British Columbia · Personal Information Protection Act

Run BC PIPA — the law that displaces PIPEDA in British Columbia

For private-sector organizations, non-profits, and associations operating in BC — AccessPoint manages access and correction requests on the 30-day clock, the consent and disclosure rules, and complaints to an order-making Commissioner, inside your own Microsoft 365 tenant.

Start Free Trial Request a Demo

British Columbia — PIPA at a glance

Access deadline
30 business days, with an extension in the circumstances PIPA allows
Correction
Correction, or annotation where the organization declines
Who is covered
Private-sector organizations, non-profits, and associations operating in BC
Relationship to PIPEDA
Deemed substantially similar — PIPA displaces PIPEDA for intra-provincial activity
Oversight
OIPC for BC — order-making
Languages
English, French

Built for British Columbia — PIPA

One platform for the whole access-and-privacy mandate, pre-configured for this regime and running in your own Microsoft 365 tenant.

Access requests on the PIPA clock

Run an individual's access request end to end on the 30-business-day clock, covering not just the information held but how it was used and to whom it was disclosed — which PIPA asks for and generic ticketing tools rarely capture.

Correction and annotation

Manage correction requests, and where the organization declines to correct, record the annotation PIPA requires so the disagreement travels with the record.

Consent, purpose, and disclosure

Record the purpose and authority behind each collection, use, and disclosure, so an organization can answer the question a Commissioner actually asks: on what basis did you hold this?

Privacy incidents

Log an incident, assess the risk of significant harm, and work the notification decision on a live checklist, with the reasoning recorded whichever way it goes.

Built for an order-making regulator

OIPC BC can order an organization to act. Every request carries a timestamped trail of what was decided, by whom, and on what ground — the record an inquiry runs on.

In your own tenant

Personal information stays inside your own Microsoft 365 and Azure tenant — no third-party cloud, no vendor access, and no cross-border transfers.

Which law actually applies?

If you operate inside British Columbia, PIPA is your law — not PIPEDA.

Canada's federal PIPEDA is the default private-sector privacy law, but it steps aside where a province has enacted legislation the federal government deems substantially similar. British Columbia's PIPA is one of the three that qualify, alongside Alberta's PIPA and Québec's private-sector regime. The practical consequence is that a BC organization's intra-provincial activity is governed by PIPA and reviewed by the OIPC for BC — an order-making body — rather than by the federal Commissioner, whose findings are recommendations. Organizations that assume PIPEDA applies end up working to the wrong clock, the wrong exceptions, and the wrong regulator. AccessPoint ships PIPA as its own pack, and ships PIPEDA as another, so you run the one you are actually subject to.

30 business days PIPA's clock, over BC's holiday calendar.
Orders, not recommendations An order-making Commissioner reviews the file you kept.
The right statute PIPA and PIPEDA ship as separate packs — no approximating.

Configured out of the box

Installing the ca-bc-pipa jurisdiction pack seeds your tenant with everything this regime needs — a starting point you can adjust, not a lock-in.

Related guide: FOI Workflow Quick Check
  • PIPA as the legal-authority spine, with access and correction as the workflow
  • The 30-business-day access clock with PIPA's extension grounds and BC's statutory-holiday calendar
  • Access responses covering the information held, its uses, and its disclosures
  • PIPA's exceptions to access, colour-coded for redaction and citable line by line
  • Correction requests and the annotation path where the organization declines
  • Collection, use, and disclosure records carrying purpose and authority
  • Privacy incident intake, risk assessment, and notification decisions with reasons
  • OIPC BC complaint and inquiry tracking with grounds and dispositions

British Columbia — PIPA Questions

Does PIPA or PIPEDA apply to my organization?
For a private-sector organization's activity within British Columbia, PIPA applies — it has been deemed substantially similar to PIPEDA, so it displaces the federal law for intra-provincial activity. PIPEDA continues to govern federally regulated works and undertakings, and personal information crossing provincial or national borders in the course of commercial activity. AccessPoint ships both as separate packs so you can run whichever governs, or both.

How long do we have to answer an access request?
30 business days, with an extension in the circumstances PIPA allows. AccessPoint computes the due date on receipt over British Columbia's statutory-holiday calendar and tracks any extension with its ground and the notice given.

Does PIPA apply to non-profits?
Yes — unlike PIPEDA, which is tied to commercial activity, BC's PIPA reaches organizations broadly, including many non-profits, societies, and associations operating in the province. That is one of the practical reasons BC organizations that assumed they were outside private-sector privacy law find that they are not.

Where does personal information reside?
Entirely within your own Microsoft 365 and Azure tenant. Requests, records, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers.

Run BC PIPA in Your Own Tenant

Try AccessPoint free for 30 days, configured for British Columbia's private-sector privacy law. No credit card required.

Start Free Trial