How BC PIPA changes donor data handling for Vancouver nonprofits

What to take away

What BC PIPA requires of Vancouver charity donor databases

British Columbia's Personal Information Protection Act (BC PIPA) governs how private organizations, including charities, handle personal information. For a Vancouver charity, donor data is personal information: names, addresses, giving history, email opens and phone numbers all count. The Personal Information Protection Act sets the statutory rules for that handling.

The Act requires organizations to collect only what they need, state the purpose before or at collection, and keep the information accurate for the purpose. A donation form that asks for a birth date with no stated use is a problem. A Vancouver food-security charity collecting employer details for matching gifts should say so on the form.

Donors can ask to see the personal information a charity holds about them and request corrections. Your donor database must be able to produce a single donor's record, including notes fields, within the response window. If your CRM spreads a donor across household, gift and volunteer records, you need a process to assemble them.

BC PIPA also limits disclosure. Sharing a donor list with a partner organization or a mailing house requires consent unless an exception applies. The same applies to cloud storage: if your donor database is hosted outside Canada, you are still accountable for it.

Section 7 of the Act requires a comparable level of protection when information goes to a service provider.

Accountability is not optional. A charity must designate someone responsible for compliance and protect information with safeguards appropriate to its sensitivity. For a small Vancouver arts nonprofit, that might mean role-based access in the CRM and no donor exports on personal laptops.

Consent under BC PIPA versus PIPEDA for BC nonprofits

PIPEDA is the federal private-sector law, and it applies where provinces have not enacted substantially similar legislation. British Columbia has, so BC PIPA governs most charitable fundraising in the province.

The Summary of privacy laws in Canada - Office of the Privacy Commissioner of Canada explains how federal and provincial statutes divide the field.

Under PIPEDA, consent can be implied in some circumstances and the model is built around knowledge and consent. BC PIPA also allows implied consent, but only where the purpose would be obvious to a reasonable person and the information is not sensitive.

Donation history can be sensitive when it reveals health, religion or political views. A gift to a Vancouver refugee-support charity may imply something a donor does not want shared.

Express consent is safer for any new purpose. If you want to use donor data for a lapsed donor reactivation campaign, get clear consent for that contact. Email consent also has to satisfy casl nonprofit email compliance, which is separate from privacy consent and enforced federally.

Opt-out mechanisms must be easy. BC PIPA requires an individual to be able to withdraw consent, and the organization must explain the consequences. For a monthly giving programme, withdrawal may mean the donation stops. Say that plainly rather than burying it.

Minors need extra care. A Vancouver youth-serving charity collecting donor data from a school programme should have a parent or guardian consent where the donor is under the age of majority. BC PIPA treats consent from minors as valid only if they can reasonably understand the nature of the collection.

Breach notification and record-keeping duties

BC PIPA requires an organization to notify the Commissioner and affected individuals when a breach of personal information creates a real risk of significant harm. A stolen laptop with an unencrypted donor file is the classic case. So is a misdirected email with a major donor list, or ransomware that locks a Vancouver charity out of its donor database.

Notification must happen without unreasonable delay. The notice should describe the breach, the information involved and the steps the individual can take. The Commissioner may require the organization to notify others, and the organization must keep records of every breach, even those not reported.

Record-keeping also covers consent. You should be able to show when and how a donor consented, and what they were told. Privacy policies need review dates. If your policy still references a mailing house you stopped using in 2023, it is out of date.

Retention is part of the duty. Keep donor records only as long as needed for the purpose and for CRA charitable receipt requirements. After that, destroy or anonymize. A Vancouver environmental charity with twenty years of donor files should not be storing them indefinitely because deletion feels risky.

Staff training is a control, not a nicety. Volunteers who handle donor lists at events need to know not to photograph a sign-in sheet. A short annual briefing with a sign-off record is enough for most small charities.

Practical steps for auditing a Vancouver donor database

An audit is a set of concrete checks, not a policy rewrite. Set aside two sessions and work through the following steps with the person who runs your CRM.

Use this checklist to record what you find.

After the audit, fix the highest-risk gaps first. Consent records and access controls usually matter more than a new policy document. If your donor acquisition forms collect data you never use, change the forms before the next campaign.

The audit also feeds fundraising work. Cleaner consent data improves donor retention because donors get fewer irrelevant messages. It also makes mapping donor drop-off more accurate, since each touchpoint has a known data purpose.

Where BC PIPA sits among Canadian privacy laws

Canada has no single privacy statute for charities. PIPEDA covers federally regulated organizations and provinces without substantially similar laws. British Columbia, Alberta and Quebec have their own private-sector statutes. Quebec Law 25 modernized that province's rules, and Ontario's FIPPA covers public bodies, not charities.

That patchwork matters for Vancouver nonprofits that fundraise across borders. A donor in Alberta is covered by Alberta's PIPA, which is similar but not identical. A donor in Quebec has additional rights under Law 25. Your national donor database may need province-specific consent language.

Sector programmes add expectations. The Imagine Canada Standards Program asks charities to demonstrate privacy accountability, and many foundation funders ask for a privacy policy before releasing grants. CanadaHelps and other platforms handle some donor data, but your charity remains accountable for what you receive and store.

CRA's Charities Directorate does not enforce privacy law, but it expects charities to follow the law and to keep adequate books and records. A privacy complaint that becomes public can affect public trust and, in serious cases, a charity's standing.

For a nonprofit donor privacy laws by state comparison, remember that Canadian provinces function like states for privacy purposes.

Use the province's own resources. The Data and information management - Province of British Columbia pages cover records and information management, which is useful when building a retention schedule. For legal context and complaint routes, the Law, crime and justice - Province of British Columbia pages point to the right bodies.

Common questions