# Frontier Cyber: Canadian privacy breach notification rules and harm tests > Every Canadian federal, provincial and territorial privacy breach and cyber incident notification duty, with who to notify, the statutory timing, the harm threshold, penalties and the primary source for each, plus the statutory harm tests (real risk of significant harm, serious injury and their equivalents). Rules dataset version 2026-10-29; harm tests version 2026-10-29. Licence CC BY 4.0: cite "Frontier Cyber, https://frontiercyber.app/tools/breach-notification/". Interactive tools: [breach notification decision tool](https://frontiercyber.app/tools/breach-notification/) and [harm assessment tool](https://frontiercyber.app/tools/harm-assessment/). Both run in the browser and send nothing. This is a summary of the law, not legal advice. ## Canada (federal) Page: https://frontiercyber.app/tools/breach-notification/federal/ ### PIPEDA - Law: Personal Information Protection and Electronic Documents Act, ss. 10.1 to 10.3, and the Breach of Security Safeguards Regulations (SOR/2018-64) - Status: In force since 2018-11-01; covers private sector - Applies to: Private-sector organizations that collect, use or disclose personal information in the course of commercial activity anywhere in Canada, federal works, undertakings and businesses (banks, telecoms, airlines, inter-provincial transport) and their employee data, and organizations in provinces without substantially similar private-sector law (every province except BC, Alberta and Quebec; health custodians in Ontario, NB, NS and NL are also substantially similar for health information). - Threshold: real risk of significant harm. A breach of security safeguards must be reported and individuals notified if it is reasonable in the circumstances to believe the breach creates a real risk of significant harm to an individual. Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property (s. 10.1(7)). Factors: sensitivity of the information, probability of misuse, and any other prescribed factor (s. 10.1(8)). - Notify Office of the Privacy Commissioner of Canada (OPC): as soon as feasible after the organization determines that the breach has occurred. No fixed hour or day count in the statute or regulations. Report contents prescribed by SOR/2018-64 s. 2 (circumstances and cause, date or period, personal information involved, number of individuals, mitigation steps, steps to notify individuals, contact person). Report: https://www.priv.gc.ca/en/report-a-concern/report-a-privacy-breach-at-your-organization/report-a-privacy-breach-at-your-business/ - Notify Each affected individual: as soon as feasible after the organization determines that the breach has occurred. Notice must be conspicuous and given directly, except where indirect notice is permitted by regulation. Contents prescribed by SOR/2018-64 s. 3. Not required where prohibited by law. Report: https://laws-lois.justice.gc.ca/eng/acts/P-8.6/section-10.1.html - Notify Other organizations or government institutions that may be able to reduce or mitigate the harm (e.g., banks, credit bureaus, police): as soon as feasible after the organization determines that the breach has occurred. Duty under s. 10.2 arises whenever individuals must be notified. Report: https://laws-lois.justice.gc.ca/eng/acts/P-8.6/page-3.html - Records: Keep a record of every breach of security safeguards (whether or not it met the RROSH threshold) for 24 months after the day the organization determines the breach occurred (SOR/2018-64 s. 6); provide records to the OPC on request (s. 10.3(2)). - Penalties: Knowingly contravening s. 10.1 or s. 10.3(1): fine up to $10,000 on summary conviction or up to $100,000 on indictment (s. 28). - Notes: Bill C-27 (Consumer Privacy Protection Act) died on the Order Paper in January 2025. Bill C-36, the Protecting Privacy and Consumer Data Act, was tabled and received first reading on June 15, 2026; it would replace Part 1 of PIPEDA and carries the breach reporting duties forward, but it is not law. As of October 2026 PIPEDA remains the governing federal private-sector law (Justice Laws consolidation current to 2026-09-30). Organizations in Alberta, BC and Quebec must also apply provincial law; PIPEDA still applies to their federally regulated activities and inter-provincial/international flows. - Sources: PIPEDA s. 10.1 (Justice Laws) https://laws-lois.justice.gc.ca/eng/acts/P-8.6/section-10.1.html; PIPEDA ss. 10.2, 10.3 (Justice Laws, page 3) https://laws-lois.justice.gc.ca/eng/acts/P-8.6/page-3.html; PIPEDA full text, s. 28 offence https://laws-lois.justice.gc.ca/eng/acts/P-8.6/FullText.html; Breach of Security Safeguards Regulations SOR/2018-64 https://laws-lois.justice.gc.ca/eng/regulations/SOR-2018-64/page-1.html; OPC: Report a privacy breach at your business https://www.priv.gc.ca/en/report-a-concern/report-a-privacy-breach-at-your-organization/report-a-privacy-breach-at-your-business/; DLA Piper: Canada tables Bill C-36, the Protecting Privacy and Consumer Data Act (June 17, 2026) https://www.dlapiper.com/en-us/insights/publications/2026/06/canada-tables-bill-c36-the-protecting-privacy-and-consumer-data-act - Last verified: 2026-10-29 ### Privacy Act / TBS Directive on Privacy Practices - Law: Privacy Act (R.S.C. 1985, c. P-21) and Treasury Board Directive on Privacy Practices, Appendix B (Mandatory Procedures for Privacy Breaches) - Status: In force; covers federal institutions - Applies to: Federal government institutions subject to the Privacy