Calgary Data Sharing Agreements and Third-Party Controls

Technology and Data Alberta 4 Minutes Read · published February 11, 2026 Flag of Alberta

Calgary, Alberta municipal bodies increasingly share data with vendors, contractors and partner agencies. This guide explains how local rules, administrative controls and procurement obligations shape data sharing agreements, vendor security requirements and complaint paths for municipal staff, councillors, contractors and privacy officers in Calgary. It summarizes enforcement routes, common violations, practical steps to draft or review agreements, and where to find official forms and contacts for compliance or appeals.

Scope and Applicable Instruments

Municipal data sharing in Calgary is governed by municipal administrative policies and broader access and privacy law. For City-specific information and records handling guidance, consult the City of Calgary access and privacy pages and procurement requirements when contracting third parties. City of Calgary Access and Privacy[1] and City of Calgary procurement rules[2] provide operational guidance for agreements and vendor controls.

Start data sharing reviews early in procurement to address privacy and security requirements.

Key Contractual Controls

  • Include a narrow purpose clause that limits use of shared data and requires deletion or return at contract end.
  • Specify records, audit and reporting rights for the City, including frequency and format of audit evidence.
  • Mandate technical and organizational security measures (encryption, access controls, incident response timelines).
  • Allocate liability, indemnities and insurance requirements for data breaches or unauthorized disclosures.
  • Require subprocessors and flow-down clauses so third-party subcontractors meet the same obligations.

Operationally, include a data inventory schedule, breach notification procedure and retention/destruction timelines in the agreement.

Penalties & Enforcement

Enforcement can arise from municipal compliance processes, procurement remedies, or provincial access and privacy law where applicable. The City’s access and privacy guidance and procurement pages describe responsibilities but do not list specific municipal fine amounts or detailed penalty schedules for data-sharing violations; such monetary penalties are not specified on the cited page. City of Calgary Access and Privacy[1]

  • Fines and monetary penalties: not specified on the cited page.
  • Escalation: initial remediation, contract remedies (withholding, termination), repeat/continuing breaches may lead to contract termination or procurement debarment—specific ranges not specified on the cited page.
  • Non-monetary sanctions: orders to cease processing, contract suspension or termination, audit or mandatory corrective plans; provincial remedies under FOIP may also apply where relevant.
  • Enforcer and complaint pathway: Bylaw Enforcement and the City administrative offices handle municipal complaints and contract compliance; official submission and contact routes are available via the City’s bylaw/contact pages and procurement contacts. City Bylaw Enforcement contact[3]
  • Appeals and review: appeal routes vary by instrument—procurement debriefs and protest procedures and administrative reviews may exist; specific appeal time limits are not listed on the cited procurement page. City of Calgary procurement rules[2]
  • Defences and discretion: common contractual defences include reasonable excuse, contractor mitigation steps, and approved variances or exemptions within a signed agreement; availability depends on the contract and policy.
If a penalty amount or statutory limit is required for action, confirm the figure on the controlling bylaw or provincial statute.

Applications & Forms

  • No single universal City "data sharing" form published on the cited pages; procurement and access/privacy sections list templates and guidance depending on the transaction—check the procurement and access pages for contract templates and privacy impact assessment guidance.

Where formal permissions, variances or data access reviews are required, procurement and privacy officers typically require a written agreement and may request a privacy impact assessment; fees and deadlines are set per procurement or project and are not consolidated on a single page.

Practical Steps to Draft or Review an Agreement

  1. Identify the legal basis and lawful purpose for the data sharing.
  2. Map data categories, retention periods and authorized users.
  3. Specify security controls, audits and breach notification timelines.
  4. Include clauses for audits, approval of subprocessors and termination for cause.
  5. Coordinate with City procurement and access/privacy officers before final signature.

Common Violations

  • Unauthorized disclosure of personal information or sharing beyond the agreed purpose.
  • Failure to implement required security controls or to report breaches on time.
  • Not including required flow-down clauses for subcontractors.
  • Refusal to permit audits or provide records when contractually required.
Document decision-making and approvals when exceptions to standard data controls are granted.

FAQ

Who in the City enforces data sharing controls?
The City’s access and privacy office, procurement group and bylaw enforcement teams share responsibility depending on whether the issue is privacy, contract compliance or a bylaw matter.
Are there standard City templates for data sharing?
The City publishes procurement templates and guidance; a single universal data-sharing form is not published on the cited pages—check procurement and access/privacy guidance for templates.
How do I report a suspected data breach involving a contractor?
Report immediately to the City privacy or procurement contact and follow contractual breach-notification timelines; refer to City access and privacy guidance for procedures.

How-To

  1. Identify stakeholders and document the lawful purpose for data sharing.
  2. Complete a data inventory and conduct a privacy impact assessment if required.
  3. Draft contractual terms: purpose, retention, security, audit and breach notification.
  4. Obtain procurement and privacy officer review and approvals before signature.
  5. Monitor compliance, audit as scheduled, and enforce remedies for breaches.

Key Takeaways

  • Start privacy and procurement reviews early in project planning.
  • Include audit, breach notification and subcontractor controls in every agreement.

Help and Support / Resources

  1. [1] City of Calgary Access and Privacy
  2. [2] City of Calgary Procurement
  3. [3] City of Calgary Bylaw Enforcement contact

Categories

General Governance and Administration Public Safety Public Health and Welfare Land Use and Zoning Housing and Building Standards Transportation Environmental Protection Parks and Public Spaces Business and Consumer Protection Taxation and Finance Labor and Employment Education Civil Rights and Equity Elections and Campaign Finance Events and Special Uses Signs and Advertising Utilities and Infrastructure Technology and Data