Your practice
In most cases, no — and a lot of privacy marketing implies otherwise.
In British Columbia and under Alberta's Personal Information Protection Act, failing to safeguard information is not an offence. The offence provisions cover things like deceiving people during collection, obstructing the Commissioner, and disobeying an order. Losing a device is not among them.
The privacy commissioners also cannot issue fines. In a 2026 Alberta case where a safeguards contravention was formally proven, the adjudicator wrote that her order powers did not include the authority to issue fines. The remedy was to implement safeguards and document them.
One real exception: Alberta's Health Information Act does make a custodian's failure to maintain safeguards an offence, carrying up to $200,000 for an individual. But in practice, every health-privacy conviction in Alberta since 2001 has been for deliberate snooping by an employee, the largest fine ever was $15,000, and the Commissioner has said publicly that the offence provisions are largely failing.
We could not find a single Canadian penalty imposed on a small practice for a lost or unencrypted device.
Encrypt the device anyway, and not out of fear. Alberta's own regulation lists encryption as a factor weighing against a breach being reportable at all. An encrypted laptop that goes missing may never become a notifiable breach, which avoids notifying patients, the Commissioner and the Minister. That is a better reason than a fine that does not arrive.
If a device has already gone missing with records on it, get advice quickly. The question of whether it is reportable is time-sensitive and fact-specific, and it is the one place where getting it wrong has consequences.
A · Verified
Checked 6 Sep 2026 · Review by Mar 2027
BC PIPA s.56 and Alberta PIPA s.59 offence provisions read directly. Alberta OIPC Order HIA2026-01 read directly for the no-fine finding. Conviction history and Commissioner's comments from the Alberta OIPC 2023-24 and 2024-25 Annual Reports. Encryption safe-harbour from Alberta's Health Information Regulation AR 70/2001 s.8.1(1)(f).
Still open: We searched specifically for a Canadian penalty against a small practice for a lost device and found none. Absence of evidence is not proof; if you know of one, tell us and we will correct this.
Every correction we have made is published. Nobody pays us.