Guides

The PlaybooksDecision-Makers Use.

Insurance requirements, breach response, certification and what security should cost, explained in depth.

Get a free security assessment

In-depth guides: 8
No sign-up needed: Free
Law and context: Canadian

Cyberphore guide

Cyber insurance requirements in Canada

2,000 words · 2026 edition

Cyberphore guide

Privacy breach response in Canada

2,000 words · 2026 edition

Cyberphore guide

SOC 2 readiness for Canadian SaaS

2,000 words · 2026 edition

Certified partner of

Start here

Most Needed When the Pressure Is On

Compliance and privacy9 min read · 13 sections

Privacy Breach Response in Canada: Who to Notify and When

After a privacy breach in Canada, you need to contain it, assess the risk of harm, and decide quickly who must be notified under PIPEDA, Quebec Law 25, Alberta PIPA or another applicable law. This guide sets out the steps, the legal tests, the people to call and the records you must keep.

Key takeaways

Contain first, then assess: you cannot decide on notification until you know what data was involved and who could access it.
PIPEDA and Alberta PIPA use a real risk of significant harm test; Quebec Law 25 uses a risk of serious injury test.
Under PIPEDA you must keep a record of every breach of security safeguards for 24 months, even when it is not reportable.

Read the guide

Cyber insurance9 min read · 9 sections

Cyber Insurance Requirements in Canada: What Insurers Ask

Canadian cyber insurers now expect a set of baseline controls, led by multi-factor authentication, endpoint detection and response, tested backups and staff training, before they will quote or renew. This guide explains what underwriters ask, why, and how to collect evidence that keeps your answers accurate when you make a claim.

Key takeaways

Multi-factor authentication, endpoint detection and response, and tested backups are the controls Canadian cyber applications ask about most often.
Your application answers become part of the policy, so an inaccurate yes can put a future claim at risk.
Keep dated evidence for every control you attest to: configuration reports, console exports, restore test records and training logs.

Read the guide

All guides

Every Guide, by Topic

Short on time

Quick Answers in the Knowledge Base

45 common questions, each with a short answer first.

Browse the knowledge base