Privacy Impact Assessment

On this page:

In compliance with section 26(1) of the Protection of Privacy Act (POPA) and section 7 of the Protection of Privacy (Ministerial) Regulation (M-Reg), this webpage replaces the legacy Privacy Security Review (PSR) platform with a streamlined, two-step Privacy Impact Assessment (PIA) model designed to safeguard personal information and enforce security standards.

All software, cloud services, and administrative projects must progress through the following steps, to the degree specified at each phase, prior to implementation. 

Phase 1: Pre-Submission OSTAD Intake

Submit your initiative to the Office of Strategic Transformation and Delivery (OSTAD) Initiative Intake Form. Before you complete the Step-1 PIA Checklist, note that high impact projects may require OSTAD Governance Approval. Visit the OSTAD Project Intake page to assess your project.

Researchers, please consult with the Research Ethics Office (REO) and Safeguarding Research Office (SRO) to confirm if a Step-1 PIA should be completed. Step-1 PIAs are integrated into the Research Ethics Board (REB) process. 

Pre-Submission Checklist:

  • Administrative and Academic projects to obtain Governance Approval from OSTAD Intake: Approval is required prior to submitting your Step-1 PIA. 
  • Confirm a Step-1 PIA is actually required (not required for software that is intended for individual use (e.g., does not store, share or process institutional data or personal information as defined in the Institutional Data Management and Governance Procedure) 
  • Prime Vendor Security Documentation: Proponents may wish to inform their vendor that industry-standard security accreditations will be requested during the subsequent review phase(s) If a Step-1 review proceeds (e.g. SOC 2 Type II, HECVAT [Higher Education Community Vendor Assessment Tool], and/or an ISO 27001/42001 certificate).
  • Coordinate Academic Research Projects with REO and SRO: If your submission is for a research project, ensure you have contacted the REO and the SRO to ensure full institutional compliance.

NOTE: A Step-1 PIA does not review your study protocol or ethics application; its sole purpose is to evaluate the privacy and technical security safeguards of the software, application, or online service supporting your study.

Phase 2: Step-1 PIA Security Review Checklist

  • What to do: Access the Step-1 PIA Privacy and Security Review online intake form to submit your project details.
  • Vendor Security: If utilizing an external SaaS/Cloud platform, request security certifications (SOC 2 Type II, HECVAT 4.1 or greater, and/or an ISO 27001/42001 certificate) from your vendor.

Exclusions: Standard Google Workspace/Gmail extensions and tools for strictly individual use are out of scope for Step-1 reviews as such systems do not send data externally. However, university staff are responsible for ensuring the privacy and security of such systems.

What to expect

  • The IPRMO and CISO teams review your data flow, security safeguards, and data residency risks. (Data Sovereignty and Residency Guidelines)
  • Engagement: A brief review meeting will be scheduled to collaboratively discuss information flow and technical controls.
  • Data Sovereignty: Storage outside Canada (Tier 2/3) may require specialized safeguards (e.g. client-side encryption [BYOK]).

Step-1 PIA Outcome

Every submitted Step-1 checklist concludes with one of four clear outcomes:

  1. Project Can Proceed (no concerns identified): Assessment is complete with no outstanding issues.
  2. Project can Proceed with Recommendations: Assessment complete and cleared to implement, provided the team adopts specific recommendations outlined in the Closure Form.
  3. Project Cannot Proceed (substantive concerns): Privacy/security vulnerabilities (such as lack of data deletion) must be resolved with the vendor before proceeding.
  4. Step-2 PIA Required: Reg 7(5) criteria are met; In accordance with POPA M-Reg section 7(5) (If it is determined that the factors as set out in POPA M-Reg section 7(5) apply,) the project must complete a full PIA and submit it to the Commissioner before launching.

Step 1 vs. Step 2: Quick Comparison

Feature

Step-1 PIA Security Review

Step-2 Full OIPC PIA

Focus

Baseline security, hosting environment, and FPP procurement vetting.

In-depth legal and privacy risk analysis submitted to the OIPC.

Applicability

Required for all new software, trials, pilots, and contract renewals involving data.

Required only if specific statutory risk thresholds under POPA Reg 7(5) are triggered.

Duplication

Screens basic project features; maps directly to OIPC PIA Template Sections A, B, and D.

Zero Duplication: Validated Step-1 responses are automatically ported to the OIPC template.

Implementation

Can proceed once the PSR-Step 1 Closure Certificate is issued.

Must wait for formal OIPC submission, file number and clearance before deployment.

 

Phase 3: Step-2 PIA - Legal Triggers

A Step-2 PIA involves completing and submitting the formal Office of the Information and Privacy Commissioner (OIPC) Privacy Impact Assessment template. Under section 26(1) of POPA and section 7 of the Ministerial Regulation, the University of Alberta is legally mandated to submit a full PIA to the Commissioner for high-impact projects that meet one or more of the following criteria:

  1. High-Sensitivity Information: Biometrics, credit card/financial data, or records involving minors, seniors, or vulnerable individuals.
  2. Significant Population Reach: Processing personal data of a large percentage of the U of A community served.
  3. Inter-Institutional Data Matching: Linking personal information between separate databases or other public bodies.
  4. Common or Integrated Programs: Collaborating on programs planned or delivered only with other public bodies subject to POPA
  5. Innovative Technology: Such as Implementing artificial intelligence, machine learning, or algorithms that automate decisions or generate content or other new and creative technologies
  6. Commissioner’s Direct Request: The OIPC formally requests a copy of the University's Privacy Impact Assessment under Section 27(1)(j) of POPA to be completed within 30 business days

