Data protection

How BC law treats it

The Personal Information Protection Act, SBC 2003, c 63 (PIPA) applies to private sector organizations in BC, including businesses, non-profits and their handling of employee information. Because PIPA is declared substantially similar to the federal law, PIPEDA does not apply to personal information collected, used or disclosed within BC by provincially regulated organizations. PIPEDA applies to federal works and undertakings, such as banks, airlines and telecoms, and to personal information that crosses provincial or national borders in commercial activity. PIPA requires consent for collection, use and disclosure, limited to what a reasonable person would consider appropriate, subject to listed exceptions. Employers may collect, use and disclose employee personal information without consent where it is reasonable to establish, manage or end the employment relationship, but must give notice (ss. 13, 16 and 19). Organizations must make reasonable security arrangements (s. 34), keep information only as long as needed, and destroy or anonymize it after that. Individuals have a right of access to their information (s. 23) and a right to request correction (s. 24). PIPA has no general GDPR style right to erasure. PIPA has no mandatory breach notification for private organizations as of October 2026, although PIPEDA s. 10.1 requires reporting for organizations it covers. Complaints go to the Office of the Information and Privacy Commissioner for BC, which can investigate and make binding orders. BC's Privacy Act, RSBC 1996, c 373 also makes wilful violation of privacy a tort. The EU GDPR can apply to a BC business that offers goods or services to people in the EU or monitors them.

What it means for your business

Every BC business holds customer, employee or supplier data. A clear privacy policy, sensible consents, limited collection, reasonable security and a breach response plan reduce complaint and lawsuit risk and build customer trust. Getting the PIPA versus PIPEDA question right matters when the business moves data across borders, uses US cloud providers or sells to customers in other provinces or the EU. Example: A Vancouver e-commerce retailer stores customer data with a US cloud provider. It updates its privacy policy to say data is stored outside Canada, limits staff access, and sets a schedule for deleting old order records.

Risks and common mistakes

Assuming PIPEDA governs a provincially regulated BC business's local data handling. Promising customers a GDPR style right to deletion the business has not planned for. Collecting more employee or customer information than is reasonable for the purpose. Keeping personal information indefinitely with no retention or destruction schedule. Having no breach response plan because PIPA does not yet require notification.