The Office of the Information and Privacy Commissioner (OIPC) of Alberta has announced the release of two new resources to help public bodies to establish and implement the privacy management programs (PMPs) required by Alberta’s Protection of Privacy Act (POPA) and Protection of Privacy (Ministerial) Regulation.
The legislation provided a one-year grace period for public bodies to establish and implement PMPs, which began when the legislation came into force in June 2025; this grace period is now coming to an end, and all public bodies must have fully developed PMPs in place by June 2026.
As all rural municipalities fall within the definition of public bodies under POPA, the OIPC’s two resources are directly relevant to RMA members and are intended to help members understand how to develop a PMP and what the OIPC will be looking for when assessing public bodies’ PMPs.
The first resource, Guidance for Public Bodies in Developing Privacy Management Programs, guides public bodies through the development of their PMPs and provides a useful checklist of PMP requirements, including the enhanced requirements for public bodies that process sensitive or high volumes of personal information.
The second resource, Guidance for Public Bodies when Contracting Service Providers, provides guidance for public bodies when contracting service providers, outlining how municipalities must account for both employee practices and the privacy obligations of any third-party vendors when developing their PMPs.
RMA encourages members to review the two resources to help ensure that their PMPs are effective and in compliance, as there are significant penalties established by POPA for public bodies who fail to comply with the legislation.
Joseph Kay
Policy Advisor
587.689.5484
joseph@rmalberta.com
Warren Noga
Manager of Policy and Research
825.319.2285
warren@rmalberta.com