The short answer: if your business is in British Columbia and collects personal information about customers, patients or employees, the Personal Information Protection Act (PIPA) almost certainly applies to you. It requires you to name someone responsible for privacy, protect personal information with reasonable security arrangements, and keep and destroy it properly. Organizations can be fined up to $100,000 for offences under the Act.
This guide explains the parts of PIPA that touch your IT, then turns them into a practical checklist. It is general information, not legal advice. The full Act is published on BC Laws; for your specific situation, talk to a privacy lawyer or BC’s Office of the Information and Privacy Commissioner (OIPC).
Who PIPA Applies To
PIPA applies to every organization in BC’s private sector: corporations, sole proprietors acting in a business capacity, partnerships, non-profits, associations and trade unions. It covers personal information about customers and clients as well as employee personal information.
It does not cover public bodies such as municipalities, health authorities and schools, which fall under BC’s Freedom of Information and Protection of Privacy Act (FIPPA). Federally regulated businesses such as banks, airlines and telecoms, and personal information that crosses provincial or national borders in the course of commercial activity, generally fall under the federal PIPEDA instead.
For a typical Surrey business, an accounting firm, a dental clinic, a contractor or a distributor, PIPA is the law that applies.
The Four PIPA Duties That Touch Your IT
1. Name someone responsible (section 4)
Every organization must designate one or more individuals to be responsible for complying with PIPA, and make that person’s title and contact information available. In a small business this is often the owner or office manager. They don’t need to be technical, but they need to know where personal information lives and who can see it.
2. Protect it with reasonable security (section 34)
Section 34 requires organizations to protect personal information in their custody or control by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification or disposal. The Act doesn’t list specific technologies. “Reasonable” depends on how sensitive the information is. A clinic holding health records needs more than a landscaping company holding addresses. In practice, this is where your IT comes in.
3. Keep it long enough, then destroy it (section 35)
If you use personal information to make a decision that directly affects someone, you must keep it for at least one year after using it, so they have a chance to access it. Once it is no longer needed for its purpose or for legal or business reasons, you must destroy it or make it anonymous. That means knowing where copies live: email, OneDrive, old laptops, backups and filing cabinets.
4. Consent and access
Generally, you need consent to collect, use and disclose personal information, and individuals have the right to ask for the personal information you hold about them. Good IT makes both easier: if you know where information is stored, you can find it, correct it, or delete it when you should.
Do You Have to Report a Privacy Breach in BC?
This is the question we hear most, and the answer surprises people. PIPA does not currently contain a mandatory breach notification requirement. The Act, as consolidated on BC Laws (current to October 6, 2026), has no duty to report a breach to the Commissioner or notify affected individuals.
That doesn’t mean you should stay quiet. BC’s privacy commissioner encourages organizations to report breaches voluntarily and to notify affected people where there is a risk of harm, and has publicly called for mandatory reporting to be added to the Act. Notifying people promptly also reduces the harm, which matters if a breach later becomes a complaint or a lawsuit.
Two important exceptions:
- If PIPEDA applies to you, for example because you transfer personal information across borders in the course of business, you must report breaches that create a real risk of significant harm to the federal Privacy Commissioner, notify affected individuals, and keep a record of every breach for 24 months.
- Your cyber-insurance policy and contracts may require you to report incidents to the insurer or your clients within a short time, regardless of what the law says.
The practical takeaway: have an incident plan that says who decides, who you call, and how you notify people, before you need it.
Penalties and Enforcement
Under section 56, an organization that commits an offence under PIPA can be fined up to $100,000, and an individual up to $10,000. The Commissioner can also investigate complaints and order an organization to change how it handles personal information, and in some circumstances individuals can sue for damages under section 57.
For most small businesses the bigger costs of a breach aren’t fines. They are downtime, recovery work, lost client trust and the time spent dealing with it. Reasonable security is cheaper than all of those.
12-Point Cybersecurity Checklist for BC Businesses
What “reasonable security arrangements” looks like in practice for a typical Surrey business:
- Multi-factor authentication on email, Microsoft 365, remote access and admin accounts.
- Encryption on every laptop and phone that holds client information.
- Patching: Windows, apps and firewalls updated on a schedule. No unsupported Windows 10 machines.
- Endpoint detection and response on every computer and server.
- Email security: phishing filtering plus SPF, DKIM and DMARC on your domain.
- Least-privilege access: staff can see only the files and systems their job needs.
- Same-day offboarding: accounts disabled the day someone leaves.
- Tested, isolated backups, including Microsoft 365, stored in Canada where possible.
- Security awareness training and phishing tests for all staff.
- Vendor agreements that require your IT provider and software vendors to protect your data.
- Secure disposal: drives wiped or destroyed when computers are retired, paper shredded.
- A written incident plan: who to call, what to preserve, who decides on notification.
Not sure how many of these you have in place? A free IT assessment checks every one and rates it red, amber or green.
Cyber Insurance: The Questions You’ll Be Asked
Even where privacy law is vague, cyber insurers are not. Application forms and renewals now commonly ask whether you have MFA on email and remote access, EDR on all devices, offline or immutable backups, regular patching, staff training and an incident response plan. A “no” can raise the premium or cancel cover.
The checklist above lines up closely with those questions. If you have a renewal coming up, call 604-359-5284 and we’ll help you get the evidence together.