British Columbia, Canada

CA-BC schema gdpri-v2 trajectory: not yet assessedregulated (omnibus)overlaps: AIC

Last updated 2026-09-28 · 10 categories · 34 claims · 30 sources in the cumulative register

10Categoriesbaseline.[]

57Sub-modulesbaseline..sub_modules{}

34Claimsbaseline..claims[]

14Tier-1 sourcesrun_metadata.t1_source_count

Traffic-light mix (sums to 10 rendered categories; click to filter)

No red categories; 15 sub-modules are flagged red.

Jurisdiction brief

Latest update · 28 September 2026

Lead Signal

British Columbia's data-protection landscape moved on two statutory tracks this cycle, with the public-sector framework advancing while the private-sector framework stayed still under mounting regulatory pressure. Bill 9, the Freedom of Information and Protection of Privacy Amendment Act, 2026, was introduced in the BC Legislature on 26 February 2026 and would grant the Office of the Information and Privacy Commissioner for British Columbia authority to enter collaboration and information-sharing agreements with other Canadian regulators. Separately, and more consequentially for the private sector, the OIPC's joint investigation with the federal Office of the Privacy Commissioner found that the Personal Information Protection Act does not enable OpenAI to establish implicit consent for its personal-information processing, with the Commissioner stating that PIPA's consent provisions are no longer well suited to AI-driven data processing.

Other Developments

Access-request rules are tightening for public bodies. Bill 9 would change the Freedom of Information and Protection of Privacy Act duty to respond to access requests from without delay to without unreasonable delay, and would require requesters to provide enough detail for an experienced employee to identify the record within a reasonable time. This is understood to be a public-sector-only change; PIPA, the private-sector statute, is not affected. Surveillance guidance was refreshed for public bodies. The OIPC is reported to have released updated Public Sector Surveillance Guidelines in January 2026, replacing guidelines dating to 2014, applicable to ministries, local governments, schools, Crown corporations, hospitals, and municipal police forces subject to FIPPA. The regulator's enforcement toolkit remains limited. The OIPC does not currently hold administrative-monetary-penalty power under PIPA and has recommended such power be added, modelled on section 17.1 of the federal Personal Information Protection and Electronic Documents Act; this recommendation remains unenacted as of this cycle. A platform breach is under watch. The OIPC is reported to be monitoring a privacy breach involving the Canvas platform and urging prompt breach reporting by public and private bodies, though this is sourced only via a third-party jurisdiction tracker and has not been independently confirmed against an OIPC primary release this pass.

Cross-Monitor Connections

The OIPC's joint investigation into OpenAI's personal-information processing sits adjacent to the artificial-intelligence monitor's coverage of the same AI system's data practices; readers tracking algorithmic governance developments should also consult that monitor's treatment of the underlying AI system. No financial-integrity, world-payments, advennt, or crypto overlap was evidenced in this cycle's British Columbia data-protection findings.

Outlook

The gap between British Columbia's public-sector and private-sector privacy frameworks is widening rather than closing: FIPPA is moving through Bill 9 while PIPA remains statutorily static despite the OIPC's own finding that its consent framework is no longer well suited to AI-driven processing. Whether that finding translates into a legislative reform proposal for PIPA itself, and whether the OIPC's standing recommendation for administrative-monetary-penalty power is taken up, are the two developments most likely to reshape the province's enforcement and consent architecture going forward.

2 earlier updates not shown here.

Standing brief · as of 26 August 2026

Written before the update above. Where they differ, the update is the more recent position.

Lead Signal

The Office of the Information and Privacy Commissioner for British Columbia (OIPC) operates independently from government, with a mandate to promote and protect the information and privacy rights of British Columbians; against that standing institutional backdrop, this cycle's developments cluster unusually heavily around algorithmic and biometric governance and around the enforcement and redress consequences that follow from it. British Columbia's data-protection posture recorded a period of active regulatory movement this cycle, anchored by the BC Court of Appeal's dismissal, on 2026-02-18, of Clearview AI's appeal against the OIPC's finding that Clearview contravened the Personal Information Protection Act (PIPA) by collecting and using BC residents' personal information from online sources without consent. The appellate court confirmed that PIPA applies to Clearview and does not exempt it from the consent requirement it was found to have contravened, a confirmation of PIPA's extraterritorial reach that carries High confidence, though it is sourced this cycle to Tier-3 law-firm commentary rather than the primary judgment, which was not independently retrieved from CanLII this cycle. The Clearview AI outcome doubles as this cycle's leading enforcement and redress development: the appellate loss confirms both the underlying PIPA-contravention finding and the BC-market prohibition the OIPC imposed, giving British Columbia's enforcement track record its most significant test of extraterritorial reach in this period. Separately, Bill 9, the Freedom of Information and Protection of Privacy Amendment Act, 2026, was introduced on 2026-02-26, amending the public-sector Freedom of Information and Protection of Privacy Act (FIPPA) to tighten the specificity a requester must provide in an access request, to change the response-timeline standard from "without delay" to "without unreasonable delay," and to grant the OIPC new authority to enter inter-regulator information-sharing agreements. For public-body-covered access requesters, the shift from an unqualified "without delay" standard to a more qualified "without unreasonable delay" standard, paired with tightened specificity requirements for what a request must contain, together represent a data-subject-rights change that skews toward administrative flexibility for public bodies rather than expanded requester protection. Bill 9 is a public-sector-only instrument; no corresponding PIPA private-sector amendment was identified this cycle.

Other Developments

OIPC signals PIPA is not fit for AI-driven consent. In a letter dated 2026-05-05, the OIPC stated that PIPA's consent provisions are no longer well suited to AI-driven data processing. A joint OIPC/OPC investigation found that PIPA does not enable OpenAI to establish implicit consent, and the Commissioner urged the legislature to advance its statutory review of PIPA. This is High-confidence guidance rather than binding instrument, understood as advocacy for legislative reform rather than a change in force.

OIPC publishes audit and compliance-review guidance. On 2026-03-23, the OIPC published guidance on its audit, investigation, and compliance-review authority, intended to help both public bodies and private-sector organizations understand the OIPC's function in these processes. This is non-binding guidance, sourced this cycle to Tier-3 commentary.

Updated Public Sector Surveillance Guidelines. In January 2026, the OIPC released updated Public Sector Surveillance Guidelines, replacing 2014 guidance and applicable to all FIPPA-covered public bodies, requiring a privacy impact assessment under FIPPA section 69(5.3) before implementing new surveillance initiatives. This is non-binding guidance sourced to Tier-3 commentary this cycle.

Cross-Monitor Connections

The OIPC's position that PIPA's consent framework is not fit for AI-driven processing, and the underlying joint investigation finding that PIPA does not enable OpenAI to establish implicit consent, is directly relevant to the artificial-intelligence monitor's tracking of AI-governance regulatory response; that analysis is not duplicated here. Clearview AI's continued facial-recognition prohibition in British Columbia, upheld on appeal, is similarly relevant to the artificial-intelligence monitor's biometric-governance tracking. Neither connection is analysed further in this brief.

Outlook

Two open questions define the near-term horizon. First, whether British Columbia's statutory six-year review of PIPA has a scheduled 2026 or 2027 date was not confirmed this cycle; the OIPC's public urging for legislative advancement of that review, set against the OpenAI investigation findings, suggests momentum but no confirmed timeline. Second, whether Bill 9 passes in its introduced form, and whether any future amendment extends beyond FIPPA into PIPA's private-sector consent framework, remains to be seen. Retrieving the primary Clearview AI appellate judgment from CanLII, rather than relying on secondary commentary, would also sharpen the evidentiary basis for that finding in a future cycle.

trust tier: ai_unverified

Latest update · 14 September 2026

Regulatory Status

British Columbia's data protection landscape this cycle is defined by active enforcement and litigation outpacing stalled statutory reform. The Court of Appeal for British Columbia dismissed Clearview AI's appeal, confirming PIPA's application to the company and its lack of exemption from consent requirements for online-sourced personal information. The OIPC, jointly with the federal OPC, found that PIPA does not enable OpenAI to establish implicit consent for its data-processing practices, even where OpenAI's steps were understood to satisfy the federal implied-consent standard, prompting renewed OIPC calls for PIPA reform. OIPC BC also released updated Public Sector Surveillance Guidelines in January 2026, replacing 2014 guidance, for all FIPPA-covered public bodies. Meanwhile, Bill 9 advances FIPPA amendments for the public sector, but private-sector PIPA itself remains formally unreformed.

10 of 10 categories

Signal

Density

Selections OR within a group, AND across groups. Press / to search.

#

Comprehensive, actively-enforced private-sector statute with a functioning independent regulator and confirmed federal 'substantially similar' status; recent joint enforcement (OpenAI, TikTok) demonstrates active jurisdiction.

Primary frameworkPersonal Information Protection Act (PIPA), SBC 2003, c. 63

Supervisory authorityOffice of the Information and Privacy Commissioner for British Columbia (OIPC BC)

Traffic-light rationale — GreenComprehensive, actively-enforced private-sector statute with a functioning independent regulator and confirmed federal 'substantially similar' status; recent joint enforcement (OpenAI, TikTok) demonstrates active jurisdiction.

Sub-modules (5)

Regulator And AuthorityGreen

OIPC BC, led by Commissioner Michael Harvey as of May 2026, oversees PIPA (private sector), FIPPA (public sector), and the E-Health Act (health records).

