When do I have to report a privacy breach in Canada?

A breach of security safeguards under PIPEDA means the loss of, unauthorized access to, or unauthorized disclosure of personal information, whether from a hack, a misdirected email or a lost laptop.

What triggers the duty to report?

A real risk of significant harm to an individual. Under section 10.1, significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on a credit record, and damage to or loss of property. Whether the risk is real depends on the sensitivity of the information and the probability it will be misused.

Example	Likely reportable?
Unencrypted database of names, emails and passwords exposed	Yes, usually
Health, financial or ID information accessed by an unknown party	Yes, usually
Email sent to the wrong customer, who confirms deletion	Often not, but record it
Encrypted laptop lost, key not compromised	Often not, but record it

Who do I notify, and when?

If the test is met, “as soon as feasible” after you determine the breach occurred, as the OPC’s guidance explains:

• The Privacy Commissioner of Canada, using the OPC’s breach report.
• Affected individuals, directly and conspicuously, with enough information to understand the significance of the breach and protect themselves.
• Other organizations, such as a bank or credit bureau, if they can reduce the risk of harm.

There’s no fixed number of days. Don’t wait for a full investigation before reporting; you can update the report.

What records do I need to keep?

A record of every breach of security safeguards, including ones you decide aren’t reportable, for 24 months after you determine the breach occurred, under the Breach of Security Safeguards Regulations. The Commissioner can ask for it. Knowingly failing to report, notify or keep records is an offence under section 28 of PIPEDA, with fines up to $100,000.

What if a vendor has the breach?

If the information is under your control, the duty is usually yours even when a sub-processor was breached. That’s why your data processing agreements should require vendors to tell you quickly. If you’re the vendor, your customers will expect prompt notice from you so they can meet their own duties.

What about Quebec and health information?

• Quebec: for a confidentiality incident that presents a risk of serious injury, notify the Commission d’accès à l’information and the affected people promptly, and keep a register of all incidents. See Quebec’s Law 25 for SaaS.
• Ontario health custodians: PHIPA has its own notice duties to patients and the IPC. See privacy rules for a wellness clinic.

What should I do in the first hours?

Contain the breach, preserve evidence, assess what information was involved and whose, tell your insurer, then decide on reporting. A one-page plan written in advance makes this much easier.

We prepare privacy policies and SaaS agreements with breach terms, at fixed fees on our fees page.

This guide is general information about Ontario and Canadian law, not legal advice for your situation. If you’re dealing with a breach now, book a free 15-minute consult.