The legislation
What POPA now requires
Alberta's Access to Information Act (ATIA) and Protection of Privacy Act (POPA) replaced the FOIP Act on June 11, 2025. Under POPA, every public body, including every municipality, must establish and implement a privacy management program of documented policies and procedures (POPA s. 25). Public bodies were given one year to comply, so the requirement has applied since June 11, 2026.
A Privacy Management Program is not a single document. It is a documented, organization-wide system for managing personal information responsibly: who is responsible, what information you hold, how staff are trained, and what happens when something goes wrong. For most small and rural municipalities, building one from scratch is genuinely new work.
The requirement applies regardless of your municipality's size or staffing level. A village with one part-time administrator has the same legal obligation as a city of 50,000. The Act requires the program to be proportional to the volume and sensitivity of the personal information you hold (POPA s. 25(2)), but the program must exist.
48% of Canadian public servants surveyed use AI tools for work, and half of those use publicly available tools. (KPMG Canada, September 2025; 349 respondents across federal, provincial and municipal government.) Nearly a third of 282 municipal leaders surveyed by MNP in 2025 said their municipality has no formal policies or guidelines for AI. In many municipalities, the privacy management program gap and the shadow AI problem are the same problem.
The compliance checklist
What your privacy management program must include
The Protection of Privacy (Ministerial) Regulation (Alta Reg 143/2025) sets out what every program must contain. Items 1 to 8 are required of every public body. Items 9 and 10 apply in some circumstances. Items 11 to 13 are what we recommend for any municipality whose staff use AI tools. If a required item does not exist in your organization in writing, you have a gap.
Required of every public body
-
Privacy officer designated
Designate or identify a privacy officer responsible for the municipality's compliance with POPA (Reg. s. 6(1)(a)). The regulation does not prescribe the form. A written designation, by council resolution or CAO directive, lets you show it on request. Handling access requests under ATIA is a separate function, which the same person may also hold.
-
Breach, correction and complaint procedures
Written procedures for responding to privacy breaches, requests to correct personal information, and privacy complaints (Reg. s. 6(1)(b)(i)). Where a loss of, or unauthorized access to or disclosure of, personal information creates a real risk of significant harm, POPA s. 10(2) requires notice, without unreasonable delay, to three parties: the affected individuals, the Information and Privacy Commissioner, and the Minister responsible for the Act (currently the Minister of Technology and Innovation). You do not want to work this out during an incident.
-
Automated systems and AI policy
If staff put personal information into an automated system to generate content or make decisions, recommendations or predictions, including generative AI tools, the program must set out how those systems use personal information and the safeguards that protect it (Reg. s. 6(1)(b)(iii)). If you create, use or disclose non-personal data, such as de-identified data sets, you need policies for that too (Reg. s. 6(1)(b)(ii)).
-
AI disclosure in collection notices
When you collect personal information directly from a resident, the notice must state any intention at that time to input it into an automated system to generate content or make decisions, recommendations or predictions (POPA s. 5(2)(d)). Review your forms and online notices.
-
Security classification and information inventory
Establish a security classification system for personal information, data derived from it, and non-personal data (Reg. s. 6(1)(c)). In practice, that starts with an inventory of where personal information sits: paper records, software, cloud services, and the AI tools staff actually use. Shadow AI tools belong in this inventory.
-
Mandatory training with retraining dates
Mandatory training for employees on their obligations under POPA, with specified expiry periods after which retraining is required (Reg. s. 6(1)(d)). We recommend keeping records of who was trained, when, and on what, so you can demonstrate it.
-
Review timelines
Set timelines for the periodic review, assessment and update of the program (Reg. s. 6(1)(e)). The interval is yours to set. We recommend at least annually, and whenever a new AI tool or system is introduced.
-
Program available to the public
Post the program on your website or set up a process to provide it on request (Reg. s. 6(3)). Anyone may request a copy, which must be provided within 30 business days (POPA s. 25(3)). Information that could compromise security may be withheld (Reg. s. 6(4)).
Required in some circumstances
-
Added elements for high-volume or sensitive information
If the municipality holds a high volume of personal information or highly sensitive personal information, the program must also document: roles and responsibilities; the process for privacy impact assessments; proactive monitoring of information systems; consent procedures; policies on using personal information in AI systems and on creating derived and non-personal data, where the municipality uses personal information in AI systems, creates non-personal data or does data matching; and written administrative, technical and physical safeguards (Reg. s. 6(2)). The Commissioner's office describes meeting all of section 6 as a matter of best practice for every public body.
-
Privacy impact assessments
POPA s. 26 requires a privacy impact assessment in circumstances set by regulation. Under Reg. s. 7, that includes any new or substantially changed program, project or service where a loss of, or unauthorized access to or disclosure of, the personal information involved could result in significant harm, and any that involves the development or use of innovative technology. Assessments must also be submitted to the Commissioner where factors such as innovative technology, highly sensitive information, a significant share of the population you serve, or data matching with another public body apply (Reg. s. 7(5)). Build this check into the procurement of any new AI tool.