Claims (2):

The Information and Privacy Commissioner for British Columbia is responsible for overseeing and enforcing PIPA, FIPPA, and the E-Health Act.
Michael Harvey serves as the Information and Privacy Commissioner for British Columbia as of the May 2026 joint ChatGPT investigation announcement.

Act And InstrumentsGreen

PIPA (SBC 2003, c. 63) is the operative private-sector instrument; FIPPA (RSBC 1996, c. 165) governs public bodies; the E-Health Act governs health-information custodians.

Claims (1):

PIPA is BC's private-sector privacy law, and has been deemed 'substantially similar' to the federal PIPEDA, while FIPPA is BC's public-sector privacy law and the E-Health Act governs health records.

Material ScopeGreen

PIPA applies to the collection, use and disclosure of personal information by private-sector organizations, including employee personal information, subject to statutory exclusions.

Claims (1):

Employee personal information held by provincially-regulated organizations in British Columbia is covered by PIPA, unlike PIPEDA which excludes employee information for non-FWUB organizations.

Territorial ScopeGreen

PIPA applies to organizations' activity within BC; a real-and-substantial-connection test extends jurisdiction to non-established foreign controllers, as confirmed in the OpenAI and TikTok joint investigations.

Claims (2):

Exemption Order SOR/2004-220, issued under PIPEDA, exempts organizations from Part 1 of PIPEDA for collection, use, or disclosure of personal information occurring within British Columbia, making PIPA the operative statute for BC-internal activity even for organizations without physical presence in Canada.
The OIPC-BC and the BC Court of Appeal have confirmed that PIPA's jurisdiction extends to foreign organizations with a real and substantial connection to British Columbia, notwithstanding lack of establishment or employees in Canada prior to product launch.

Regulator Registration And FilingAmber

PIPA does not impose a general controller registration or filing requirement on organizations.

Absence provenance: unavailable. Searched: BC PIPA registration filing requirement OIPC.

Category narrative117 words

British Columbia's private-sector data protection regime is anchored in the Personal Information Protection Act (PIPA), SBC 2003, c. 63, overseen by the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC), currently led by Commissioner Michael Harvey. PIPA has been declared substantially similar to the federal PIPEDA, which carves BC-internal commercial/organizational personal-information handling out of PIPEDA's Part 1 via Exemption Order SOR/2004-220, while PIPEDA continues to govern interprovincial/international commercial transactions and federally-regulated works and undertakings (FWUBs). The OIPC BC also oversees the public-sector Freedom of Information and Protection of Privacy Act (FIPPA), RSBC 1996, c. 165, and the health-sector E-Health (Personal Health Information Access and Protection of Privacy) Act, giving it a tri-regime portfolio.

Periodic update · new data 2026-09-28

Regulator & Framework

The Office of the Information and Privacy Commissioner for British Columbia administers both the private-sector Personal Information Protection Act and the public-sector Freedom of Information and Protection of Privacy Act, a dual-statute authority structure that continues to define the province's regulatory architecture. This cycle's principal development sits on the public-sector side: Bill 9, the Freedom of Information and Protection of Privacy Amendment Act, 2026, was introduced in the BC Legislature on 26 February 2026. The Bill would grant the OIPC authority to enter collaboration and information-sharing agreements with other Canadian regulators, extending the Commissioner's capacity to coordinate with counterpart bodies elsewhere in Canada.

This is a public-sector FIPPA amendment; the private-sector PIPA statute is not affected by Bill 9 and remains in its existing form. The Bill has not been enacted; it has been introduced and remains before the Legislature, so the collaboration-agreement authority is not yet in force.

Outlook

Whether and when Bill 9 proceeds to enactment will determine when the OIPC's expanded collaboration authority takes effect. The wider question left open by this cycle is whether the dual-statute structure itself, with FIPPA advancing while PIPA remains static, will be addressed as a single reform package or continue to develop on separate legislative timelines.

2 earlier distinct update(s)

Periodic update · new data 2026-09-22

Regulator & Framework

The Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) provides independent oversight and enforcement of the province's Freedom of Information and Protection of Privacy Act (FIPPA), the Personal Information Protection Act (PIPA), and the E-Health Act. This cycle's structural development is Bill 9, the Freedom of Information and Protection of Privacy Amendment Act 2026, which amends FIPPA — the public-sector statute — but leaves PIPA, the private-sector law, unamended. As of mid-2026, no reform bill for PIPA had been announced, despite mounting pressure from the Commissioner's office following its findings on AI-related consent gaps.

This asymmetry is the key structural fact for the framework this cycle: public-sector information and privacy law is actively being modernised through Bill 9, while private-sector privacy law remains on its existing statutory footing even as the Commissioner has publicly signalled that its consent provisions are strained by contemporary data-driven processing, particularly involving AI. The regulator's dual public/private mandate under FIPPA and PIPA respectively means these two tracks can and do move at different speeds, and this cycle illustrates exactly that divergence.

Outlook

Watch for whether the pressure generated by the OIPC/OPC OpenAI investigation translates into a formal PIPA reform bill, distinct from and following the FIPPA-focused Bill 9 track, which is understood to be progressing separately.

Periodic update · new data 2026-09-14

Regulator & Framework

The Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) remains independent from government and enforces both the Personal Information Protection Act (PIPA), which governs the private sector, and the Freedom of Information and Protection of Privacy Act (FIPPA), which governs public bodies. This cycle produced two material developments in the framework itself. First, Bill 9, the Freedom of Information and Protection of Privacy Amendment Act, 2026, was introduced in the BC Legislature on February 26, 2026, amending FIPPA. Second, and by contrast, private-sector PIPA has not been amended, and no PIPA reform bill has been announced as of this cycle, despite ongoing OIPC advocacy for statutory review of the private-sector regime.

The Court of Appeal for British Columbia's dismissal of Clearview AI's appeal is a significant framework-level development in its own right: the court confirmed that PIPA applies to Clearview and that the statute does not exempt the company from obtaining consent to collect personal information from online sources. This is an appellate-level confirmation of PIPA's extraterritorial and biometric-data reach, strengthening the practical scope of the statute even as the underlying legislative text remains unreformed.

The asymmetry between active public-sector reform and stalled private-sector reform is the framework-level story of this cycle: BC's regulator and courts are extending PIPA's practical reach through enforcement and litigation even as the legislature has not yet moved to modernise the statute's text for AI-era data practices.

Outlook

Watch for whether Bill 9 receives royal assent, and whether the OIPC's renewed advocacy — prompted by the OpenAI investigation findings — results in an announced PIPA reform bill. The gap between public-sector legislative movement and private-sector statutory stasis is likely to remain the defining framework tension into the next cycle.

Sources and claims (6)

ConfirmedOPC Canada — The Information and Privacy Commissioner for British Columbia is responsible for overseeing and enforcing PIPA, FIPPA, and the E-Health Act.observed 2026-08-05
ConfirmedOPC Canada — Michael Harvey serves as the Information and Privacy Commissioner for British Columbia as of the May 2026 joint ChatGPT investigation announcement.observed 2026-08-05
ConfirmedOPC Canada — PIPA is BC's private-sector privacy law, and has been deemed 'substantially similar' to the federal PIPEDA, while FIPPA is BC's public-sector privacy law and the E-Health Act governs health records.observed 2026-08-05
ConfirmedOPC Canada — Employee personal information held by provincially-regulated organizations in British Columbia is covered by PIPA, unlike PIPEDA which excludes employee information for non-FWUB organizations.observed 2026-08-05
ConfirmedOPC Canada / OIPC BC / OIPC AB / CAI — Exemption Order SOR/2004-220, issued under PIPEDA, exempts organizations from Part 1 of PIPEDA for collection, use, or disclosure of personal information occurring within British Columbia, making PIPA the operative statute for BC-internal activity even for organizations without physical presence in Canada.observed 2026-08-05
ConfirmedOPC Canada / OIPC BC / OIPC AB / CAI — The OIPC-BC and the BC Court of Appeal have confirmed that PIPA's jurisdiction extends to foreign organizations with a real and substantial connection to British Columbia, notwithstanding lack of establishment or employees in Canada prior to product launch.observed 2026-08-05

#

Core consent architecture is robust and enforced, but the absence of a codified sensitive-data category and of anonymisation safe-harbours leaves gaps relative to GDPR-style regimes.

Primary frameworkPersonal Information Protection Act (PIPA), SBC 2003, c. 63

Supervisory authorityOffice of the Information and Privacy Commissioner for British Columbia (OIPC BC)

Traffic-light rationale — AmberCore consent architecture is robust and enforced, but the absence of a codified sensitive-data category and of anonymisation safe-harbours leaves gaps relative to GDPR-style regimes.

Sub-modules (4)

Lawful BasesGreen

Consent is the primary lawful basis under ss. 6-8 of PIPA, subject to enumerated exceptions; collection/use/disclosure must additionally satisfy the 'reasonable purpose' test.

Claims (2):

Sections 6-8 of PIPA-BC require the consent of individuals for the collection, use or disclosure of their personal information, unless an exception applies.
An organization may collect, use or disclose personal information under PIPA only for a purpose that a reasonable person would consider appropriate in the circumstances, per sections 11 and 14.

Special CategoriesAmber

PIPA has no express statutory 'special category' list, but biometric/facial-recognition data has been found by joint regulatory investigations to be sensitive in almost all circumstances, generally triggering an express-consent requirement.

Claims (1):

Joint regulatory investigations (Clearview AI, Cadillac Fairview) found biometric information to be sensitive in almost all circumstances, being intrinsically and often permanently linked to an individual, distinctive and difficult to change.

