What counts as a breach of security safeguards
PIPEDA defines a breach of security safeguards as the loss of, unauthorized access to, or unauthorized disclosure of personal information, resulting from a failure of an organization's security safeguards or from those safeguards not being established at all. The phrase covers far more than a hacked database.
A stolen laptop, a paper file left in a taxi, an email sent to the wrong client list, an employee looking up a customer's account out of curiosity, a misconfigured cloud folder and a ransomware attack are all breaches of security safeguards. Nothing has to be published, and no money has to be lost, for the duty to assess the breach to arise.
Two duties follow every breach. The organization assesses whether the breach creates a real risk of significant harm, and it records the breach either way. Only the first duty leads to a report and a notification.
The real risk of significant harm test
The threshold that decides whether anyone has to be told is the real risk of significant harm, usually shortened to RROSH. PIPEDA s. 10.1(7) defines significant harm as including bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record, and damage to or loss of property.
Section 10.1(8) sets the two factors that decide whether the risk is real:
- The sensitivity of the personal information involved in the breach. Health records, financial information, government identifiers and biometric data sit at the sensitive end, but the Privacy Commissioner's guidance is that context decides: the same data point can be sensitive in one situation and not in another.
- The probability that the personal information has been, is being, or will be misused. The Commissioner's guidance points to who obtained the information, how long it was exposed, whether there is evidence of malicious intent, how many pieces of information were combined, whether the data was encrypted, and whether harm has already appeared.
What the notice must say, and how fast it has to arrive
Where the threshold is met, the organization reports the breach to the Privacy Commissioner and notifies each affected individual. Under the Breach of Security Safeguards Regulations s. 3, a notification to an individual has to describe the circumstances of the breach, when it happened, what personal information was involved, what the organization has done to reduce the risk of harm, what steps the individual could take to reduce or mitigate that harm, and how to get more information from the organization.
Notification is normally direct: in person, by telephone, mail, email, or any other form a reasonable person would consider appropriate (Regulations s. 4). Indirect notification, such as a public notice, is allowed only where direct contact would cause further harm, would be an undue hardship, or where the organization has no contact information (s. 5). PIPEDA s. 10.2 also requires the organization to tell any other organization or government institution that might be able to reduce the risk of harm, which is why a bank or a payment processor is often notified alongside you.
On timing, PIPEDA sets a standard rather than a number: the report and the notification are given as soon as feasible after the organization determines that the breach occurred (ss. 10.1(2) and 10.1(6)). Canadian law has no 72-hour deadline. That figure comes from Article 33(1) of the European Union's General Data Protection Regulation, which requires notification of the supervisory authority not later than 72 hours after the controller becomes aware of a breach. It does not apply to a Canadian organization dealing with a Canadian customer under PIPEDA.
The record of every breach, kept for 24 months
PIPEDA s. 10.3 requires an organization to keep and maintain a record of every breach of security safeguards involving personal information under its control, whether or not the breach met the real risk of significant harm threshold, and to give those records to the Privacy Commissioner on request.
The Regulations set the period at 24 months after the day on which the organization determines that the breach occurred (s. 6). The practical effect is that an organization which decided a breach was harmless still has a file about it for two years, and the Commissioner can ask to see how that decision was made.
Which rules apply, and who takes the complaint
Which law governs a breach depends on who held the information and where. This table sets out the reporting duty and the regulator that receives a complaint in each case.
