If you run a private business in British Columbia, two privacy laws come up: BC's Personal Information Protection Act (PIPA) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA). Here is which one applies, what both expect, and the practical IT steps that cover most of it. We are an IT company, not lawyers, so take legal questions to a lawyer or the regulator.
Which law applies to you?
For most BC small businesses, PIPA is the main law. It covers how private organizations in BC collect, use and disclose personal information about customers and employees. PIPEDA generally applies instead to federally regulated businesses, such as banks, airlines and telecoms, and to personal information that crosses provincial or national borders in the course of commercial activity. Plenty of BC businesses touch both: PIPA for day-to-day operations, PIPEDA when data moves out of the province as part of a sale.
PIPA is overseen by the Office of the Information and Privacy Commissioner for British Columbia. PIPEDA is overseen by the Office of the Privacy Commissioner of Canada.
What both laws expect
- Consent and purpose. Collect personal information for reasonable purposes you can explain, with consent.
- Only what you need. Do not collect or keep more than the purpose requires.
- Reasonable security. Protect personal information with safeguards that fit how sensitive it is.
- Access. People can ask to see the personal information you hold about them.
- Accountability. Someone in the business is responsible for privacy, and there is a written policy.
Breaches
Under PIPEDA, organizations must report breaches of security safeguards that create a real risk of significant harm to the Privacy Commissioner of Canada, notify the people affected, and keep a record of every breach. If something goes wrong and you are unsure which rules apply, get advice quickly, because notice has to be given as soon as feasible.
The IT side of "reasonable security"
Neither law hands you a checklist, but for a small business the same handful of controls does most of the work:
- Multi-factor sign-in on email, Microsoft 365 or Google Workspace, banking, and any system holding customer data.
- Encrypted laptops and phones, so a lost device is not a breach.
- Backups you have actually tested, stored separately from the originals.
- Least-privilege access: staff see what their job needs, and leavers lose access the day they go.
- Phishing awareness, because most incidents start with an email.
- A short written record of where personal information lives and who can reach it.
The Canadian Centre for Cyber Security publishes free baseline cyber security controls for small and medium organizations that line up well with this list.
Where we fit
Bitlogix helps BC businesses put these controls in place and keep them working, from security assessments and multi-factor sign-in to endpoint protection and backups. If you would like a plain-language look at where you stand, book a free 30-minute consultation.
Official sources
- Personal Information Protection Act (PIPA), BC Laws
- Office of the Information and Privacy Commissioner for British Columbia
- PIPEDA, Office of the Privacy Commissioner of Canada
- Privacy breaches at your business, Office of the Privacy Commissioner of Canada
- Baseline cyber security controls for small and medium organizations, Canadian Centre for Cyber Security