Act (departments, agencies, Crown corporations listed in the schedule). - Threshold: material privacy breach. The Privacy Act itself contains no breach provision; the duty comes from Treasury Board policy. A material privacy breach is one involving sensitive personal information that could reasonably be expected to cause serious injury or harm to the individual and/or involves a large number of affected individuals. Institutions must contain, assess and mitigate, then report material breaches. - Notify Office of the Privacy Commissioner of Canada (OPC) and Treasury Board of Canada Secretariat (TBS): no later than seven days after the institution determines that a breach is material. A Treasury Board policy requirement, not a statute. The seven day clock runs from the institution's determination that the breach is material, not from discovery, so a countdown from discovery is the conservative reading. Informal early notice is permitted at any time but does not replace the formal report. The OPC online form submits to both OPC and TBS (Privacy Implementation Notice 2024-02, effective July 8, 2025). Confirmed on canada.ca TBS pages (Breach management Phase 4, updated 2026-03-23); the Directive page itself (tbs-sct.canada.ca) rejects automated requests. Report: https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/access-information-privacy-notices/privacy-implementation-notice-2024-02.html - Notify Affected individuals: as soon as possible following containment and assessment of the breach (TBS breach management guidance). TBS breach management guidance: for a material privacy breach, senior officials must ensure affected individuals are notified, directly where possible. Notice may be withheld where it would be inappropriate for security, confidentiality, legal or other reasons, and the institution must then justify that decision to the OPC and TBS. Report: https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/privacy/privacy-policies-guidance/breach-management/phase-3.html - Records: Institutions must document every privacy breach, including non-material ones, as part of breach management, and report breach statistics in their annual reports to Parliament. - Penalties: No statutory penalty for failure to report; non-compliance is a policy breach subject to TBS consequences under the Policy on Privacy Protection. - Notes: The seven day timeline for reporting a material privacy breach to the OPC and TBS is set out in the Treasury Board Directive on Privacy Practices (Appendix B) and restated in TBS breach management guidance and Privacy Implementation Notice 2024-02. The Directive is policy, not statute, and is updated by TBS without legislative process, so confirm the current version on the TBS site when reporting. - Sources: TBS Breach management Phase 4: Report and prevent another breach https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/privacy/privacy-policies-guidance/breach-management/phase-4.html; TBS Privacy Implementation Notice 2024-02 https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/access-information-privacy-notices/privacy-implementation-notice-2024-02.html; TBS Breach management Phase 3: Notify affected individuals https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/privacy/privacy-policies-guidance/breach-management/phase-3.html - Last verified: 2026-10-29 ### CCSPA (Bill C-8) - Law: Critical Cyber Systems Protection Act, S.C. 2026, c. 9, s. 11 (enacted by Bill C-8, An Act respecting cyber security) - Status: Not yet in force; covers designated critical infrastructure operators - Applies to: Designated operators in federally regulated vital services and systems (telecommunications, interprovincial/international pipelines and power lines, nuclear, transportation, banking, clearing and settlement) once classes of operators are designated by regulation and listed in Schedule 2. - Threshold: cyber security incident affecting a critical cyber system. A designated operator must report any cyber security incident in respect of any of its critical cyber systems. The threshold definition (interference with continuity or security of a vital service/system, or confidentiality, integrity or availability of the critical cyber system) will be refined by regulations. - Notify Communications Security Establishment (Canadian Centre for Cyber Security): within a period prescribed by the regulations, not to exceed 72 hours. Section 17 reads 'within a period prescribed by the regulations, not to exceed 72 hours'. 72 hours is the statutory ceiling; the actual deadline will be set by regulation. Section 17 is not yet in force. The Act does not say 'immediately' for the CSE report. Report: https://laws-lois.justice.gc.ca/eng/acts/C-47.4/FullText.html - Notify The operator's appropriate regulator (Minister of Industry, Minister of Transport, OSFI, Bank of Canada, Canada Energy Regulator or Canadian Nuclear Safety Commission): Immediately after reporting a cyber security incident. s. 18: notify the regulator that the report was made and provide a copy. Report: https://laws-lois.justice.gc.ca/eng/acts/C-47.4/FullText.html - Records: s. 30: keep records of program implementation, every reported incident, supply-chain mitigation and directive compliance; records must be kept in Canada; period and manner set by the regulator unless regulations provide otherwise. - Penalties: Administrative monetary penalties of up to $500,000 for an individual and $15,000,000 in any other case per violation (s. 91), each day