Alberta's privacy law and your AI stack, in plain English

Most Alberta business owners can tell you their fire code obligations before they can tell you their privacy ones. Fair enough: fires are vivid. But if your business handles customer information and uses AI tools, and both are near certainties, Alberta's Personal Information Protection Act already governs what you are doing. Not once you get bigger. Now.

The usual disclaimer applies: we are consultants, not lawyers, and this is orientation, not legal advice. But we build systems under this law every month, so here is the working version, minus the fog.

PIPA is Alberta's private-sector privacy law. If you collect, use, or share personal information about customers or employees in the course of business, it applies to you. Personal information means anything about an identifiable person: names, contact details, purchase history, employee records, a client's file. Which is to say, most of what flows through your operation daily.

Where AI makes this interesting is a single mechanical fact: most AI tools send data somewhere. Paste a client email into a free chatbot and that text left your building. It went to servers you do not control, under terms you have not read, likely outside Canada. Under PIPA, you are responsible for personal information you hand to a service provider. The vendor's shrug is not your defence.

This is why "we use AI carefully" and "we comply with privacy law" turn out to be the same project. A few translations from legalese to operations:

Consent and purpose, translated: use information for what you collected it for. A customer who gave you an email for invoices did not sign up to have their correspondence become training data for someone's model. When we deploy AI systems, disabling data retention and model training on business tiers is step one, not an option.

Reasonable safeguards, translated: know where the data goes and be able to prove it. This is exactly what an AI inventory produces: which tools, which data, which terms, which country. Most companies cannot produce this list today. After a governance engagement, it is a document you can hand over.

Breach obligations, translated: if information under your control ends up somewhere it should not be, and there is a real risk of harm, you have reporting duties to Alberta's privacy commissioner and possibly to the people affected. An employee pasting a client list into an unvetted free tool can qualify. This is the concrete legal edge of the shadow AI problem, and it is why "just ban it" is not a strategy: banned usage still happens, just invisibly.

Here is the reframe we push clients toward, because dread is a bad motivator: PIPA compliance is mostly just knowing your own operation. Where information lives, which tools touch it, who can see it, when it gets deleted. Every one of those answers also makes you a better-run company. And when an enterprise client eventually sends the vendor questionnaire, and they will, the privacy section is already written.

The law has been in force since 2004. The AI tools showed up without asking it for permission. Closing that gap is a few weeks of honest work, and considerably cheaper than being the case study.