Privacy Breach Response in Canada: Who to Notify and When

After a privacy breach in Canada, do four things in order: contain the breach, assess the risk of harm to the people affected, notify the regulator and individuals where the law requires it, and fix what allowed it to happen. Which law applies depends on where you operate and what kind of organization you are. Federally, PIPEDA requires you to report breaches that create a real risk of significant harm to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible. Quebec, Alberta and the health sector have their own rules.

This guide is written for the owner, CFO or operations lead who has just been told "we think someone got into our systems" and needs to know what comes next.

This is general information, not legal advice. In a real breach, get privacy counsel involved early. If you have cyber insurance, your insurer can usually provide a breach coach.

What Counts as a Privacy Breach?

A privacy breach is unauthorized access to, or disclosure or loss of, personal information. PIPEDA uses the term "breach of security safeguards." Quebec Law 25 uses "confidentiality incident." The idea is similar across the laws.

Common examples for Canadian SMBs:

• A Microsoft 365 mailbox is taken over and the attacker could read client or employee emails
• Ransomware encrypts a file server, and the attackers say they copied data first
• A laptop with unencrypted client files is stolen from a car
• An employee emails a spreadsheet of customer data to the wrong person
• A cloud storage folder is accidentally shared publicly
• A vendor that holds your customer data is breached

Not every security incident is a privacy breach. Ransomware that encrypts only systems with no personal information, with no evidence of data theft, may not be. But you need evidence to reach that conclusion, not a hunch.

Step 1: Contain the Breach

Your first job is to stop more data from leaking. Typical containment steps:

• Reset passwords and revoke sessions for compromised accounts, and check for malicious mailbox rules and app consents
• Isolate infected devices from the network (unplug or isolate through your EDR tool), but do not wipe them
• Disable compromised remote access or vendor accounts
• Retrieve misdirected emails or documents where possible and get written confirmation they were deleted
• Change sharing settings on exposed cloud folders

Preserve evidence while you contain. Do not reimage machines, delete mailboxes or clear logs before a forensic copy is taken. You will need those records to work out what was accessed, and your insurer and regulators may ask for them. Many businesses destroy the evidence that would have shown the breach was smaller than feared.

Call your insurer's breach hotline at this stage, not after. Most cyber policies require prompt notice, and the insurer can connect you with a breach coach (usually a privacy lawyer) and approved forensic firms.

Step 2: Assess the Risk of Harm

Once the breach is contained, work out:

• What personal information was involved?Names and emails are different from SINs, banking details, health information or ID documents.
• How many people are affected, and who are they?Customers, employees, patients, children?
• Who had access?A criminal group, a single wrong recipient who confirmed deletion, or unknown?
• Was the data encrypted?And was the key also compromised?
• Is there evidence of misuse?Data posted on a leak site, fraud attempts, extortion demands?

This assessment drives every notification decision. Document it carefully, including the reasons for your conclusions. Regulators expect to see reasoning, not just a yes or no.

Step 3: Work Out Which Privacy Laws Apply and Who to Notify

Most private-sector organizations fall under one of these:

Health information often has its own law. Ontario's PHIPA and Alberta's Health Information Act, for example, have their own breach notification rules for health custodians. Public bodies, such as municipalities and school boards, are covered by provincial public-sector laws.

Many organizations are covered by more than one law. A Calgary company with customers in Quebec and Ontario may have obligations under Alberta PIPA, Law 25 and PIPEDA at once, depending on whose information was involved and where.

A note on federal reform: Bill C-36, introduced in the House of Commons on June 15, 2026, would replace the privacy part of PIPEDA with a new statute. As of this guide's date it is not law. PIPEDA continues to apply until any replacement is passed and in force.

PIPEDA Breach Reporting Requirements

Under PIPEDA and its Breach of Security Safeguards Regulations, if a breach creates a real risk of significant harm (RROSH) to an individual, you must:

1. Report to the Office of the Privacy Commissioner of Canada as soon as feasible after determining the breach occurred
2. Notify affected individuals as soon as feasible, directly in most cases
3. Notify other organizations or government institutions that may be able to reduce the risk of harm, such as banks or credit bureaus

"Significant harm" is broad. It includes bodily harm, humiliation, damage to reputation or relationships, loss of employment or business opportunities, financial loss, identity theft, negative effects on credit records and damage to or loss of property. Whether the risk is "real" depends on the sensitivity of the information and the probability it will be misused.

Record keeping. You must keep a record of every breach of security safeguards involving personal information under your control for 24 months, whether or not it met the RROSH threshold. The OPC can ask to see these records. This catches many businesses out: a misdirected email that you decided was low risk still needs an entry.

Penalties. Knowingly failing to report, notify or keep records can lead to fines of up to $100,000 CAD per violation.

The OPC has an online breach report form and guidance on what to include.

