Nonprofits · Privacy
Does Alberta’s privacy law apply to your nonprofit?
Plenty of web pages tell Alberta nonprofits that privacy law covers everything they hold. The Alberta privacy commissioner’s own guidance is narrower, and more useful once you read it. This page explains the difference, then covers what’s worth doing about donor and member information whichever way your situation falls. It’s a plain-language summary, not legal advice.
Updated · By AltaSmith, Calgary
When the law applies
Alberta’s Personal Information Protection Act (PIPA) covers private-sector organizations. For non-profits, the Office of the Information and Privacy Commissioner says it applies to organizations incorporated under the Societies Act or the Agricultural Societies Act, or registered under Part 9 of the Companies Act, but only for personal information collected, used or disclosed in connection with a commercial activity.
The OIPC describes a commercial activity as any transaction, act, conduct or regular course of conduct of a commercial character. Selling tickets, running a rented facility or charging for programs are the sort of thing that means.
If something goes wrong
For information connected with a commercial activity, the OIPC’s guidance says a non-profit must notify the Commissioner of a privacy breach that meets the Act’s test, and describes what a notice has to include: what happened, what information was involved, how many people were affected, the risk of harm and what you’ve done about it. Read the current guidance before an incident, not during one.
What’s worth doing whichever way it falls
Donors and members trust you with their details, and a breach hurts that whether or not a regulator is involved. The basics:
- Multi-factor sign-in on email and file storage, so a stolen password alone isn’t enough.
- Limit who can see donor and member lists. Not everyone on the team or board needs the spreadsheet.
- Keep backups, and test restoring from them.
- Keep the admin login in the organization’s name, with more than one trusted person, so one departure doesn’t lock you out.
- Decide in advance who you would call if something went wrong, and write it down.
How we can help
We set up the practical side: email on your own domain, Microsoft 365 with sign-in protection, and the admin logins in your hands. See our nonprofits page and the Microsoft 365 for nonprofits guide. For whether and how the law applies to your organization, the OIPC or a lawyer is the right source.
Ask for a quote if you’d like help with the setup.
Common questions
Sometimes. The Alberta Office of the Information and Privacy Commissioner says the Personal Information Protection Act applies to an incorporated non-profit only for personal information connected with a commercial activity, such as selling tickets, running a facility or charging for services. Donations and membership alone may not count, so check your own situation.
The OIPC describes it as any transaction, act, conduct or regular course of conduct of a commercial character. Ticket sales, a rented hall, a thrift store or fee-based programs are the kind of thing it means. If you’re unsure, ask the OIPC or a lawyer.
For information connected with a commercial activity, the OIPC’s guidance says a non-profit has to notify the Commissioner of a breach that meets the Act’s test. Read the OIPC’s breach guidance, or ask a lawyer, before you decide a particular incident doesn’t count.
No. It’s a plain-language summary of public guidance, checked on 4 October 2026. Privacy law depends on your organization’s structure and activities, so get advice about your own situation.
Protect the information whether or not the law covers it: turn on multi-factor sign-in, limit who can see donor and member lists, keep tested backups, and decide in advance who you would call if something went wrong.
Want a straight price for your business?
Tell us what you do and we’ll reply within 1 business day with a clear number — no sales call required.