RROSH Hour: Privacy Breach Response

Cyber incidents and accidental or unauthorized disclosure of personal information have become routine business risks for organizations operating in Canada. The legal, operational and reputational costs of getting the response to a breach wrong can be significant. Advance planning is therefore essential, particularly for organizations that handle personal information across multiple Canadian jurisdictions, where reporting triggers, timelines and enforcement risks are not uniform.

Canada comprises a patchwork of ever-changing privacy laws and regulations. Each province and territory has its own public sector privacy legislation. Private sector organizations are generally subject to the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”),¹ while British Columbia, Alberta and Quebec have enacted their own private-sector privacy statutes of general application.²

Additional sector-specific laws, guidelines and other requirements apply to banking, financial services, health care, telecommunications and federal elections, making it critical to know which framework or frameworks govern a particular organization. For organizations operating nationally, this patchwork means that a single incident can trigger different legal obligations in different jurisdictions, all arising from the same facts.

Quebec’s privacy legislation includes some of the most significant administrative monetary penalties currently available under Canadian privacy law of up to C$10 million or two percent of worldwide turnover.

When Is Breach Reporting Required?

The Canadian privacy landscape has shifted toward mandatory breach reporting. Under PIPEDA, Alberta’s private sector legislation and Quebec’s private sector legislation, organizations must report breaches to privacy commissioners and affected individuals where there is a real risk of significant harm (“RROSH”), or, in Quebec, the breach “presents a risk of serious injury.” The risk analysis is fact-specific, requiring consideration of the sensitivity of the personal information, the likelihood of misuse and the nature of the potential harm. If the threshold is met, notification must be made “as soon as feasible” (PIPEDA), “without unreasonable delay” (Alberta) or “promptly” (Quebec).

While these standards appear similar, their interpretation and enforcement vary, requiring careful jurisdiction-by-jurisdiction analysis rather than a single national response strategy. British Columbia does not currently mandate private sector breach reporting. However, voluntary notification is encouraged by the regulator and may assist in managing reputational risk and civil exposure. As a result, organizations responding to the same breach across multiple provinces may face mandatory reporting in some jurisdictions and discretionary decisions in others, increasing coordination risk.

Public sector bodies and health sector organizations are generally subject to mandatory reporting obligations across Canada, in some cases on expedited timelines. In the health context, there is typically no risk assessment or reporting threshold; a patient must be informed even if there is no risk. Federally regulated financial institutions must notify the Office of the Superintendent of Financial Institutions within 24 hours, while investment dealers must report to the Canadian Investment Regulatory Organization within three days. These overlapping and accelerated timelines can complicate incident response when organizations are subject to multiple regulators with different reporting expectations.

The timing and content of breach notifications have attracted increased scrutiny, particularly in Quebec, Ontario and Alberta, where organizations are facing an increase in putative privacy class actions relating to breach response practices. Privacy class action trends in British Columbia continue to focus on data misuse allegations.

Responding to a Privacy Breach

When a breach occurs, early action is critical. The first hours matter. Organizations should promptly alert internal stakeholders and engage external counsel and forensic experts to contain the incident. Once the breach has been contained, organizations must assess the nature and scope of the breach and the personal information involved across jurisdictions, as this assessment will drive different reporting notification and mitigation obligations to regulators, affected individuals and, where appropriate, law enforcement. Contractual notification obligations, which are often subject to strict timelines and liability allocations, add an additional layer to privacy breach response across jurisdictions. 

Privilege considerations should be addressed from the outset. Copying in-house counsel on communications does not automatically attract solicitor-client or litigation privilege, and external counsel should proactively manage privilege risks throughout the response.

Breaches Involving Sensitive Personal Information

When a breach involves sensitive personal information, such as medical records, financial data, biometrics or children’s information, the reporting threshold is more likely to be met. Organizations need to implement security safeguards proportionate to sensitivity, and they should collect, use and disclose only what is necessary. Data security, retention and destruction policies should be reviewed regularly. Limiting the collection and retention of personal information to what is necessary in the circumstances is required by privacy laws, and it also helps reduce the impact of a cybersecurity incident.

Employee training plays a critical role in breach detection and response. Clear guidance on the handling of personal information and early incident reporting can significantly mitigate harm. Breach reporting should be encouraged rather than discouraged, recognizing that early disclosure often limits downstream risk.

In responding to a privacy breach, perfection is not required, but reasonableness is. Organizations that understand and plan for their legal obligations, sector-specific requirements and contractual commitments are better positioned to respond calmly and strategically through containment, risk assessment, notification and prevention. In a cross-jurisdictional environment, preparation remains the most effective breach-response tool.

1. Personal Information Protection and Electronic Documents Act, SC 2000, c 5.
2. Personal Information Protection Act, SBC 2003, c 63; Personal Information Protection Act, SA 2003, c P-6.5; Act respecting the protection of personal information in the private sector, CQLR c P-39.1.