Quick Resource Directory

Forms & Portals

Guides

Knowledge Holders 

Frequently Asked Questions

To align with section 26(1) of the Protection of Privacy Act (POPA) and POPA Ministerial Regulation section 7, the legacy PSR has been merged into a streamlined 2-step PIA model:

  1. Step-1 Security & Privacy Review: Evaluates baseline technical, physical, and administrative safeguards to satisfy institutional IT security, privacy, and procurement requirements.
  2. Step-2 Full OIPC PIA: Required under POPA Section 26(1) and Ministerial Regulation Section 7(5) only if your project triggers specific statutory risk thresholds (e.g., AI, biometric data, or data matching).

Step-1 questions are directly mapped to Sections A, B, and D of the formal Office of the Information and Privacy Commissioner (OIPC) template. If the review team determines your project triggers a Step-2 threshold, you do not start over; you will port your validated Step-1 answers directly into the OIPC template and complete the remaining sections.

Public bodies (e.g., Universities) are legally required under POPA Section 10(1) to protect personal information by making reasonable security arrangements. Non-compliance can result in severe security breaches and statutory fines of up to $125,000 for individuals and $750,000 to $1,000,000 for organizations.

OSTAD Initiative Intake is a mandatory institutional process prerequisite designed to manage technical capacity and prevent duplicate software purchases. All projects, including local, departmental, and faculty-specific software purchases, must secure formal IT Governance approval before any privacy or security review can proceed.

You must submit an intake request through the OSTAD Initiative Intake portal immediately. Operating unvetted software that handles institutional or personal information could expose your unit and the University to security vulnerabilities, data breaches, and significant statutory penalties.

A Step-1 review is mandatory whenever a university member (including researchers) intends to implement new software, cloud services, or online platforms, make substantive changes to an existing data flow, or sign a new or renewed vendor contract accessing personal information. This includes temporary pilots, trials, and proofs-of-concept; no personal information or sensitive institutional information may be inputted into a trial platform until a Step-1 review is completed.

Yes. A Step-1 review is not required for:

  1. Software restricted to individual use that does not store, share, or process institutional data, university records or personal information.
  2. Software included in IST-provisioned images or distributed through software packages published within the image. 
  3. Pre-approved, enterprise-wide platform extensions or plug-ins (e.g., standard Google Workspace/Gmail add-ons).

The review is valid only for the project’s use-case as presented at the time of completion. Proponents must submit an amended Step-1 review if substantive changes are made, including migrating hosting environments, changing integrated AI engine/model versions, or collecting new, higher sensitivity data elements.

The Step-1 PIA Closure Form is the official completion notice issued jointly by the IPRMO and the CISO once your Step-1 PIA review is cleared. Finance, Procurement and Planning (FPP) may request a copy of this form before they proceed with signing, or executing your vendor agreements.

If substantive security or privacy concerns are identified, the project cannot proceed. You must work with the software vendor to implement the required technical security controls or contract amendments and resubmit. If the vendor cannot meet the University's mandatory security baselines, your department may need to select an alternative, compliant software platform.

Yes. Under POPA Section 26(1) and POPA Ministerial Regulation Section 7(5), projects meeting mandatory thresholds cannot be implemented until a full PIA is completed, signed off by the Head of the Public Body, and formally submitted to the OIPC (and an OIPC file number is received).

Please see the University of Alberta’s Data Classification Table of Concordance for an overview of the institution’s classification matrix and mapping to research, provincial and federal classification categories.

Storing personal information outside Canada is heavily restricted because foreign laws (such as the US Cloud Act) can legally compel international vendors to disclose data, regardless of where the data resides, which contractual agreements cannot override. To address this risk, the University evaluates vendor hosting across three tiers based on whether the vendor ownership and physical server locations are Canadian or international. Storing sensitive data outside Canada or on servers managed by foreign-registered vendors requires advanced technical safeguards, such as client-side encryption, and explicit written consent from the University before any international data transfer can occur. For a complete breakdown of compliance requirements, please review the Data Sovereignty and Residency Guidelines.

Yes. While employee academic research information is excluded under POPA, and therefore does not require a Step-2 PIA, any third-party software, cloud service, or SaaS tool used to host or analyze research data containing personal information must undergo a Step-1 PIA Security Review.

The REB reviews the ethical merits, participant consent models, and societal impacts of your study. It does not assess technical IT risks. The Step-1 PIA is a technical evaluation performed by the CISO and IPRMO to ensure that the system or software you are using to store that data and/or personal information is technically secure, contractually compliant, and legally sound.

The HIA only covers designated health custodians like Alberta Health Services or regulated clinics. Because the University of Alberta is not an HIA Custodian, any health or psychological data collected by U of A departments (e.g., counselling, social work, or research) is governed by POPA.

If your department collects this type of data, you are required to complete a Stepped PIA.

Contact Us 

Information, Privacy and Records Management Office

University of Alberta

7-20 University Terrace

8303 - 112 Street NW

Edmonton, Alberta, Canada T6G 1K4

privacy@ualberta.ca

On this page: