Calgary Data Breach Reporting - Bylaw Guide

Technology and Data Alberta 3 Minutes Read · published February 11, 2026 Flag of Alberta

Calgary, Alberta residents and city staff must follow municipal and provincial rules when a city data breach occurs. This guide explains who to notify, how to document incidents, the municipal office responsible for access and privacy, and practical steps to report a suspected or confirmed breach involving city-held records. It summarizes enforcement pathways, common violations, and how to appeal or request review. Use the action steps in the How-To section to act quickly and preserve evidence; for formal complaints about FOIP compliance contact the city Access and Privacy office listed below.

Report breaches promptly to reduce risk to affected individuals.

Penalties & Enforcement

The City of Calgary handles municipal privacy and access matters through its Access and Privacy office within City Clerks, and enforcers include municipal officers and the provincial oversight body for FOIP. For the City of Calgary Access and Privacy contact and guidance see the official page below City of Calgary - Access & Privacy[1].

  • Fines: not specified on the cited page; consult the city or provincial FOIP Act for statutory penalties.
  • Escalation: first, internal corrective orders or notices; repeat or continuing breaches may lead to formal investigations by provincial oversight - specific escalation ranges not specified on the cited page.
  • Non-monetary sanctions: corrective orders, directions to secure or destroy records, administrative reviews, and court action are possible; exact remedies depend on findings and statute.
  • Enforcer and complaint pathway: City Access and Privacy office for internal complaints and the Office of the Information and Privacy Commissioner of Alberta for external complaints.
  • Appeals and review: administrative reviews to the city; external complaint to provincial OIPC; statutory time limits for appeals are not specified on the cited page.
  • Defences and discretion: reasonable excuse or authorized disclosures under FOIP may apply; specific defences depend on statutory provisions and are determined case by case.
Municipal pages provide contact and process info but may not list statutory fines or precise time limits.

Applications & Forms

The City does not publish a specific municipal "data breach fine" form on the cited page; forms and reporting instructions for access or privacy requests are provided by the Access and Privacy office or on related City pages, or by provincial OIPC guidance as applicable City of Calgary - Access & Privacy[1].

How-To

  1. Identify the incident: note date/time, systems affected, data types exposed, and initial scope.
  2. Preserve evidence: do not alter logs or affected devices; capture screenshots and export system logs where possible.
  3. Notify City Access and Privacy office promptly and follow internal reporting steps; provide the documented facts and evidence.
  4. Assess harm: determine if personal information was exposed and whether there is a real risk of significant harm to individuals.
  5. Notify affected individuals if required by FOIP and follow any provincial notification guidelines as appropriate.
  6. If internal resolution is not satisfactory, submit a complaint to the Office of the Information and Privacy Commissioner of Alberta.
Keep a secure, dated record of all actions taken after discovering a breach.

FAQ

Who should I contact first if I find a suspected city data breach?
Contact the City of Calgary Access and Privacy office immediately and follow your department's incident reporting protocol.
Will the city notify affected individuals?
Yes when FOIP or risk assessment indicates a likely risk of significant harm; notification procedures follow statutory and municipal guidance.
Can I file an external complaint?
Yes, you may file a complaint with the Office of the Information and Privacy Commissioner of Alberta after exhausting municipal processes.

Key Takeaways

  • Report quickly and preserve evidence to reduce harm and support investigation.
  • The City Access and Privacy office is the primary municipal contact for breaches.
  • Provincial OIPC provides external oversight and complaint routes under FOIP.

Help and Support / Resources

    Categories

    General Governance and Administration Public Safety Public Health and Welfare Land Use and Zoning Housing and Building Standards Transportation Environmental Protection Parks and Public Spaces Business and Consumer Protection Taxation and Finance Labor and Employment Education Civil Rights and Equity Elections and Campaign Finance Events and Special Uses Signs and Advertising Utilities and Infrastructure Technology and Data