Real risk of significant harm

Under PIPEDA, significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on a credit record and damage to or loss of property.

Assessing whether the risk is real involves two main factors. The first is the sensitivity of the personal information: health records, social insurance numbers, banking details, government identification and login credentials are highly sensitive. The second is the probability of misuse: whether the information was encrypted, who obtained it, whether there is evidence it was taken or used, how long it was exposed and whether it has been recovered.

The assessment must be documented, and records of every breach must be kept for 24 months whether or not the threshold was met. Quebec Law 25 uses a similar but distinct test, risk of serious injury. Organizations commonly involve privacy counsel and incident responders, since the facts established by forensic investigation largely determine the answer.