British Columbia's privacy impact assessments: what section 69 of FOIPPA and the minister's directions require of every public body

British Columbia is the reference case for a statutory PIA regime in Canada: the duty has been in FOIPPA long enough that most public bodies have a template, a privacy officer and a filing habit. The 2021 amendments changed the shape of the obligation more than its existence, and the parts that catch organizations now are the ones added then: the substantial-change trigger, the offshoring supplement, the privacy management program the PIA process must belong to, and a breach rule with a defined harm test. This guide sets out the current text, the current directions, and how the pieces fit.

What the Act says

FOIPPA defines a privacy impact assessment as "an assessment that is conducted by a public body to determine if a current or proposed enactment, system, project, program or activity meets or will meet the requirements of Part 3 of this Act". The duties sit in section 69:

• 69(5) — the head of a ministry must conduct a PIA and must do so in accordance with the directions of the minister responsible for the Act.
• 69(5.1) — for a proposed enactment, system, project, program or activity, the head of a ministry must submit the PIA to the minister responsible for the Act, during development, for the minister's review and comment.
• 69(5.2) — where a ministry's PIA concerns a common or integrated program or activity, the minister must notify the Commissioner during development and, on request, make the PIA available for the Commissioner's review and comment.
• 69(5.3) — the head of a public body that is not a ministry must conduct a PIA in accordance with the minister's directions.
• 69(5.4) — for a proposed common or integrated program or activity, the head of a non-ministry public body must notify the Commissioner during development and, on request, make the PIA available for review and comment.

Two more provisions round it out. Section 69(3)(c) puts ministries' PIAs into the personal information directory the minister publishes, so a ministry's assessments are a matter of public record in summary. And ministries that are health care bodies must also assess their health information banks and health information-sharing agreements.

What the directions add

The minister's directions, issued separately to heads of ministries under section 69(5) and to heads of other public bodies under section 69(5.3), took effect on November 26, 2021. They define an initiative as an enactment, system, project, program or activity, and set the trigger:

1. A PIA must be conducted on a new initiative for which no PIA has previously been conducted. For ministries, a previously conducted PIA includes one conducted in consultation with the minister on behalf of all or multiple ministries.
2. A PIA must be conducted before implementing a significant change to an existing initiative, including but not limited to a change to the location in which sensitive personal information is stored when it is stored outside Canada.

The directions then walk through what the assessment must establish, including that personal information used to make a decision that directly affects an individual will be retained for at least one year after use, as section 31 of the Act requires, and they add a supplementary assessment for disclosures that store personal information outside Canada. For ministries, the directions restate the statute's timing: the PIA for a proposed initiative is submitted during the development phase, not at go-live.

The program the PIA belongs to

Privacy management program. Section 36.2 requires the head of a public body to develop a privacy management program in accordance with the minister's directions. A PIA process is a component of that program; so are the designated privacy officer, training, the breach process and the policies that document all of it. A public body that can produce its PIAs but not the program around them has answered half the question.

Breach notification. Section 36.3 defines a privacy breach as the theft or loss, or the unauthorized collection, use or disclosure, of personal information in a public body's custody or control. Where a breach could reasonably be expected to result in significant harm — identity theft, or significant bodily harm, humiliation, damage to reputation or relationships, loss of employment or business opportunities, financial loss, a negative impact on a credit record, or damage to or loss of property — the head must, without unreasonable delay, notify the affected individual and the Commissioner, with narrow exceptions where notification would itself cause grave harm. The PIA's risk section and the breach procedure should use the same list.

Ministries and other public bodies: the differences that matter

Building the program

1. Inventory initiatives, not systems. The directions attach to enactments, systems, projects, programs and activities. List them with owners, and mark which have a PIA on file.
2. Define significant change for your organization. The directions give one example, a change of storage location outside Canada; your written threshold should add new categories of personal information, new uses or disclosures, new vendors and new automated decisions.
3. Use the provincial template and keep the initiative-update form beside it. Most BC public bodies build on the government's standard PIA; a lighter update form keeps significant-change assessments proportionate.
4. Delegate program sections to the program and keep the Part 3 analysis with the privacy office.
5. Register the risks and the commitments with owners and dates, so the next assessment on the same initiative starts from history.
6. Route common or integrated programs to the Commissioner notification in time: during development, not at launch.
7. Document the program itself: the privacy officer, the training record, the breach procedure written to section 36.3, and the PIA process, so section 36.2 has an answer.

How AccessPoint runs it

AccessPoint's British Columbia jurisdiction pack carries the province's standard PIA template and a separate initiative-update template for significant changes, both versioned and pack-maintained, with FOIPPA attached as the governing legal authority.

Everything runs in your own Microsoft 365 and Azure tenant, in Canada, beside the FOIPPA access requests the same office handles.

A readiness checklist

• Confirm which directions apply: ministries under section 69(5), other public bodies under section 69(5.3).
• Inventory initiatives and mark which have a PIA on file.
• Adopt the standard template and an initiative-update form.
• Write a significant-change threshold and put it in a screener.
• Confirm the one-year retention rule for decision-making information is checked in every PIA.
• Add the offshoring supplement to any initiative storing personal information outside Canada.
• Document the privacy management program under section 36.2.
• Write the breach procedure to section 36.3's definition and harm list.

Sources

• Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165, s. 69 and ss. 36.2 and 36.3 — BC Laws (accessed September 4, 2026).
• Directions on Conducting PIAs: Ministries and Directions on Conducting PIAs: Non-Ministry Public Bodies (effective November 26, 2021) — Minister of Citizens' Services.
• Privacy impact assessments — Government of British Columbia (accessed September 4, 2026).

Related reading on this site: AccessPoint for British Columbia public bodies, privacy impact assessment software, the companion guides on Alberta's POPA PIAs, Ontario's mandatory PIAs and federal PIAs under the 2024 standard, or book a demo.