# Protecting Children's Personal Information in BC Programs > Community programs collect a lot about children. Here is what counts as their personal information and what BC's privacy law expects you to do with it. Published: 2026-09-04 Author: Andrey (OpenCommunity Team) ## Key takeaways - In BC, private-sector privacy law (PIPA) applies to most non-profit community organizations, not just businesses. - A child's name, birthdate, address, photo, family relationships, and health notes are all personal information you are responsible for protecting. - Collect only what a program genuinely needs, and be able to explain why you are asking for each field. ## Why children's data deserves extra care When a parent signs a child up for a program, they hand you a surprising amount of sensitive detail: the child's full name, birthdate, home address, who they live with, allergies, and sometimes photos. Children cannot meaningfully consent to most of this themselves, and the information can follow them for years, so regulators treat it as especially sensitive. In BC, protecting it is not just good practice, it is the law. Handling it well also builds trust with families, especially newcomers who may be cautious about giving information. ## Which privacy law applies to your centre In British Columbia, the **Personal Information Protection Act (PIPA)** governs how private-sector organizations, including non-profits and charities, collect, use, and disclose personal information. This is broader than the federal law, PIPEDA, which mainly applies to commercial activity, so many community organizations that would fall outside PIPEDA are still fully covered by PIPA in BC. Public bodies like school districts and municipalities follow a different law, FIPPA, instead. For the Canada-wide picture, start with [privacy basics for community organizations](https://opencommunity.ca/blog/privacy-laws-community-organizations-pipeda/index.md). Other provinces differ. Alberta has its own PIPA, Quebec has Law 25, and organizations elsewhere generally fall under PIPEDA. If you operate only in BC, PIPA is your starting point. > Tip: The BC Office of the Information and Privacy Commissioner (OIPC) publishes plain-language guides for small organizations at oipc.bc.ca. ## What counts as a child's personal information Personal information is any information about an identifiable individual. For a child in your programs, that usually includes: - Full name, birthdate, and age. - Home address and contact details. - Family relationships, such as who their parents or caregivers are and who lives in the household. - Photos and video. - Health details like allergies, medications, and accessibility needs. - Attendance and program history. Some of these are more sensitive than others. Health details and family circumstances deserve tighter handling than a first name on a name tag. The more sensitive the information, the more care and the clearer the consent you need. ## Collect only what the program needs The single most useful habit is **collecting less**. Under PIPA you may only collect personal information a reasonable person would consider appropriate for the purpose you have identified. So for each field on your form, ask a plain question: what program decision does this help us make? A cooking program needs allergies. It probably does not need a child's full home address if a parent's phone number would do. Our field-by-field walkthrough of [what participant information to collect](https://opencommunity.ca/blog/what-participant-information-to-collect/index.md) is a useful companion when you are trimming a form. Fewer fields mean less to protect, less to explain, and less to lose. When you do collect sensitive details, tell families why, in plain language. For how consent works when the participant is a child, see [who can consent for a child under BC privacy rules](https://opencommunity.ca/blog/parental-consent-childrens-privacy-bc/index.md). ## Everyday habits that protect kids' records You do not need an enterprise security team to handle children's data responsibly. A few habits do most of the work: 1. Limit who can see what. Give staff and volunteers access to the information their role needs, and no more. 2. Keep it in one place. Scattered spreadsheets and paper forms are harder to secure and easier to lose than a single system with sign-in controls. 3. Write down your practices. PIPA expects a privacy policy that families can read and a named person responsible for privacy. 4. Destroy what you no longer need. Once a purpose is fulfilled and no law requires you to keep a record, dispose of it securely. These same habits make it easier to answer a parent who asks to see or correct what you hold, which is their right under PIPA. > Note: This article is general information only and is not legal, financial, or professional advice. For questions about your organization's obligations, consult a qualified professional or the relevant government resource (for example, the CRA for registered charity matters, or your provincial or territorial registry for nonprofit governance). ## Questions and answers ### Does BC privacy law apply to a small non-profit? Yes. PIPA applies to private-sector organizations in BC including non-profits and charities, regardless of size. If you collect personal information about participants, you have obligations under it. ### Is a child's photo personal information? Yes. A photo or video of an identifiable child is personal information, so you should get specific consent before taking or publishing images, and store them with the same care as other records. ### What is the difference between PIPA and PIPEDA? PIPA is BC's private-sector privacy law and covers non-profits broadly. PIPEDA is the federal law and mainly applies to commercial activity. In BC, most community organizations look to PIPA first. ### Do we have to have a privacy policy? Yes. PIPA expects organizations to be open about their practices, which in practice means a written privacy policy families can understand and a designated person responsible for privacy. ### Can parents ask to see the information we hold about their child? Generally yes. PIPA gives individuals a right to access and correct their personal information, and for a young child that request usually comes from a parent or guardian. Confirm the details with the OIPC. ## More from OpenCommunity - [All resources](https://opencommunity.ca/blog/index.md): Browse every published guide. - [OpenCommunity features](https://opencommunity.ca/features/index.md): Explore the platform.