| Who held the information | The breach rule | Regulator |
|---|---|---|
| A private business anywhere in Canada, and every federally regulated business (banks, airlines, telecoms), including their employee information | PIPEDA s. 10.1: report to the Commissioner and notify the individual as soon as feasible where there is a real risk of significant harm. Record of every breach kept 24 months. | Office of the Privacy Commissioner of Canada (priv.gc.ca) |
| A private-sector organization in Alberta | PIPA s. 34.1: report to the Commissioner without unreasonable delay where a reasonable person would consider a real risk of significant harm exists. Under s. 37.1 the Commissioner decides whether the organization has to notify the individuals. | Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca) |
| An enterprise doing business in Quebec | A confidentiality incident presenting a risk of serious injury is reported promptly to the Commission and to the persons concerned. Sensitivity, foreseeable consequences and the probability of misuse decide the risk. A register of all incidents, including those without serious injury, is kept at least five years. | Commission d'accès à l'information du Québec (cai.gouv.qc.ca) |
| A private-sector organization in British Columbia | PIPA s. 34 requires reasonable security arrangements, but the Act contains no breach reporting or notification section. Reporting a breach to the Commissioner and telling affected individuals is voluntary. | Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca) |
| An Ontario health information custodian: hospital, clinic, doctor, pharmacy, long-term care home | PHIPA s. 12(2): the individual is notified at the first reasonable opportunity where health information is stolen, lost, or used or disclosed without authority. Since October 1, 2017, s. 12(3) and its regulation also require a report to the Commissioner in prescribed circumstances, which include theft and deliberate unauthorized access. | Information and Privacy Commissioner of Ontario (ipc.on.ca) |
| An Ontario provincial or municipal institution: ministry, university, hospital, municipality, police service, school board | FIPPA institutions report a breach meeting the real risk of significant harm threshold to the Commissioner and notify affected individuals as soon as feasible, from July 1, 2025. The same obligations reach MFIPPA municipal institutions on January 1, 2027. | Information and Privacy Commissioner of Ontario (ipc.on.ca) |
| An Alberta public body: ministry, municipality, school board, university, police service | Protection of Privacy Act s. 10(2), in force June 11, 2025: notify affected individuals, the Commissioner and the Minister where a reasonable person would consider a real risk of significant harm exists. | Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca) |
| A British Columbia public body | FOIPPA s. 36.3: notify affected individuals and the Commissioner of a breach that could reasonably be expected to result in significant harm, including identity theft. | Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca) |
| A federal government institution: CRA, IRCC, Service Canada, RCMP | The Privacy Act contains no breach notification section. Under the Treasury Board Directive on Privacy Practices, institutions report a material privacy breach to the Privacy Commissioner and to Treasury Board, and notifying the affected individuals is one of the required mitigation measures unless notification would be inappropriate. | Office of the Privacy Commissioner of Canada (priv.gc.ca) |
Steps open to someone who has been notified
There is no single required response, and nothing below is legal advice. These are the steps official Canadian guidance describes for a person whose information has been exposed, in the order that most guidance sets them out.
- Keeping the notice itself. It is the document that records what was exposed and when the organization knew, and it is what any later complaint or court application is measured against.
- Changing the password on the affected account, and on any other account where the same password was used, and turning on multi-factor authentication where the service offers it.
- Telling the bank and the card issuer where financial information was involved, and asking for new card numbers. The Financial Consumer Agency of Canada describes this as the first step after a suspected fraud.
- Asking Equifax and TransUnion to place a fraud alert on the credit file. An alert asks a potential lender to confirm identity before granting credit. The Financial Consumer Agency of Canada notes that Equifax sets one up free of charge while TransUnion charges a one-time fee of five dollars plus taxes.
- Requesting the free credit report each bureau provides and reviewing it for accounts and enquiries that were not authorized.
- Reporting to the Canadian Anti-Fraud Centre where the information appears to have been used in a fraud or a scam, and to local police where there was a theft.
- Reporting missing identity documents to the body that issued them, and telling the Canada Revenue Agency where a social insurance number was exposed.
- Raising the problem with the organization's privacy officer in writing. The Privacy Commissioner expects this step before a formal complaint, and may decline a complaint where it was skipped.
- Taking the matter to the Privacy Commissioner of Canada, or to the provincial commissioner in the table above, where the organization does not respond or the response is inadequate. Complaints are free.