Pseudonymisation And AnonymisationRed

No statutory definitions or safe-harbour provisions for pseudonymisation or anonymisation exist under PIPA.

Absence provenance: unavailable. Searched: BC PIPA pseudonymisation anonymisation definition safe harbour.

Category narrative72 words

PIPA operates on a consent-based model (ss. 6-8) coupled with a 'reasonable purpose' appropriateness test (ss. 11 and 14) that must be satisfied regardless of consent. There is no GDPR Art 9-style enumerated special-category list on the face of the statute, but joint OPC/OIPC-BC/OIPC-AB guidance and case law (Clearview AI, Cadillac Fairview) treat biometric information as inherently sensitive, generally requiring express consent. PIPA contains no statutory definitions of pseudonymisation or anonymisation safe-harbours.

Periodic update · new data 2026-09-28

Lawful Processing & Special Data

The OIPC's joint investigation with the federal Office of the Privacy Commissioner into OpenAI's personal-information processing produced this cycle's most consequential lawful-processing finding: PIPA does not enable OpenAI to establish implicit consent for its processing of personal information, and the Commissioner stated that PIPA's consent provisions are no longer well suited to AI-driven data processing. This is a live regulatory finding directly implicating the statutory consent basis under which private-sector organisations in British Columbia operate.

The finding is significant because it identifies a structural mismatch between PIPA's existing consent framework, built around traditional notice-and-consent mechanics, and the scale and opacity of AI-driven processing. The Commissioner's own investigation report and any remedial order arising from it have not been independently confirmed beyond the Commissioner's letter, so the practical consequences for OpenAI's BC-facing operations, and for other AI processors relying on similar consent theories, remain to be seen.

Outlook

The OIPC's finding creates pressure for legislative attention to PIPA's consent provisions, though no reform proposal specific to consent has yet been introduced; Bill 9 addresses only the public-sector FIPPA. Whether the OpenAI investigation results in a formal order, and whether it prompts a parallel private-sector reform push, are the developments most likely to determine how this finding translates into binding obligations.

2 earlier distinct update(s)

Periodic update · new data 2026-09-22

Lawful Processing & Special Data

A joint investigation by OIPC BC and the federal Office of the Privacy Commissioner (OPC) into OpenAI, with findings published in May 2026, found that PIPA does not enable OpenAI to establish implicit consent for its processing of personal information. The Commissioner stated directly that PIPA's consent provisions are no longer well suited to today's data-driven world. This is a Confirmed finding, sourced from the regulator's own public comments, and it is the most consequential lawful-processing development for British Columbia this cycle.

The finding matters because PIPA's consent framework is fundamentally implicit-consent-permissive in structure, and the investigation concluded that societal expectations about AI and the organisational risk-mitigation steps involved have moved outside the scope that PIPA's current consent provisions can reasonably accommodate. This is not a finding limited to OpenAI specifically — it identifies a structural feature of the statute itself, one that the Commissioner has flagged as a candidate for reform. No change to the statute has yet occurred; the finding stands as an authoritative regulatory assessment of the existing law's limits, not a legislative amendment.

Outlook

The practical question for organisations relying on implicit consent for AI-adjacent processing in British Columbia is whether this finding will be treated as persuasive guidance ahead of any statutory change, and whether the Commissioner's advocacy for an accelerated PIPA review translates into a formal reform timeline.

Periodic update · new data 2026-09-14

Lawful Processing & Special Data

A joint investigation by OIPC BC and the federal Office of the Privacy Commissioner found that PIPA does not enable OpenAI to establish implicit consent for its data-processing practices. Notably, this finding held even in circumstances where OpenAI's actions were understood to be sufficient to satisfy the federal OPC's own implied-consent standard under PIPEDA, indicating that BC's PIPA applies a more exacting consent threshold than the federal private-sector standard in at least this instance.

This is a Confirmed, Tier-1-sourced finding directly from the regulator's own joint investigation report, and it is material: it establishes, for a globally significant AI company, that BC's consent framework does not automatically defer to whatever a federal-standard analysis would permit. The finding functions as a de facto precedent for how PIPA's consent provisions apply to large-scale AI training and data-processing operations, even though the underlying statute has not been formally amended to address AI-specific processing.

Outlook

The key open question is what remedial or compliance steps, if any, OpenAI must take in response to the joint investigation's findings, and whether other AI companies operating in or processing BC residents' data face similar scrutiny under the same implicit-consent reasoning. This finding is also the direct trigger for the OIPC's renewed calls for statutory PIPA reform addressing AI-era consent standards.

Sources and claims (4)

ConfirmedOPC Canada / OIPC BC / OIPC AB / CAI — Sections 6-8 of PIPA-BC require the consent of individuals for the collection, use or disclosure of their personal information, unless an exception applies.observed 2026-08-05
ConfirmedOPC Canada / OIPC BC / OIPC AB / CAI — An organization may collect, use or disclose personal information under PIPA only for a purpose that a reasonable person would consider appropriate in the circumstances, per sections 11 and 14.observed 2026-08-05
ConfirmedOPC Canada / OIPC BC / OIPC AB / CAI — Joint guidelines issued by OPC, OIPC-AB and OIPC-BC provide that organizations must generally obtain express consent when information is sensitive, collection/use/disclosure is outside reasonable expectations, or creates a meaningful residual risk of significant harm.observed 2026-08-05
ConfirmedOPC Canada / OIPC AB / OIPC BC — Joint regulatory investigations (Clearview AI, Cadillac Fairview) found biometric information to be sensitive in almost all circumstances, being intrinsically and often permanently linked to an individual, distinctive and difficult to change.observed 2026-08-05

#

Core access/correction rights are in force and enforced, but PIPA lacks GDPR-equivalent erasure, restriction/objection, and portability rights, which remain at the recommendation stage only.

Primary frameworkPersonal Information Protection Act (PIPA), SBC 2003, c. 63

Supervisory authorityOffice of the Information and Privacy Commissioner for British Columbia (OIPC BC)

Traffic-light rationale — AmberCore access/correction rights are in force and enforced, but PIPA lacks GDPR-equivalent erasure, restriction/objection, and portability rights, which remain at the recommendation stage only.

Sub-modules (5)

Access RightGreen

Individuals may request access to personal information about them held by an organization, subject to enumerated exceptions.

Claims (1):

Individuals have a right to know the details of unauthorized access of their personal information and, more broadly, a right to access personal information held about them by an organization subject to statutory exceptions.

Rectification And ErasureAmber

PIPA provides a correction right for inaccurate/incomplete information; a standalone erasure/'right to be forgotten' is not currently codified and was flagged by the OIPC as a reform priority going further than the federal C-11 proposal.

Claims (1):

The OIPC BC's PIPA-reform recommendations included a 'Right to be Forgotten' proposal on which the federal OPC stated it would go further than the BC recommendation.

Restriction And ObjectionRed

PIPA does not contain a general statutory right to restrict processing or object to processing/profiling; automated-decision-making transparency was among the OIPC's 12 reform recommendations, not yet enacted.

Claims (1):

Automated decision-making transparency was among the 12 recommendations made by the OIPC BC for PIPA reform, indicating it is not currently a codified right under PIPA.

Data PortabilityRed

PIPA does not currently include a data-portability right; portability was one of the OIPC's 12 PIPA-reform recommendations.

Claims (1):

Data portability was among the 12 recommendations made by the OIPC BC for PIPA reform, confirming it is not a currently codified statutory right.

Deadlines And Response WindowsAmber

PIPA requires organizations to respond to access requests within a defined statutory window; exact day-count was not independently re-verified against the current consolidated statute text in this research pass.

Absence provenance: unavailable. Searched: BC PIPA access request response deadline days section.

Category narrative75 words

PIPA provides individuals a right of access to their own personal information held by an organization and a right to request correction of inaccurate or incomplete information. PIPA does not currently contain an explicit right to erasure/be-forgotten, a general right to restrict or object to processing, or a data-portability right; the BC Special Committee's December 2021 reform report recommended adding several of these rights, but as of this run they remain proposed rather than enacted.

Periodic update · new data 2026-09-28

Data Subject Rights

Bill 9 is understood to change the Freedom of Information and Protection of Privacy Act's duty to respond to access requests from a duty to respond without delay to a duty to respond without unreasonable delay. The Bill is also understood to require that access requests provide enough detail for an experienced employee of the public body to identify the record being sought within a reasonable time. Both changes apply to the public-sector FIPPA regime only; the private-sector PIPA access-right provisions are not affected.

The practical effect, if enacted, would be a softened response-time standard paired with a tightened specificity requirement on the requester's side. Read together, these amendments shift some of the practical burden of the access-request process toward the requester at the margin, while giving public bodies a more flexible timeline standard than the current without delay wording.

Outlook

The Bill has not been enacted; it remains before the Legislature. Passage would settle whether these changes proceed as introduced or are amended during the legislative process. No corresponding change to the private-sector PIPA access-right regime has been proposed this cycle.

Sources and claims (4)

ConfirmedOPC Canada — Individuals have a right to know the details of unauthorized access of their personal information and, more broadly, a right to access personal information held about them by an organization subject to statutory exceptions.observed 2026-08-05
ConfirmedOPC Canada — The OIPC BC's PIPA-reform recommendations included a 'Right to be Forgotten' proposal on which the federal OPC stated it would go further than the BC recommendation.observed 2026-08-05
ConfirmedOPC Canada — Automated decision-making transparency was among the 12 recommendations made by the OIPC BC for PIPA reform, indicating it is not currently a codified right under PIPA.observed 2026-08-05
ConfirmedOPC Canada — Data portability was among the 12 recommendations made by the OIPC BC for PIPA reform, confirming it is not a currently codified statutory right.observed 2026-08-05

#

Accountability and security-safeguard obligations are in force, but the absence of mandatory breach notification and of explicit processor/service-provider accountability are material, long-flagged gaps relative to peer Canadian regimes and GDPR.

