Definition
Breach record
In one sentence
A breach record is the documented log that organizations must keep of privacy breaches, such as PIPEDA's requirement to record every breach of security safeguards involving personal information for 24 months, and Quebec Law 25's confidentiality incident register.
Personal Information Protection and Electronic Documents ActQuebec Law 25Real risk of significant harm
Breach Record Explained
Many organizations focus on whether a breach must be reported and overlook the record-keeping duty, which applies regardless. Under PIPEDA, organizations must keep a record of every breach of security safeguards involving personal information under their control, whether or not it creates a real risk of significant harm. Records must be kept for 24 months after the organization determines the breach occurred, and the Office of the Privacy Commissioner of Canada can request them.
Records should contain enough information for the OPC to verify compliance, including the date or estimated date, a description of the circumstances, the information involved, and whether the breach was reported and notified, with reasons if not.
Quebec Law 25 requires a similar register of all confidentiality incidents, with content set by regulation and retention for a minimum period. Small incidents count: an email with client information sent to the wrong person is a breach that belongs in the record. Keeping a simple, consistent log, with a documented risk assessment for each entry, is one of the easiest privacy obligations to meet and one of the most frequently missed.
General information for Canadian organizations, not legal advice.