Does BC PIPA apply when your staff use ChatGPT?

Short answer: yes, the moment a prompt contains personal information. And the obligation sits with the business, not with the employee who typed it.

This is a practitioner's read of how BC's private-sector privacy law applies to everyday use of generative AI tools, not legal advice. Last reviewed 12 October 2026 against the statute and regulator sources linked below.

Who is on the hook

BC's Personal Information Protection Act (PIPA) defines an "organization" so that it excludes an individual acting as an employee. The person who pastes a client email into ChatGPT is not the regulated party. The company is.

Section 4 makes that explicit in two ways that matter for AI tools:

• An organisation is responsible for personal information under its control, including information that is not in its custody. Data sitting on an AI vendor's servers is still yours to answer for.
• An organisation must designate someone responsible for compliance, and section 5 requires it to develop and follow policies and practices to meet the Act. "We didn't have an AI policy" is not a defence. It is the gap.

When a prompt is in scope

PIPA covers "personal information": information about an identifiable individual, including employee personal information. It excludes business contact information and work product information.

That gives a workable line for staff:

• Asking a model to tighten the wording of a proposal, summarise a public report, or draft a generic policy: out of scope.
• Pasting in a customer complaint with the customer's name, a candidate's CV, a client's medical or financial details, or notes from a performance conversation: in scope.

Most companies do not need to ban AI tools. They need staff to know which side of that line a given prompt sits on.

What the Act asks once you are in scope

A reasonable purpose. Sections 11, 14 and 17 allow collection, use and disclosure only for purposes a reasonable person would consider appropriate in the circumstances. Sending a client's information to a third-party model is a new use or disclosure, and it has to pass that test on its own.

Consent, separately. Reasonableness and consent are two tests, not one. The OIPC BC put it plainly in its January 2026 guidance on AI scribes: "a person cannot consent to something that isn't appropriate; and an organization can't proceed with something that is considered appropriate if a person hasn't consented to it." Your privacy notice almost certainly did not tell customers their information might go to a generative AI vendor.

Employee information has its own rules. Sections 13, 16 and 19 allow employee personal information to be handled without consent only where it is reasonable for managing the employment relationship, and only after notifying the employee. Running performance notes through a chatbot needs that analysis too.

Security. Section 34 requires reasonable security arrangements against unauthorised access, use, disclosure and similar risks. For an AI tool that means knowing the vendor's retention, whether your data trains their models, and who can see it.

Accuracy. Section 33 requires reasonable effort to make sure personal information is accurate if it is likely to be used to make a decision about the person. A hallucinated summary of a customer's history that feeds a decision is a section 33 problem.

Cross-border: no residency rule, but not a free pass

PIPA has no provision restricting transfers outside Canada. The OIPC BC's AI scribes guidance says organisations "can only disclose personal information outside of Canada if they are satisfied that their obligations under s. 34 of PIPA will be met," and that the cross-border risk belongs in the security assessment.

The same guidance includes a vendor checklist worth reusing for any AI tool: does the vendor use your data for secondary purposes such as training the model, is it sent outside Canada, what is the retention policy, will the vendor notify you of a breach, and can you control, modify and delete records.

One question regulators have not settled: whether sending a prompt to a model hosted in the US is itself an interprovincial or international flow that brings PIPEDA into play alongside PIPA. If your answer depends on it, that is a question for counsel, not for a blog post.

What the regulators have said about generative AI

In December 2023 the federal, provincial and territorial privacy commissioners, including BC's, published joint principles for responsible generative AI. For organisations using these tools they come down to: know and document your legal authority, consider whether the use is necessary and proportionate, accept that accountability for decisions rests with you, and safeguard personal information throughout the tool's lifecycle.

In May 2026 the federal commissioner and the BC, Alberta and Quebec regulators reported on their joint investigation of OpenAI. The OIPC BC found OpenAI contravened PIPA on all but one of thirteen issues, and the regulators found that using users' chats for training fell outside users' reasonable expectations. Those findings are about OpenAI as the developer, not about a BC business whose staff use ChatGPT. But they show how the regulator reads consent and reasonable expectations, and that reading applies to you too.

Breach notification

As of October 2026, PIPA has no mandatory breach notification. The OIPC BC encourages reporting where there is a significant risk of harm, and notifying affected people can still follow from your section 34 duty. Where PIPEDA applies to the data, its mandatory "real risk of significant harm" reporting does apply.

Penalties under PIPA are modest next to Quebec's: offences carry fines of up to $100,000 for organisations, and individuals can sue for damages for a breach of the Act. The bigger practical risk is the investigation, the remediation and the client conversation.

Five things to put in place

1. A one-page acceptable-use rule. Which tools are approved, and the work-product line: no identifiable customer, candidate or employee information in prompts unless the tool is approved for it.
2. Approved tools on business terms. Business and enterprise tiers typically let you turn off training on your data and set retention. Check the vendor against the OIPC checklist above and keep the answers.
3. A notice that matches reality. If personal information will go to an AI vendor, your privacy notice and employee notice need to say so before it happens.
4. A named owner. Section 4 already requires one for privacy. Make AI tool approval part of that role rather than a separate committee.
5. An inventory of where AI is already in use. Staff are almost certainly using tools nobody approved. You cannot apply any of the above to use you do not know about.

That last step is the starting point of our AI readiness and privacy assessment: a one-week inventory of the AI already in use, checked against PIPA, PIPEDA and, where relevant, Quebec's Law 25.