Primary frameworkPersonal Information Protection Act (PIPA), SBC 2003, c. 63

Supervisory authorityOffice of the Information and Privacy Commissioner for British Columbia (OIPC BC)

Traffic-light rationale — AmberAccountability and security-safeguard obligations are in force, but the absence of mandatory breach notification and of explicit processor/service-provider accountability are material, long-flagged gaps relative to peer Canadian regimes and GDPR.

Sub-modules (7)

Accountability And DpiaAmber

PIPA embeds an accountability principle requiring organizations to designate a person accountable for compliance; no formal DPIA-trigger regime is codified.

Claims (1):

An organization is responsible for personal information under its control and shall designate an individual or individuals accountable for the organization's compliance with core privacy principles.

Dpo RequirementsAmber

PIPA does not mandate formal DPO appointment thresholds; organizations must designate an accountable individual for compliance purposes.

Claims (1):

An organization is responsible for personal information under its control and shall designate an individual or individuals accountable for the organization's compliance with core privacy principles.

Ropa RequirementsRed

No express Records-of-Processing-Activities obligation is codified in PIPA.

Absence provenance: unavailable. Searched: BC PIPA records of processing activities requirement.

Joint Controller ArrangementsAmber

PIPA does not currently expressly hold organizations responsible for personal information transferred to a service provider for processing; the OIPC has recommended amending PIPA to impose such accountability, aligning with the federal Bill C-11/CPPA approach.

Claims (1):

PIPA currently does not expressly hold organizations responsible for the personal information they transfer to a service provider, and the OIPC has recommended amending PIPA to require contractual or other means ensuring compliance or comparable protection.

Security MeasuresGreen

PIPA requires organizations to protect personal information under their control with reasonable security safeguards.

Claims (1):

PIPA requires organizations to protect personal information in their custody or under their control through reasonable security arrangements against risks such as unauthorized access, collection, use, or disclosure.

Breach NotificationRed

PIPA does not impose a mandatory breach-notification requirement, making BC the outlier among Canadian 'substantially similar' regimes (PIPEDA, Alberta PIPA, Quebec's Private Sector Act) that all mandate breach reporting. The OIPC has repeatedly recommended mandatory notification be added; the April 2026 OIPC SME breach-response guide is non-binding guidance rather than a statutory notification duty.

Claims (3):

The BC OIPC has recommended that PIPA be amended to require organizations to notify affected individuals and the Commissioner of any loss of, unauthorized access to, or disclosure of personal information where it is reasonable to believe there is a real risk of significant harm — confirming this is not yet a binding statutory requirement.
Quebec's mandatory breach reporting to its data protection authority and to individuals is described as bringing that province's regime into alignment with 'the existing regime everywhere else in Canada, except British Columbia', confirming BC PIPA lacks a mandatory breach-notification obligation.
In April 2026, the OIPC BC published a quick-reference guide for small and medium-sized businesses on responding to privacy breaches, explaining that a privacy breach occurs when personal information is mishandled in violation of PIPA and describing OIPC's monitoring and recommendation role, without imposing a new mandatory notification duty.

Retention And DisposalGreen

PIPA requires personal information to be retained only as long as necessary to fulfil the identified purpose, with disposal obligations thereafter.

Claims (1):

Organizations are expected to limit collection to what is necessary and retain personal information only as long as necessary to fulfil identified purposes under BC and Alberta's private-sector privacy laws.

Category narrative114 words

PIPA imposes an accountability principle requiring organizations to designate an individual accountable for compliance, and requires reasonable security safeguards for personal information in an organization's custody or control. Critically, PIPA does not currently impose a mandatory breach-notification obligation on organizations or individuals — British Columbia is the one Canadian jurisdiction (among PIPEDA, Alberta PIPA, and Quebec's Private Sector Act) without mandatory breach reporting, despite the OIPC's repeated recommendations to add it. PIPA also does not expressly hold organizations accountable for personal information transferred to third-party service providers, another gap flagged by the OIPC for reform. The April 2026 OIPC breach-response guide for SMEs is non-binding operational guidance, not a codification of a mandatory-notification duty.

Periodic update · new data 2026-09-22

Controller/Processor Duties

In January 2026, OIPC BC released updated Public Sector Surveillance Guidelines, replacing guidance dating to 2014. The new guidelines require completion of a privacy impact assessment under FIPPA section 69(5.3) before a public body may implement a new surveillance initiative. This is a Confirmed, in-force development affecting public-body accountability duties specifically; it does not alter private-sector controller/processor obligations under PIPA, which remain governed by that Act's existing accountability provisions.

The update raises the practical accountability bar for public bodies contemplating surveillance deployments, formalising the privacy-impact-assessment step as a precondition rather than a best-practice recommendation. This sits alongside, but is distinct from, the private-sector consent gap identified in the concurrent OpenAI investigation: the surveillance guidelines address process discipline for public-body surveillance, while the OpenAI findings address the substantive adequacy of PIPA's consent basis for private-sector AI processing. Together they illustrate two separate fronts on which BC's privacy accountability framework is under active scrutiny this cycle — one procedural and public-sector-facing, the other substantive and private-sector-facing.

Outlook

Watch for how public bodies operationalise the new privacy-impact-assessment requirement in practice, and whether any enforcement action tests the boundaries of the FIPPA section 69(5.3) obligation in the coming cycles.

Sources and claims (7)

ConfirmedOPC Canada — An organization is responsible for personal information under its control and shall designate an individual or individuals accountable for the organization's compliance with core privacy principles.observed 2026-08-05
ConfirmedOIPC BC — PIPA currently does not expressly hold organizations responsible for the personal information they transfer to a service provider, and the OIPC has recommended amending PIPA to require contractual or other means ensuring compliance or comparable protection.observed 2026-08-05
ConfirmedOPC Canada — PIPA requires organizations to protect personal information in their custody or under their control through reasonable security arrangements against risks such as unauthorized access, collection, use, or disclosure.observed 2026-08-05
ConfirmedOPC Canada — The BC OIPC has recommended that PIPA be amended to require organizations to notify affected individuals and the Commissioner of any loss of, unauthorized access to, or disclosure of personal information where it is reasonable to believe there is a real risk of significant harm — confirming this is not yet a binding statutory requirement.observed 2026-08-05
ConfirmedIAPP — Quebec's mandatory breach reporting to its data protection authority and to individuals is described as bringing that province's regime into alignment with 'the existing regime everywhere else in Canada, except British Columbia', confirming BC PIPA lacks a mandatory breach-notification obligation.observed 2026-08-05
ConfirmedDataGuidance — In April 2026, the OIPC BC published a quick-reference guide for small and medium-sized businesses on responding to privacy breaches, explaining that a privacy breach occurs when personal information is mishandled in violation of PIPA and describing OIPC's monitoring and recommendation role, without imposing a new mandatory notification duty.observed 2026-08-05
ProbableOPC Canada — Organizations are expected to limit collection to what is necessary and retain personal information only as long as necessary to fulfil identified purposes under BC and Alberta's private-sector privacy laws.observed 2026-08-05

#

Private-sector transfer mechanics are well-settled via the PIPEDA/PIPA interlock, but the 2021 removal of BC's public-sector data-residency mandate in favour of yet-unspecified regulations creates ongoing uncertainty flagged by the regulator itself.

Primary frameworkPersonal Information Protection Act (PIPA), SBC 2003, c. 63 / Freedom of Information and Protection of Privacy Act, RSBC 1996, c. 165

Supervisory authorityOffice of the Information and Privacy Commissioner for British Columbia (OIPC BC)

Traffic-light rationale — AmberPrivate-sector transfer mechanics are well-settled via the PIPEDA/PIPA interlock, but the 2021 removal of BC's public-sector data-residency mandate in favour of yet-unspecified regulations creates ongoing uncertainty flagged by the regulator itself.

Sub-modules (6)

Transfer MechanismsGreen

Trans-border commercial personal-information flows by BC organizations are governed by PIPEDA under the federal government's trade-and-commerce power, even where PIPA otherwise applies to in-province activity.

Claims (1):

Trans-border personal information flows in a commercial context are covered by PIPEDA due to the federal government's constitutional power over inter-provincial and international trade and commerce, even for organizations otherwise subject to PIPA.

Adequacy ReceivedAmber

Not applicable as a discrete BC-level adequacy decision; BC's regime is recognized federally as 'substantially similar' to PIPEDA rather than receiving adequacy from a foreign regulator.

Absence provenance: unavailable. Searched: British Columbia PIPA foreign adequacy decision received.

Claims (1):

PIPA has been declared substantially similar to PIPEDA, the mechanism by which BC's private-sector regime is recognized as equivalent within Canada's federal-provincial privacy architecture.

Adequacy GrantedAmber

BC does not independently grant adequacy decisions; this function does not exist at the provincial level in Canada.

Absence provenance: unavailable. Searched: British Columbia PIPA adequacy granted to other jurisdictions.

Sccs And BcrsAmber

PIPA does not prescribe SCC- or BCR-style standardized transfer instruments; contractual accountability for transferred data is currently a policy recommendation rather than a codified requirement.