- Considering the Federal Court route after the Commissioner reports. PIPEDA s. 14 allows an application within one year of the report, and s. 16 lets the Court order corrective measures and award damages. Whether that route fits a particular set of facts is a question for a qualified privacy lawyer.
What Parliament is being asked to change
The federal private-sector rules above are the ones in force. A bill now before Parliament would rewrite them.
The full explanation of the bill, including the new commission structure, the private right of action, the children's-data provisions and every stage it still has to clear, is on the /learn/bill-c-36-ppcda page.
Bill C-36: proposed, not law
Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts, received first reading in the House of Commons on June 15, 2026 and is at second reading. It is a proposal. Nothing in it applies yet, and PIPEDA continues to govern private-sector privacy in Canada until the bill is passed and brought into force.
Status checked September 5, 2026.
- A private right of action: clause 132 of the bill as introduced would allow an individual to claim damages from an organization for a contravention of the Act.
- Breach reporting carried forward: clause 58 would keep the duty to report a breach to the regulator as soon as feasible where there is a real risk of significant harm, and clause 59 the duty to notify other organizations that could reduce the harm.
- A record of every breach would still be required (clause 60), with the details left to regulations.
- The bill would replace Part 1 of PIPEDA and move private-sector enforcement to a new commission rather than the tribunal proposed in the previous Parliament's Bill C-27.
Frequently asked questions
- What is a privacy breach in Canada?
- PIPEDA calls it a breach of security safeguards: the loss of, unauthorized access to, or unauthorized disclosure of personal information that results from a failure of an organization's security safeguards, or from the absence of those safeguards. A stolen laptop, a misdirected email, an employee looking at a file without a work reason, a misconfigured cloud folder and a ransomware attack all qualify. The organization has to assess every breach against the real risk of significant harm threshold and keep a record of it for 24 months, whether or not anyone is notified.
- Does PIPEDA have a 72-hour breach notification deadline?
- No. PIPEDA requires the report to the Privacy Commissioner and the notification to affected individuals to be given as soon as feasible after the organization determines that the breach occurred (ss. 10.1(2) and 10.1(6)). There is no fixed number of hours or days in the Act or in the Breach of Security Safeguards Regulations. The 72-hour figure comes from Article 33(1) of the European Union's General Data Protection Regulation and applies to organizations covered by European law, not to a PIPEDA breach in Canada.
- When does a company have to tell me about a breach?
- When it is reasonable in the circumstances to believe the breach creates a real risk of significant harm to you (PIPEDA s. 10.1(3)). Significant harm is defined in s. 10.1(7) and includes humiliation, damage to reputation or relationships, loss of employment, financial loss, identity theft, negative effects on the credit record, and bodily harm. Section 10.1(8) says the risk is judged on the sensitivity of the information and the probability that it has been or will be misused. Where the assessment comes out below that threshold, no notification is required, but the breach still goes in the organization's record.
- What has to be in a breach notification letter?
- Under section 3 of the Breach of Security Safeguards Regulations, the notice describes the circumstances of the breach, the day or period when it happened, the personal information involved, the steps the organization has taken to reduce the risk of harm, the steps you could take to reduce or mitigate the harm, and contact information for getting further details from the organization. The Privacy Commissioner's guidance adds that it should be written to be easily understood rather than in legal language, and it is normally delivered directly by mail, email, telephone or in person.
- Who do I complain to about a privacy breach, and can I be compensated?
- The regulator depends on who held the information: the Office of the Privacy Commissioner of Canada for a federally regulated or most private businesses and for federal institutions, the OIPC in Alberta or British Columbia, the Commission d'accès à l'information in Quebec, and the Information and Privacy Commissioner of Ontario for Ontario health custodians and public institutions. Complaints are free, and the commissioners expect the issue to be raised with the organization first. Compensation is a separate step: under PIPEDA s. 14 an application may be made to the Federal Court within one year of the Commissioner's report, and s. 16 lets the Court award damages. Bill C-36, at second reading in September 2026, proposes a direct private right of action at clause 132.