Recommended by Spencer Morley Consulting
-
AI acceptable use policy
A staff policy naming sanctioned and prohibited AI tools, what information may and may not be entered, and the consequences of unauthorized use. It is the most direct control on shadow AI and puts item 3 into practice.
-
Vendor and data processing agreements
POPA s. 10(1) requires reasonable security arrangements for personal information in your custody or under your control, and that duty applies to information under your control even when a vendor holds it. Review contracts for every cloud service and AI tool, including Microsoft Copilot and Google Workspace AI features, and flag any that process resident information without a data processing agreement.
-
Formal approval and a resident-facing privacy statement
The Act does not require council to adopt the program, but approval at the right level gives it authority. Some municipalities pair a council-adopted privacy policy with an administratively managed program. Publish a plain-language privacy statement explaining what you collect, why, and how residents can access or correct their information.
The hidden risk
Shadow AI is already in your municipality
Shadow AI is staff using AI tools (ChatGPT, Microsoft Copilot, Google Gemini, free tools on personal devices) without organizational authorization or governance. It is not hypothetical. KPMG Canada found that nearly half of Canadian public servants surveyed use AI tools at work, and half of those use publicly available tools.
When a staff member pastes a ratepayer complaint into ChatGPT to draft a response, or uses a free AI tool to summarize council meeting audio, that data has left your systems. Depending on the tool and its settings, the provider may retain it or use it to train its models. Whether that constitutes a POPA breach depends on context, but without a policy you have no governance, no documentation and no defence. If your municipality does put personal information into AI tools, POPA already requires your program to set out how those systems use it (Reg. s. 6(1)(b)(iii)) and your collection notices to say so (POPA s. 5(2)(d)).
Your AI Acceptable Use Policy is the first control. Your staff training is the second. Neither can happen until someone in your organization has been designated to own the problem.
What you should be able to show: If the Office of the Information and Privacy Commissioner reviews a complaint or a breach, your program is your evidence. A designated privacy officer, documented policies, and training with retraining dates are things you can produce on request. In our view, a municipality with an imperfect program that is actively being improved is in a far better position than one with nothing in writing.
If you missed the deadline
You're not compliant today. What now?
Start immediately: this week, not after budget season. In our view, a municipality that can demonstrate active steps toward compliance is in a fundamentally different position than one that has done nothing.
The minimum credible first step is designating a Privacy Officer and engaging a qualified consultant to begin the assessment. That combination (a named internal owner and documented external support) demonstrates organizational intent. It is the foundation everything else is built on.
For most small municipalities, a practical Privacy Management Program can be drafted and approved in 30 to 60 days with qualified support. The window to be in an acceptable compliance posture before a complaint is filed is narrow. Start the clock now.
Frequently asked questions
Common questions from municipal administrators
Does this apply to our municipality? We're a small village with two staff.
Yes. The Privacy Management Program requirement applies to all public bodies in Alberta regardless of size. The scale of your program should reflect the scale of your operations, but the program must exist and be documented. A village with two staff has a smaller inventory and a simpler policy, but it needs both.
Can we use a template privacy policy we found online?
Templates are a starting point. Your Privacy Management Program must reflect your municipality's actual data practices: the systems you use, the data you collect, the AI tools currently in use. A policy that doesn't match your operations offers limited protection if a complaint is filed. Customization to your specific context is essential, and that customization requires someone who understands both your municipality and the legislation.
What is the difference between ATIA, POPA, and the Privacy Management Program requirement?
ATIA governs the public's right of access to records held by public bodies. POPA governs how public bodies collect, use, disclose and protect personal information. The privacy management program requirement is in POPA (s. 25), and its required contents are set out in the Protection of Privacy (Ministerial) Regulation. It is the obligation to have a systematic, documented approach to privacy governance, not just ad hoc responses to requests and complaints. Both Acts replaced the FOIP Act on June 11, 2025.
How long does it take to build a compliant Privacy Management Program?
For a small or rural municipality, 30 to 60 days with qualified support is realistic. The Spencer Morley Consulting Municipal AI Readiness Assessment is scoped to produce a compliance roadmap in about two weeks, followed by policy drafting and approval. The timeline depends mainly on your approval schedule and on the current state of your records and systems.
Does our Privacy Management Program need to cover AI tools specifically?
If your municipality puts personal information into an automated system to generate content or make decisions, recommendations or predictions, yes. The regulation requires the program to set out how those systems use personal information and the safeguards that protect it (Reg. s. 6(1)(b)(iii)), and POPA requires your collection notices to disclose that intention (s. 5(2)(d)). In our view, generative AI tools fall within that description when staff enter personal information into them. A standalone AI acceptable use policy is not named in the regulation, but it is the most practical way to meet these requirements and control shadow AI.
What about municipalities in other provinces?
Each province has its own legislation, and the obligations differ. British Columbia's FOIPPA, for example, requires public bodies to develop a privacy management program (s. 36.2). Check the requirements in your province before assuming this checklist applies. Spencer Morley Consulting works with municipalities in any Canadian province or territory.