Claims (1):

PIPA currently does not expressly hold organizations responsible for the personal information they transfer to a service provider, and the OIPC has recommended amending PIPA to require contractual or other means ensuring compliance or comparable protection.

Transfer Impact AssessmentRed

No TIA-equivalent requirement is codified in PIPA.

Absence provenance: unavailable. Searched: BC PIPA transfer impact assessment requirement.

Data LocalisationAmber

BC's public-sector FIPPA formerly required public bodies to store and access personal information only in Canada (s. 30.1); Bill 22 (2021) replaced this prohibition with a regulation-dependent disclosure permission, in practice removing the data-residency mandate, a change the OIPC BC criticized.

Claims (3):

Section 30.1 of the BC Freedom of Information and Protection of Privacy Act formerly required public bodies to ensure personal information in their custody or control was stored only in Canada and accessed only in Canada.
The Freedom of Information and Protection of Privacy Amendment Act, 2021 (Bill 22) replaced the prohibition on disclosure of personal information outside Canada with a provision allowing such disclosure in accordance with regulations, in practical terms removing the data-residency requirement.
The OIPC BC wrote to the responsible Minister expressing concern that Bill 22's data-residency changes would be filled in only through regulations whose substance was unknown at the time of the bill's introduction.

Category narrative105 words

PIPA governs BC-internal personal information flows, while PIPEDA continues to apply to interprovincial and international commercial transfers and to federally-regulated works and undertakings even within BC. BC has no formal 'adequacy' regime of its own analogous to GDPR Art 45; rather, it participates in Canada's internal 'substantially similar' recognition scheme. For the public sector, FIPPA formerly imposed an absolute Canada-only data-residency/data-access mandate (s. 30.1), but the Freedom of Information and Protection of Privacy Amendment Act, 2021 (Bill 22) replaced this prohibition with a regulation-dependent approach, in practice removing the hard data-residency requirement — a change the OIPC BC publicly criticized for its lack of transparency.

Sources and claims (5)

ConfirmedOPC Canada — Trans-border personal information flows in a commercial context are covered by PIPEDA due to the federal government's constitutional power over inter-provincial and international trade and commerce, even for organizations otherwise subject to PIPA.observed 2026-08-05
ConfirmedOPC Canada — PIPA has been declared substantially similar to PIPEDA, the mechanism by which BC's private-sector regime is recognized as equivalent within Canada's federal-provincial privacy architecture.observed 2026-08-05
ConfirmedIAPP — Section 30.1 of the BC Freedom of Information and Protection of Privacy Act formerly required public bodies to ensure personal information in their custody or control was stored only in Canada and accessed only in Canada.observed 2026-08-05
ConfirmedIAPP — The Freedom of Information and Protection of Privacy Amendment Act, 2021 (Bill 22) replaced the prohibition on disclosure of personal information outside Canada with a provision allowing such disclosure in accordance with regulations, in practical terms removing the data-residency requirement.observed 2026-08-05
ConfirmedDataGuidance — The OIPC BC wrote to the responsible Minister expressing concern that Bill 22's data-residency changes would be filled in only through regulations whose substance was unknown at the time of the bill's introduction.observed 2026-08-05

#

Health and employment overlays are well-documented and in force; several other sectoral sub-modules show no BC-specific overlay, which is itself a legitimate finding rather than a research gap.

Primary frameworkE-Health (Personal Health Information Access and Protection of Privacy) Act / Personal Information Protection Act (PIPA)

Supervisory authorityOffice of the Information and Privacy Commissioner for British Columbia (OIPC BC)

Traffic-light rationale — AmberHealth and employment overlays are well-documented and in force; several other sectoral sub-modules show no BC-specific overlay, which is itself a legitimate finding rather than a research gap.

Sub-modules (7)

Financial Sector OverlayAmber

No BC-specific financial-sector privacy overlay distinct from PIPA was identified; federally-regulated financial institutions (banks) remain subject to PIPEDA as FWUBs, while BC-regulated credit unions fall under PIPA.

Absence provenance: unavailable. Searched: British Columbia financial sector data protection overlay PIPA credit union.

Health Sector OverlayGreen

The E-Health (Personal Health Information Access and Protection of Privacy) Act is BC's dedicated health-records privacy law, overseen by the OIPC BC.

Claims (1):

The Information and Privacy Commissioner for British Columbia oversees the E-Health (Personal Health Information Access and Protection of Privacy) Act, BC's privacy law relating to health records.

Telecoms And EprivacyAmber

No BC-specific ePrivacy/telecoms overlay distinct from PIPA/PIPEDA and the federal Anti-Spam Legislation (CASL) was identified.

Absence provenance: unavailable. Searched: British Columbia telecoms ePrivacy overlay PIPA.

Employment DataGreen

PIPA directly covers employee personal information held by provincially-regulated organizations, a notable distinction from PIPEDA's employee-information exclusion for non-FWUB organizations.

Claims (1):

Employee personal information held by provincially-regulated organizations in British Columbia is covered by PIPA, unlike PIPEDA which excludes employee information for non-FWUB organizations.

Credit And ScoringAmber

No BC-specific credit-reporting or scoring statute distinct from general PIPA obligations was identified.

Absence provenance: unavailable. Searched: British Columbia credit reporting scoring privacy statute.

EducationAmber

No BC-specific private-sector education-privacy overlay distinct from PIPA/FIPPA was identified in this pass, though federal/provincial regulators have jointly addressed education-technology privacy concerns for minors.

Absence provenance: unavailable. Searched: British Columbia education sector privacy overlay PIPA FIPPA.

InsuranceAmber

No BC-specific insurance-sector privacy overlay distinct from general PIPA obligations was identified.

Absence provenance: unavailable. Searched: British Columbia insurance sector privacy overlay PIPA.

Category narrative72 words

BC's DP landscape includes a dedicated health-sector overlay (the E-Health (Personal Health Information Access and Protection of Privacy) Act) administered by the same OIPC BC, and an employment overlay embedded directly within PIPA itself (unlike PIPEDA, which excludes employee data for non-FWUB organizations). No BC-specific financial-sector, telecoms/ePrivacy, credit-scoring, education, or insurance-specific privacy overlay statutes were identified distinct from general PIPA/FIPPA coverage; federally-regulated financial institutions and telecoms remain subject to PIPEDA as FWUBs.

Sources and claims (1)

ConfirmedOPC Canada — The Information and Privacy Commissioner for British Columbia oversees the E-Health (Personal Health Information Access and Protection of Privacy) Act, BC's privacy law relating to health records.observed 2026-08-05

#

No BC-specific adtech statute exists; coverage relies entirely on PIPA's general consent/purpose principles, which is a materially thinner regime than jurisdictions with dedicated adtech rules (e.g., US-CA CPRA).

Primary frameworkPersonal Information Protection Act (PIPA), SBC 2003, c. 63

Supervisory authorityOffice of the Information and Privacy Commissioner for British Columbia (OIPC BC)

Traffic-light rationale — Not assessedNo BC-specific adtech statute exists; coverage relies entirely on PIPA's general consent/purpose principles, which is a materially thinner regime than jurisdictions with dedicated adtech rules (e.g., US-CA CPRA).

Sub-modules (6)

Cookies And TrackersAmber

No BC-specific cookie-consent statute exists; general PIPA consent/purpose principles apply to online tracking by BC-regulated organizations.

Claims (1):

An organization may collect, use or disclose personal information under PIPA only for a purpose that a reasonable person would consider appropriate in the circumstances, per sections 11 and 14.

Dark PatternsRed

No codified dark-pattern prohibition exists under PIPA.

Absence provenance: unavailable. Searched: British Columbia PIPA dark patterns prohibition.

Opt Out SignalsRed

PIPA does not recognize a codified universal opt-out signal (e.g., Global Privacy Control) mechanism.

Absence provenance: unavailable. Searched: British Columbia PIPA Global Privacy Control opt-out signal.

Clean Rooms And DcrRed

No clean-room or data-collaboration-room-specific rules exist under PIPA.

Absence provenance: unavailable. Searched: British Columbia PIPA data clean room rules.

Cross Context AdvertisingAmber

PIPA has no CPRA-style 'sale'/'share' construct for cross-context advertising; general consent/purpose-limitation rules apply instead.

Claims (1):

An organization may collect, use or disclose personal information under PIPA only for a purpose that a reasonable person would consider appropriate in the circumstances, per sections 11 and 14.

Direct MarketingAmber

Direct marketing by BC organizations is subject to PIPA's general consent principles and, separately, to the federal Anti-Spam Legislation (CASL) for electronic messages, which sits outside PIPA proper.

Claims (1):

Sections 6-8 of PIPA-BC require the consent of individuals for the collection, use or disclosure of their personal information, unless an exception applies.

Category narrative57 words

PIPA applies general consent and purpose-limitation principles to cookie/tracker use, direct marketing, and cross-context data use, but BC has no dedicated cookie-consent statute, no codified dark-pattern prohibition, no recognition regime for opt-out signals (e.g., Global Privacy Control), and no clean-room/data-collaboration-specific rules. Direct marketing is additionally governed federally by Canada's Anti-Spam Legislation (CASL), outside this JID's PIPA scope.

#

Strong, recent case-law-driven biometric protection exists via joint enforcement, but statutory ADM-transparency, genetic-data, and AI-risk-assessment provisions remain absent or only proposed.

