Privacy Breach Notification — PIPEDA (Canada)

A Privacy Breach Notification — PIPEDA in Canada notifies affected individuals and the regulator of a privacy breach as required by PIPEDA, governed primarily by PIPEDA and its breach-notification requirements.

A 'breach of security safeguards' under PIPEDA s.10.1 means the loss of, unauthorized access to, or unauthorized disclosure of personal information resulting from a breach of the organization's security safeguards under PIPEDA Principle 7 (Safeguards), or from a failure to establish those safeguards. This includes cyberattacks (hacking, ransomware, phishing), accidental disclosures (misdirected emails, lost USB drives, mailed documents sent to wrong address), and theft or loss of devices or paper records containing personal information.

PIPEDA applies to the collection, use, and disclosure of personal information by private sector organizations in the course of commercial activity in Canada — including federal works, undertakings, and businesses, and organizations that transfer personal information across provincial or national borders. Organizations carrying on business exclusively within Alberta, British Columbia, or Quebec are generally subject to their provincial private sector privacy legislation (PIPA AB, PIPA BC, or Law 25 QC) rather than PIPEDA, unless they engage in interprovincial or international transactions.

The PIPEDA breach notification framework has three core obligations: (1) notification to the OPC as soon as feasible after determining a breach creates a real risk of significant harm; (2) notification to affected individuals as soon as feasible where the breach creates a real risk of significant harm to those individuals; and (3) 24-month record retention of all breaches of security safeguards, regardless of whether they create a real risk of significant harm.

The legal framework governing the Privacy Breach Notification — PIPEDA (Canada) in Canada draws on several key statutes and regulatory bodies. Under the Canada Business Corporations Act (R.S.C. 1985, c. C-44), Corporations Canada maintains the federal registry. Section 12 of the CBCA governs corporate name requirements. The Competition Bureau enforces the Competition Act (R.S.C. 1985, c. C-34). Provincial securities commissions — including the Ontario Securities Commission (OSC) and British Columbia Securities Commission (BCSC) — regulate capital markets. The Federal Court of Canada has jurisdiction under the Federal Courts Act. Parties executing a Privacy Breach Notification — PIPEDA (Canada) in Canada should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Canada Business Corporations Act (R.S.C. 1985, c. C-44) sets the foundational requirements.

A PIPEDA Privacy Breach Notification is required whenever an organization subject to PIPEDA determines that a breach of security safeguards has occurred involving personal information that creates a real risk of significant harm to the affected individuals. The notification obligation is triggered by the organization's determination — not by the actual occurrence of harm — so organizations must act promptly once they become aware of a potential breach.

In practice, a breach notification is needed in the following circumstances. Cyberattacks: When an organization's systems are compromised by unauthorized access, ransomware, malware, or phishing attacks that may have exposed personal information — including names, SINs, financial account numbers, health records, passwords, or other sensitive data. Accidental disclosures: When personal information is mistakenly sent to the wrong recipient (e.g., a misdirected email containing client financial records, a letter sent to the wrong address, or a document inadvertently posted publicly). Lost or stolen devices: When a laptop, USB drive, or mobile device containing unencrypted personal information is lost or stolen. Third-party vendor breaches: When a third-party service provider or subcontractor that processes personal information on the organization's behalf experiences a breach — because the organization remains the controller responsible for notification under PIPEDA.

Organizations should conduct a rapid risk assessment within 24-72 hours of discovering a potential breach to determine whether the breach creates a real risk of significant harm. This assessment considers the sensitivity of the information involved and the probability of misuse. High-sensitivity data (SINs, financial account numbers, health records, passwords) breached by a malicious actor is almost always a real risk of significant harm. Lower-sensitivity data inadvertently disclosed to a known, trustworthy party may not meet the threshold.

Note that even when a breach does not meet the real risk of significant harm threshold, the organization must still maintain a record of the breach for 24 months and make it available to the OPC on request.

Under the Canada Business Corporations Act (R.S.C. 1985, c. C-44), Corporations Canada maintains the federal registry. Section 12 of the CBCA governs corporate name requirements. The Competition Bureau enforces the Competition Act (R.S.C. 1985, c. C-34). Provincial securities commissions — including the Ontario Securities Commission (OSC) and British Columbia Securities Commission (BCSC) — regulate capital markets. The Federal Court of Canada has jurisdiction under the Federal Courts Act.

A thorough PIPEDA Privacy Breach Notification to the OPC must include the following elements, as prescribed by the Breach of Security Safeguards Regulations.

Organization Identification: The organization's full legal name, principal address, and the name, title, email, and phone number of the Privacy Officer designated under PIPEDA Principle 1 (Accountability). The Privacy Officer is the contact for OPC communications and for individuals seeking information about the breach.

Breach Description: A clear, factual description of the circumstances of the breach — including when it occurred (or the estimated range of dates), when it was discovered, and how it was discovered. Identify the type of breach (unauthorized access, accidental disclosure, theft, ransomware, etc.) and describe the specific systems, records, or processes involved.

Personal Information Involved: A specific description of the categories of personal information that were or may have been compromised — full names, dates of birth, SINs, financial account numbers and types, health information, passwords or authentication credentials, and any other personal data. Identify the approximate number of individuals whose information was involved and the geographic scope (provinces, countries).

Risk of Significant Harm Assessment: Document the organization's assessment of whether the breach creates a real risk of significant harm under PIPEDA s.10.1(3) and Breach Regulations s.3. Consider: the sensitivity of the information (SINs and financial data are highly sensitive); the probability of misuse (malicious access is higher risk than accidental disclosure to a trusted party); and other relevant factors. Identify the potential types of harm (financial loss, identity theft, reputational damage, etc.).

Containment and Remediation: Describe actions taken to contain the breach (isolating systems, revoking access, notifying payment processors) and remediation measures planned or underway (forensic investigation, security patches, staff training, policy changes).

OPC Notification and Individual Notification Details: Record the date OPC was notified, any OPC reference number assigned, the method of notifying affected individuals, the date notifications were sent, and the key information included in the individual notification messages.

Record-Keeping: Document the internal incident reference number for the organization's 24-month breach record, the date of the notification document, and the name and title of the person preparing the notification.

Additional compliance elements for a Privacy Breach Notification — PIPEDA (Canada) used in Canada include: Under the Canada Business Corporations Act (R.S.C. 1985, c. C-44), Corporations Canada maintains the federal registry. Section 12 of the CBCA governs corporate name requirements. The Competition Bureau enforces the Competition Act (R.S.C. 1985, c. C-34). Provincial securities commissions — including the Ontario Securities Commission (OSC) and British Columbia Securities Commission (BCSC) — regulate capital markets. The Federal Court of Canada has jurisdiction under the Federal Courts Act. Forms-legal.com provides this template as a starting point for Canada-compliant documentation.