Quebec Law 25 Confidentiality Incident Requirements

Quebec's private-sector privacy law, as amended by Law 25 (formerly Bill 64), requires enterprises to:

• Take reasonable measures to reduce the risk of injuryand prevent new incidents
• Promptly notify the Commission d'accès à l'information (CAI)and the persons concerned if the incident presents a risk of serious injury
• Keep a register of all confidentiality incidents, and provide it to the CAI on request

Assessing "risk of serious injury" considers the sensitivity of the information, the anticipated consequences of its use and the likelihood it will be used for harmful purposes. Law 25 also requires every enterprise to have a person in charge of the protection of personal information, by default the highest-ranking executive, who must be involved in incident assessment.

If you have customers or employees in Quebec, assume Law 25 may apply even if your head office is elsewhere, and get advice.

Alberta PIPA Breach Notification

Alberta's Personal Information Protection Act requires organizations to notify the Alberta Information and Privacy Commissioner without unreasonable delay of a loss of, unauthorized access to or disclosure of personal information where a reasonable person would consider that there is a real risk of significant harm. The Commissioner can require the organization to notify affected individuals. In practice, many organizations notify individuals directly at the same time.

The Alberta OIPC has said it now issues breach notification decisions only for files where there is a real risk of significant harm, and publishes decisions at its discretion. Its published decisions are a useful guide to how the Commissioner interprets the test.

BC PIPA: No General Mandatory Breach Notification

As of writing, British Columbia's private-sector Personal Information Protection Act does not contain a general mandatory breach notification requirement. That does not mean you can stay silent:

• BC PIPA still requires reasonable security arrangements, and the BC OIPC encourages voluntary reporting
• If affected individuals live in Alberta or Quebec, or your organization falls under PIPEDA for some activities, those laws may apply
• Contracts with clients, payment card rules and your insurance policy may require notification
• Notifying affected individuals so they can protect themselves is often the right thing to do, and regulators look favourably on it

BC's public sector is different: public bodies under BC FIPPA have had mandatory breach notification since February 1, 2023.

Who Else to Notify After a Breach

Regulators and affected individuals are not the only calls. Depending on the incident:

• Your cyber insurerUsually the first call, often before you know the full scope.
• Privacy counselTo guide notification decisions and protect privilege over the investigation where possible.
• PoliceFor theft, extortion or fraud. Report fraud to the Canadian Anti-Fraud Centre as well.
• The Canadian Centre for Cyber SecurityThe Cyber Centre accepts reports of cyber incidents from Canadian organizations. Reporting is generally voluntary for private businesses but helps the national picture.
• Your bankImmediately, if funds were sent to a fraudster.
• Clients and partnersMany contracts require notice within a fixed number of hours or days.
• Card brands and your acquirerIf payment card data may be involved.
• Professional regulatorsLaw societies, health colleges and others may have their own reporting expectations.

How to Notify Individuals

A good notification letter is plain and specific. It should explain:

• What happened and when, in general terms
• What personal information was involved
• What you have done to contain it and reduce harm
• What they can do to protect themselves (for example, watch for phishing, monitor accounts, consider credit monitoring if you offer it)
• Who to contact with questions

Avoid jargon and avoid minimizing. People can tell when they are being managed. If you are offering credit monitoring, explain how to enrol.

PIPEDA allows indirect notification, such as a public notice, only in specific circumstances, for example when direct notification would cause further harm or when you have no contact information.

Step 4: Prevent It from Happening Again

Regulators will ask what you changed. Common fixes after SMB breaches:

• Enforce MFA on every account, with no exemptions
• Add monitored endpoint detection and response
• Turn on mailbox auditing and alerting for suspicious forwarding rules
• Encrypt laptops and mobile devices
• Restrict and review access to sensitive data
• Train staff on the specific lure that caused the breach
• Write or update your incident response plan

Document what you changed and when. That documentation helps with the regulator, your insurer at renewal and any client who asks.

A Breach Response Checklist

Print this and keep it with your incident plan.

1. Call your insurer's breach hotline
2. Contain: reset credentials, isolate devices, stop exposure
3. Preserve evidence: no wiping, no deleting
4. Engage privacy counsel and forensic support
5. Determine what data and which individuals were affected
6. Assess risk of harm under each applicable law
7. Report to regulators where required
8. Notify individuals and organizations that can reduce harm
9. Record the breach in your breach register, reportable or not
10. Fix the root cause and document it

How Cyberphore Helps with Privacy Breaches

Our incident response team helps you contain the attack, preserve evidence and work out what data was accessed, which is the factual foundation your counsel needs for notification decisions. We work alongside your insurer's breach coach and your lawyers.

Before a breach, our privacy compliance work helps you set up a breach register, a response plan and notification templates for the laws that apply to you. Managed detection and response shortens the time between an attacker getting in and someone noticing, which often makes the difference between a contained incident and a reportable breach.

For province-specific detail, see our Quebec, Alberta and British Columbia pages. If you are dealing with a breach right now, go to our emergency page.