Primary frameworkPersonal Information Protection Act (PIPA), SBC 2003, c. 63

Supervisory authorityOffice of the Information and Privacy Commissioner for British Columbia (OIPC BC)

Traffic-light rationale — AmberStrong, recent case-law-driven biometric protection exists via joint enforcement, but statutory ADM-transparency, genetic-data, and AI-risk-assessment provisions remain absent or only proposed.

Sub-modules (6)

Profiling RestrictionsRed

No Art 22-style profiling restriction is codified in PIPA; automated decision-making was flagged in the OIPC's 2021 reform recommendations as an area for legislative change.

Claims (1):

Automated decision-making transparency was among the 12 recommendations made by the OIPC BC for PIPA reform, indicating it is not currently a codified right under PIPA.

Automated Decision Making TransparencyRed

No statutory ADM-transparency or explanation right currently exists under PIPA; this remains a pending reform recommendation.

Claims (1):

Automated decision-making transparency was among the 12 recommendations made by the OIPC BC for PIPA reform, indicating it is not currently a codified right under PIPA.

Ai Risk AssessmentsAmber

PIPA has no AI-specific risk-assessment requirement; the 2026 joint OpenAI/ChatGPT investigation applied PIPA's general consent and purpose-limitation framework to generative-AI data practices rather than a dedicated AI statute.

Claims (1):

In 2026, the OPC, CAI, OIPC-BC, and OIPC-AB jointly released findings on OpenAI's ChatGPT, examining compliance with PIPEDA, Quebec's Private Sector Act, PIPA-BC and PIPA-AB rather than any dedicated AI-specific statute.

Biometric RegimeAmber

Biometric information, including facial-recognition data, has been found by joint regulatory investigations to be sensitive information generally requiring express consent under PIPA's consent framework.

Claims (2):

Joint regulatory investigations (Clearview AI, Cadillac Fairview) found biometric information to be sensitive in almost all circumstances, being intrinsically and often permanently linked to an individual, distinctive and difficult to change.
A joint investigation found that Clearview AI's collection of images and creation of biometric facial-recognition arrays required assessment against PIPA-BC's and PIPA-AB's reasonable-purpose and consent requirements.

Genetic DataRed

No BC-specific genetic-data regime distinct from PIPA's general sensitive-information treatment was identified.

Absence provenance: unavailable. Searched: British Columbia PIPA genetic data regime.

State Surveillance CarveoutsAmber

PIPA permits disclosure without consent to government institutions/investigative bodies in defined law-enforcement and national-security circumstances; the scope of these voluntary-disclosure exceptions was itself flagged for review by the OIPC, FIPA and OpenMedia during the 2021 PIPA reform consultation.

Claims (1):

The OIPC, FIPA and OpenMedia.ca called for the PIPA Special Committee to review PIPA's provisions permitting organizations to voluntarily provide information to law enforcement, with FIPA recommending that law enforcement be required to provide evidence of lawful authority to compel production.

Category narrative84 words

PIPA has no codified Art 22-style profiling-restriction or ADM-transparency right; automated decision-making was one of the OIPC's 12 PIPA-reform recommendations, not yet enacted. Biometric data, however, has been substantively addressed through joint enforcement: the Clearview AI and Cadillac Fairview investigations found facial-recognition/biometric data to be sensitive information generally requiring express consent, and the 2026 OpenAI/ChatGPT joint investigation extended scrutiny to generative-AI training-data practices under PIPA. No BC-specific genetic-data statute or AI-specific risk-assessment law exists; national-security carve-outs are addressed generally through PIPA's law-enforcement disclosure exceptions.

Periodic update · new data 2026-09-28

Algorithmic, Biometric & Surveillance Governance

The OIPC is reported to have released updated Public Sector Surveillance Guidelines in January 2026, replacing guidelines that had been in place since 2014. The updated guidelines are understood to apply to all public bodies subject to FIPPA, including ministries, local governments, schools, Crown corporations, hospitals, and municipal police forces. This is sourced via secondary law-firm commentary rather than direct confirmation against the guidelines' primary OIPC text, so the specific content changes between the 2014 and 2026 versions have not been independently verified this pass.

A twelve-year gap between guidance updates suggests the refresh responds to a substantially changed surveillance-technology landscape across BC's public sector, spanning municipal policing through to hospital and school surveillance practices, though the precise substantive changes remain to be confirmed against the primary document.

Outlook

Confirming the updated guidelines against the OIPC's own primary text would sharpen understanding of what specifically changed for public bodies conducting surveillance activity. Given the breadth of bodies affected, from municipal police forces to school districts, the practical implementation of the updated guidance across such a varied set of public bodies is a development worth tracking further.

2 earlier distinct update(s)

Periodic update · new data 2026-09-22

Algorithmic, Biometric & Surveillance Governance

The joint OIPC/OPC investigation into OpenAI, concluded and published in May 2026, is the headline algorithmic-governance development for British Columbia this cycle. The investigation concluded that societal expectations about AI and the organisational risk-mitigation steps involved have moved outside the scope that PIPA's current consent provisions can reasonably accommodate, and specifically found that PIPA does not enable OpenAI to establish implicit consent for its AI training and processing activities. This is a Confirmed finding directly from the regulators' own published comments.

In direct response, OIPC Commissioner Michael Harvey encouraged government to advance the timing of the legislature's statutory review of PIPA in light of these AI-related consent gaps, and offered OIPC's support for a statutory reform effort. This is a notable escalation: a joint investigation with a national-level counterpart producing a public call from the provincial Commissioner for accelerated legislative attention specifically because of AI's implications for the province's consent-based privacy law. It signals that algorithmic governance is now a driving force behind privacy-law reform pressure in British Columbia, rather than a peripheral consideration.

Outlook

The determinative question is whether the legislature responds to the Commissioner's call by advancing the statutory PIPA review ahead of its normal six-year cycle. The Interpreter's evidence treats this as a proposed, not yet formalised, possibility with a full year of timing uncertainty.

Periodic update · new data 2026-09-14

Algorithmic, Biometric & Surveillance Governance

This was a material cycle for algorithmic and biometric governance in BC. The Court of Appeal for British Columbia dismissed Clearview AI's appeal, confirming that PIPA applies to Clearview and that the statute does not exempt the company from obtaining consent to collect personal information from online sources — an appellate-level confirmation of PIPA's reach over biometric facial-recognition data sourced from public online platforms. Separately, the OIPC-OPC joint investigation into OpenAI found that PIPA does not enable the company to establish implicit consent for its data-processing practices, even where OpenAI's mitigation steps were understood to satisfy the federal OPC's implied-consent standard under PIPEDA. This finding prompted the Commissioner to renew calls for PIPA reform specifically addressing AI-era consent standards, effectively functioning as a de facto AI risk-assessment precedent under a statute that does not yet contain AI-specific provisions.

On the public-sector surveillance side, OIPC BC released updated Public Sector Surveillance Guidelines in January 2026, replacing guidance dating from 2014. These apply to all FIPPA-covered public bodies, including ministries, local governments, schools, Crown corporations, hospitals and municipal police, and reiterate privacy-impact-assessment obligations for surveillance systems deployed by those bodies.

Taken together, these three developments — a biometric appellate ruling, an AI-consent enforcement finding, and updated public-sector surveillance guidance — establish BC as an unusually active jurisdiction for algorithmic and biometric governance this cycle, operating substantially through enforcement, litigation and guidance rather than through new statutory text.

Outlook

Watch for whether the OpenAI investigation's findings translate into concrete compliance changes, whether further biometric-technology enforcement follows the Clearview AI precedent, and whether the OIPC's AI-consent-reform advocacy gains legislative traction alongside the currently public-sector-only Bill 9 reform track.

Sources and claims (3)

ConfirmedOPC Canada / OIPC BC / OIPC AB / CAI — In 2026, the OPC, CAI, OIPC-BC, and OIPC-AB jointly released findings on OpenAI's ChatGPT, examining compliance with PIPEDA, Quebec's Private Sector Act, PIPA-BC and PIPA-AB rather than any dedicated AI-specific statute.observed 2026-08-05
ConfirmedOPC Canada / OIPC BC / OIPC AB / CAI — A joint investigation found that Clearview AI's collection of images and creation of biometric facial-recognition arrays required assessment against PIPA-BC's and PIPA-AB's reasonable-purpose and consent requirements.observed 2026-08-05
ConfirmedIAPP — The OIPC, FIPA and OpenMedia.ca called for the PIPA Special Committee to review PIPA's provisions permitting organizations to voluntarily provide information to law enforcement, with FIPA recommending that law enforcement be required to provide evidence of lawful authority to compel production.observed 2026-08-05

#

No codified statutory age-of-consent or parental-consent regime exists, but active, recent joint enforcement (TikTok 2025) demonstrates the regulator applying general consent principles rigorously to protect minors.

Primary frameworkPersonal Information Protection Act (PIPA), SBC 2003, c. 63

Supervisory authorityOffice of the Information and Privacy Commissioner for British Columbia (OIPC BC)

Traffic-light rationale — AmberNo codified statutory age-of-consent or parental-consent regime exists, but active, recent joint enforcement (TikTok 2025) demonstrates the regulator applying general consent principles rigorously to protect minors.

Sub-modules (5)

Age VerificationAmber

PIPA does not codify a statutory age-verification requirement; consent capacity for minors is assessed contextually.

Claims (1):

In the 2025 joint TikTok investigation, the Offices found that TikTok's collection and use of personal information from underage users (many aged 13-17) was inappropriate, unreasonable and illegitimate, contravening sections 11 and 14 of PIPA BC among other provisions, given the platform's sophisticated age-estimation analytics used for other business purposes.

