacy management program (by 2026-06-11) and a privacy impact assessment in circumstances set by regulation.
The Health Information Act has no residency requirement either. A custodian must prepare a privacy impact assessment and submit it to the Information and Privacy Commissioner before introducing or changing an information system that handles individually identifying health information (s. 64). The 2025 amendments add PIAs for custodians joining shared health records.
What to check in a listing
- Every fact in a listing is something the PIA will ask: storage, processing, support access, ownership, subprocessors.
The law and the regulator
- Protection of Privacy Act (SA 2024, c. P-28.5), consolidated to 2025-12-11 · checked 2026-10-13
- Health Information Act (RSA 2000, c. H-5), consolidated to 2026-07-02 · checked 2026-10-13
A summary, not legal advice. Laws change; report a correction.