Minor Profiling BansRed

No BC-specific statutory ban on profiling minors exists; the TikTok joint investigation instead applied general consent/purpose-appropriateness rules.

Claims (1):

In the 2025 joint TikTok investigation, the Offices found that TikTok's collection and use of personal information from underage users (many aged 13-17) was inappropriate, unreasonable and illegitimate, contravening sections 11 and 14 of PIPA BC among other provisions, given the platform's sophisticated age-estimation analytics used for other business purposes.

Education SettingsAmber

Federal, provincial and territorial commissioners, including OIPC BC's counterparts, jointly issued a resolution on protecting children's privacy in classroom educational-technology use, though this is guidance rather than binding BC-specific legislation.

Claims (1):

Commissioner Dufresne and privacy authorities from across Canada, including BC's counterpart, issued a joint resolution on protecting the privacy of children and youth in the classroom through responsible educational technologies.

Dependent AdultsRed

No BC-specific dependent-adults privacy provision distinct from PIPA's general framework was identified.

Absence provenance: unavailable. Searched: British Columbia PIPA dependent adults privacy protection.

Category narrative73 words

PIPA contains no codified age-of-consent threshold or parental-consent mechanism analogous to COPPA or GDPR Art 8; consent validity for minors is instead assessed contextually via the 'meaningful consent' standard, considering cognitive ability and developmental maturity, as applied in the 2025 joint TikTok investigation which found consent practices for 13-17-year-old users inadequate. No BC-specific minor-profiling ban, education-settings-specific statute, or dependent-adults-specific privacy provision was identified beyond PIPA's general framework and FIPPA's coverage of public schools.

Sources and claims (2)

ConfirmedOPC Canada / OIPC BC / OIPC AB / CAI — In the 2025 joint TikTok investigation, the Offices found that TikTok's collection and use of personal information from underage users (many aged 13-17) was inappropriate, unreasonable and illegitimate, contravening sections 11 and 14 of PIPA BC among other provisions, given the platform's sophisticated age-estimation analytics used for other business purposes.observed 2026-08-05
ConfirmedOPC Canada — Commissioner Dufresne and privacy authorities from across Canada, including BC's counterpart, issued a joint resolution on protecting the privacy of children and youth in the classroom through responsible educational technologies.observed 2026-08-05

#

Order-making powers are real and recently exercised via major joint AI/platform investigations, but the absence of AMPs constrains the deterrent strength of BC's enforcement regime relative to Quebec, the federal CPPA proposal, and GDPR-style regimes.

Primary frameworkPersonal Information Protection Act (PIPA), SBC 2003, c. 63

Supervisory authorityOffice of the Information and Privacy Commissioner for British Columbia (OIPC BC)

Traffic-light rationale — AmberOrder-making powers are real and recently exercised via major joint AI/platform investigations, but the absence of AMPs constrains the deterrent strength of BC's enforcement regime relative to Quebec, the federal CPPA proposal, and GDPR-style regimes.

Sub-modules (6)

Regulator Powers And PenaltiesAmber

The Commissioner holds order-making powers under s. 52 of PIPA but lacks authority to impose financial/administrative monetary penalties, a gap the OIPC has repeatedly asked the legislature to close.

Claims (2):

The OIPC currently has order-making powers under section 52 of PIPA.
The OIPC has argued its order-making power is 'inadequate' because it lacks the ability to issue financial penalties, and has recommended PIPA be amended to enable the Commissioner to impose administrative monetary penalties, noting its existing experience administering AMPs under BC's Lobbyists Transparency Act.

Enforcement Activity IndexGreen

Recent joint investigations (OpenAI 2026, TikTok 2025, Clearview AI 2021, Cadillac Fairview 2020) demonstrate sustained, high-profile OIPC BC enforcement activity in coordination with federal and other provincial regulators.

Claims (2):

In 2026, the OPC, CAI, OIPC-BC, and OIPC-AB jointly released findings on OpenAI's ChatGPT, examining compliance with PIPEDA, Quebec's Private Sector Act, PIPA-BC and PIPA-AB rather than any dedicated AI-specific statute.
In the 2025 joint TikTok investigation, the Offices found that TikTok's collection and use of personal information from underage users (many aged 13-17) was inappropriate, unreasonable and illegitimate, contravening sections 11 and 14 of PIPA BC among other provisions, given the platform's sophisticated age-estimation analytics used for other business purposes.

Regulator Funding And CapacityAmber

No specific BC OIPC budget/headcount figures were located in this research pass; capacity is evidenced indirectly through sustained participation in multi-regulator joint investigations.

Absence provenance: unavailable. Searched: OIPC BC budget headcount funding capacity 2026.

Collective Redress And Class ActionsAmber

No PIPA-specific class-action mechanism was identified beyond BC's general Class Proceedings Act civil framework.

Absence provenance: unavailable. Searched: British Columbia PIPA class action collective redress mechanism.

Private Right Of ActionAmber

PIPA's enforcement model centers on Commissioner complaint/investigation/order processes rather than a direct private right of court action, though general civil remedies may be available outside the Act.

Absence provenance: unavailable. Searched: British Columbia PIPA private right of action civil suit.

Recent Developments 180DGreen

Within the last 180 days, the OIPC BC (i) co-published the May 2026 joint findings on OpenAI/ChatGPT with the federal OPC, CAI and Alberta OIPC, and (ii) published an April 2026 SME privacy-breach quick-reference guide.

Claims (2):

In 2026, the OPC, CAI, OIPC-BC, and OIPC-AB jointly released findings on OpenAI's ChatGPT, examining compliance with PIPEDA, Quebec's Private Sector Act, PIPA-BC and PIPA-AB rather than any dedicated AI-specific statute.
In April 2026, the OIPC BC published a quick-reference guide for small and medium-sized businesses on responding to privacy breaches, explaining that a privacy breach occurs when personal information is mishandled in violation of PIPA and describing OIPC's monitoring and recommendation role, without imposing a new mandatory notification duty.

Category narrative99 words

The OIPC BC holds order-making powers under PIPA s. 52 but, unlike Alberta's Lobbyists Transparency Act model the OIPC also administers, PIPA carries no administrative-monetary-penalty (AMP) regime; the OIPC has repeatedly and unsuccessfully sought AMP authority through the 2021 PIPA reform process. Enforcement activity in the trailing 12-18 months has been substantial via cross-Canada joint investigations: the 2026 OpenAI/ChatGPT findings (announced May 6, 2026) and the 2025 TikTok findings, both conducted jointly with the federal OPC, Quebec's CAI, and Alberta's OIPC. No BC-specific class-action or private-right-of-action mechanism distinct from general BC civil procedure and PIPA's complaint/order framework was identified.

Periodic update · new data 2026-09-28

Enforcement & Redress

The OIPC does not currently have administrative-monetary-penalty power under PIPA. The Commissioner has recommended that such power be added, modelled on section 17.1 of the federal Personal Information Protection and Electronic Documents Act, but this recommendation remains unenacted as of this cycle. This standing gap in the OIPC's enforcement toolkit sits in contrast to the Commissioner's own finding, described elsewhere this cycle, that PIPA's consent provisions are no longer well suited to AI-driven data processing: the regulator has identified a substantive gap in the statute it administers but lacks the administrative-penalty power that other Canadian privacy regulators, including the federal Privacy Commissioner under PIPEDA, already hold.

Separately, the OIPC is reported to be monitoring a privacy breach involving the Canvas platform and urging prompt breach reporting by both public and private bodies. This is sourced only via a third-party jurisdiction tracker, and no OIPC primary release confirming this specific monitoring activity was independently retrieved this pass, so the claim should be treated as uncertain pending confirmation.

Outlook

Whether the OIPC's standing recommendation for PIPEDA-style administrative-monetary-penalty power is taken up by the Legislature remains open; no legislative vehicle for that specific reform was identified this cycle, and Bill 9 does not address it. Confirmation of the Canvas platform breach-monitoring activity against a primary OIPC source would also sharpen the enforcement picture.

2 earlier distinct update(s)

Periodic update · new data 2026-09-22

Enforcement & Redress

The OIPC/OPC joint investigation into OpenAI is this cycle's headline enforcement and oversight activity, concluding that PIPA does not enable OpenAI to establish implicit consent and that the Act's consent provisions are no longer well suited to AI-era data processing. This is a Confirmed finding from a primary regulatory source, functioning as an authoritative oversight determination even though it does not itself impose a financial penalty.

Separately, OIPC BC has recommended that it be granted the ability to impose administrative monetary penalties and to enter into PIPEDA-section-17.1-style compliance agreements — enforcement powers that PIPA does not currently confer on the Commissioner. This recommendation, rated Probable, is forward-looking and has not been enacted; it reflects the Commissioner's own assessment that the office's current toolkit is inadequate relative to comparable federal enforcement mechanisms. Read together, this cycle shows a regulator whose substantive findings (the OpenAI consent gap) are outpacing its formal enforcement powers, which remain limited to investigation and public reporting rather than monetary sanction.

Outlook

Watch for whether the enforcement-powers recommendation gains legislative traction alongside, or independently of, the broader PIPA consent-reform pressure generated by the OpenAI investigation. Absent expanded powers, OIPC BC's redress toolkit for findings of this kind remains investigative rather than punitive.

Periodic update · new data 2026-09-14

Enforcement & Redress

Enforcement activity escalated materially in BC this cycle. The Court of Appeal for British Columbia dismissed Clearview AI's appeal, upholding OIPC's original enforcement order and confirming that PIPA applies to the company with no exemption from consent requirements for collecting personal information from online sources. This is a Confirmed, appellate-level enforcement outcome, and it represents the culmination of a multi-year enforcement and litigation process against Clearview AI.

Separately, the OIPC's joint investigation with the federal OPC into OpenAI's data-processing practices, while framed primarily as a consent-standard finding, also functions as an enforcement-and-redress matter: it establishes formally that PIPA was not satisfied by OpenAI's mitigation steps, a finding that carries direct redress implications for BC residents whose data was processed by OpenAI without adequate consent under BC's standard.

Outlook

The Clearview AI Court of Appeal decision closes that particular enforcement matter at the appellate level, but its precedential effect on future biometric-technology enforcement in BC is the item to watch. For the OpenAI matter, watch for what redress or remedial steps, if any, follow the joint investigation's findings.

Sources and claims (2)

ConfirmedOPC Canada — The OIPC currently has order-making powers under section 52 of PIPA.observed 2026-08-05
ConfirmedOPC Canada — The OIPC has argued its order-making power is 'inadequate' because it lacks the ability to issue financial penalties, and has recommended PIPA be amended to enable the Commissioner to impose administrative monetary penalties, noting its existing experience administering AMPs under BC's Lobbyists Transparency Act.observed 2026-08-05

No categories match.

Filters combine as OR inside a group and AND across groups.

Publication gate

No failing checks.

`schema_valid`	pass
`min_t1_per_instrument_met`	n/a — no subject in this jurisdiction
`min_quoted_text_present`	waived — floor 0%
`translation_provenance_recorded`	n/a — no subject in this jurisdiction
`egress_verified`	pass
`source_tier_integrity_ok`	pass
`jurisdiction_source_floor_met`	pass
`tier_a_b_national_primary_pct`	70.0
`aggregator_only_jurisdiction_count`	0
`manual_override`

Editorial metadata

Provenance only. Nothing below gates publication or affects the render.

Editorial metadata for British Columbia, Canada
Field	Value
`trust.lawyer_review.status`	never_reviewed
`trust.lawyer_review.reviewer`	no reviewer on record
`trust.content_source`	ai_generated

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category (BRIEF section 2b.5). Neither WPM nor the crypto monitor carries this field.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score; derived_scores = {}.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-02. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 57 sub-module(s), 34 claim(s) (34 category placement(s)), 30 source(s) in the cumulative register.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped).

Show article map

GDPR article to category mapping
Article	Category	Sub-module
`Art. 5`	Controller/Processor Duties	accountability and dpia
`Art. 6`	Lawful Processing & Special Data	lawful bases
`Art. 7`	Lawful Processing & Special Data	consent thresholds
`Art. 9`	Lawful Processing & Special Data	special categories
`Art. 13`	Data Subject Rights	access right
`Art. 14`	Data Subject Rights	access right
`Art. 15`	Data Subject Rights	access right
`Art. 16`	Data Subject Rights	rectification and erasure
`Art. 17`	Data Subject Rights	rectification and erasure
`Art. 18`	Data Subject Rights	restriction and objection
`Art. 19`	Data Subject Rights	rectification and erasure
`Art. 20`	Data Subject Rights	data portability
`Art. 21`	Data Subject Rights	restriction and objection
`Art. 22`	Algorithmic, Biometric & Surveillance Governance	automated decision making transparency
`Art. 25`	Controller/Processor Duties	accountability and dpia
`Art. 28`	Controller/Processor Duties	joint controller arrangements
`Art. 30`	Controller/Processor Duties	ropa requirements
`Art. 32`	Controller/Processor Duties	security measures
`Art. 33`	Controller/Processor Duties	breach notification
`Art. 34`	Controller/Processor Duties	breach notification
`Art. 35`	Controller/Processor Duties	accountability and dpia
`Art. 37`	Controller/Processor Duties	dpo requirements
`Art. 38`	Controller/Processor Duties	dpo requirements
`Art. 39`	Controller/Processor Duties	dpo requirements
`Art. 44`	Cross-Border & Adequacy	transfer mechanisms
`Art. 45`	Cross-Border & Adequacy	adequacy received
`Art. 46`	Cross-Border & Adequacy	sccs and bcrs
`Art. 47`	Cross-Border & Adequacy	transfer mechanisms
`Art. 48`	Cross-Border & Adequacy	transfer mechanisms
`Art. 49`	Cross-Border & Adequacy	transfer mechanisms
`Art. 77`	Enforcement & Redress	regulator powers and penalties
`Art. 78`	Enforcement & Redress	regulator powers and penalties
`Art. 79`	Enforcement & Redress	regulator powers and penalties
`Art. 80`	Enforcement & Redress	regulator powers and penalties
`Art. 81`	Enforcement & Redress	collective redress and class actions
`Art. 82`	Enforcement & Redress	private right of action
`Art. 83`	Enforcement & Redress	regulator powers and penalties
`Art. 84`	Enforcement & Redress	regulator powers and penalties

Self-audit

All 10 required modules were populated with narrative, traffic_light, and sub_modules. T1 (statute/regulator primary) coverage was achieved for regulator_and_framework, lawful_processing_and_special_data, controller_processor_duties (breach_notification gap confirmed via T1-adjacent OPC investigation reports), cross_border_and_adequacy, and enforcement_and_redress, all substantially grounded in official OPC Canada joint-investigation reports (T1) which quote PIPA-BC sections directly. sectoral_watch, adtech_and_commercial_privacy, algorithmic_biometric_and_surveillance_governance, and children_and_vulnerable_groups relied more heavily on T3 secondary commentary (IAPP, DataGuidance) and T2 OPC guidance pages, with several sub-modules carrying explicit absent_field_provenance where no BC-specific overlay statute exists (financial, telecoms, credit, education, insurance, genetic data, dependent adults, dark patterns, opt-out signals, clean rooms, TIA). data_subject_rights access-deadline day-count could not be pinned to a current T1 section citation in this pass and is flagged Uncertain/amber rather than fabricated.

Unresolved questions (4):

Exact current PIPA-BC section and day-count governing the statutory access-request response deadline was not independently re-verified against the consolidated BC Laws text in this pass.
Whether any of the BC Special Committee's December 2021 PIPA-reform recommendations (mandatory breach notification, AMPs, service-provider accountability, ADM transparency, portability, right to be forgotten) have since been introduced as a government bill or enacted was not confirmed; current evidence (April 2026 OIPC guide; May 2026 IAPP tracker language) suggests they remain unenacted, but a direct legislative-status check against the BC Legislative Assembly bill tracker was not performed.
Exact OIPC BC budget and headcount figures for regulator_funding_and_capacity were not located.
Whether BC has any sector-specific credit-union, insurance, or education privacy overlay statutes distinct from PIPA/FIPPA was not conclusively ruled out beyond the negative searches performed.

Escalate to primary-source review: yes

British Columbia, Canada

Jurisdiction brief

Latest update · 28 September 2026

Lead Signal

Other Developments

Cross-Monitor Connections

Outlook

Standing brief · as of 26 August 2026

Lead Signal

Other Developments

Cross-Monitor Connections

Outlook

Latest update · 14 September 2026

Regulatory Status

Outlook

Standing brief · as of 26 August 2026

Regulatory Status

Outlook

regulator_and_frameworkRegulator & Framework5 sub-modules6 claimsGreen▾#

Sub-modules (5)

Regulator And AuthorityGreen

Act And InstrumentsGreen

Material ScopeGreen

Territorial ScopeGreen

Regulator Registration And FilingAmber

Regulator & Framework

Outlook

Regulator & Framework

Outlook

Regulator & Framework

Outlook

lawful_processing_and_special_dataLawful Processing & Special Data4 sub-modules4 claimsAmber▾#

Sub-modules (4)

Lawful BasesGreen

Consent ThresholdsGreen

Special CategoriesAmber

Pseudonymisation And AnonymisationRed

Lawful Processing & Special Data

Outlook

Lawful Processing & Special Data

Outlook

Lawful Processing & Special Data

Outlook

data_subject_rightsData Subject Rights5 sub-modules4 claimsAmber▾#

Sub-modules (5)

Access RightGreen

Rectification And ErasureAmber

Restriction And ObjectionRed

Data PortabilityRed

Deadlines And Response WindowsAmber

Data Subject Rights

Outlook

controller_processor_dutiesController/Processor Duties7 sub-modules7 claimsAmber▾#

Sub-modules (7)

Accountability And DpiaAmber

Dpo RequirementsAmber

Ropa RequirementsRed

Joint Controller ArrangementsAmber

Security MeasuresGreen

Breach NotificationRed

Retention And DisposalGreen

Controller/Processor Duties

Outlook

cross_border_and_adequacyCross-Border & Adequacy6 sub-modules5 claimsAmber▾#

Sub-modules (6)

Transfer MechanismsGreen

Adequacy ReceivedAmber

Adequacy GrantedAmber

Sccs And BcrsAmber

Transfer Impact AssessmentRed

Data LocalisationAmber

sectoral_watchSectoral Watch7 sub-modules1 claimAmber▾#

Sub-modules (7)

Financial Sector OverlayAmber

Health Sector OverlayGreen

Telecoms And EprivacyAmber

Employment DataGreen

Credit And ScoringAmber

EducationAmber

InsuranceAmber

#

#

#

#

#

#

#

#

#

#