a separate violation (s. 94); directors and officers who directed or acquiesced in a violation are parties to it (s. 93); contravening s. 17 or 18 is an offence (s. 136). Fine amounts for offences are set in ss. 136 and 137. - Notes: Royal Assent June 15, 2026 (S.C. 2026, c. 9). The Act comes into force by order in council. As of the Justice Laws consolidation current to September 30, 2026, every provision, including the s. 17 reporting duty, is marked not in force, and no order in council, regulations or designated classes of operators had been published. Prepare for a reporting window of at most 72 hours once regulations set it. Part 1 of Bill C-8 (Telecommunications Act amendments) is a separate regime. - Sources: Critical Cyber Systems Protection Act, full text (Justice Laws) https://laws-lois.justice.gc.ca/eng/acts/C-47.4/FullText.html; CCSPA page 11 (offences) https://laws-lois.justice.gc.ca/eng/acts/C-47.4/page-11.html; Bill C-8 Royal Assent text (Parliament of Canada) https://www.parl.ca/documentviewer/en/45-1/bill/C-8/royal-assent - Last verified: 2026-10-29 ### OSFI Incident Reporting Advisory - Law: OSFI Technology and Cyber Security Incident Reporting Advisory (August 2021) and OSFI technology and cyber incident report detailed instructions (2025) - Status: In force since 2021-08-13; covers federally regulated financial institutions - Applies to: Federally regulated financial institutions (banks, foreign bank branches, federal credit unions, life and P&C insurers, trust and loan companies). Administrators of federally regulated private pension plans have a separate OSFI advisory (2023) with the same 24-hour window, reported to pensions@osfi-bsif.gc.ca. - Threshold: technology or cyber security incident meeting any one of OSFI's reportable-incident criteria. Reportable if the incident has any one or more listed characteristics, including impact on operations, systems or data (including customer information), business disruption, DR activation, third-party impact, reporting to the Board or senior management, reporting to the Privacy Commissioner or other regulators or law enforcement, a cyber insurance claim, high/critical severity rating, or breach of internal risk appetite. OSFI encourages reporting when unsure. - Notify OSFI Technology Risk Division and the institution's Lead Supervisor: within 24 hours, or sooner if possible. Supervisory expectation under an Advisory (not a statute), effective August 13, 2021; replaced the January 2019 advisory's 72-hour window. The Advisory does not state the event that starts the 24 hours; the incident report form asks for both occurrence and detection times, so treat the clock as running from detection. Situation updates required until resolved. Failure to report may result in increased supervisory oversight, watch-listing or staging. Report: https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/osfi-technology-cyber-incident-report-detailed-instructions - Records: Not specified in the Advisory beyond the incident report and follow-up reporting; general record expectations under Guideline B-13. - Penalties: No fines; non-compliance can lead to enhanced monitoring, watch-listing or staging under OSFI's supervisory framework. - Notes: The Advisory has been in effect since August 13, 2021. Pension plan administrators: OSFI advisory 'Technology and cyber security incident reporting' (pensions page issued 2024-02-28) says to send the Incident Report within 24 hours of discovering an incident. Provincially regulated credit unions report to their provincial regulator (e.g., BCFSA, FSRA) under provincial rules, not to OSFI; those are out of scope here. - Sources: OSFI Technology and Cyber Security Incident Reporting Advisory https://osfi-bsif.gc.ca/Eng/fi-if/rg-ro/gdn-ort/adv-prv/Pages/TCSIR.aspx; OSFI technology and cyber incident report, detailed instructions https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/osfi-technology-cyber-incident-report-detailed-instructions; OSFI news release: updated requirements https://www.osfi-bsif.gc.ca/en/news/osfi-issues-updated-requirements-technology-cyber-incident-reporting; OSFI: Technology and cyber security incident reporting for federally regulated private pension plans https://www.osfi-bsif.gc.ca/en/supervision/pensions/administering-pension-plans/guidance-topic/technology-cyber-security-incident-reporting - Last verified: 2026-10-29 ### CIRO Rule 3703 - Law: CIRO Investment Dealer and Partially Consolidated Rules, s. 3703 (cybersecurity incident reporting; formerly IIROC Dealer Member Rule 3100(1)(B)1.1) - Status: In force since 2019-11-14; covers securities dealers and issuers - Applies to: CIRO investment dealer members. Mutual fund dealer members should confirm whether an equivalent reporting rule applies to them. - Threshold: cybersecurity incident. Any act to gain unauthorized access to, disrupt or misuse a Dealer's information system or information stored on it that results in, or is reasonably likely to result in, substantial harm to any person, a material impact on normal operations, invocation of the BCP/DR plan, or a notice requirement under other regulatory obligations. - Notify CIRO (via the Dealer's FinOps relationship manager): within three days of discovery of the cybersecurity incident. Initial report. CIRO FAQ uses 'three calendar days following discovery'. Contents: description, discovery date and occurrence period, preliminary risk assessment, immediate response, contact. Report: https://www.ciro.ca/node/10897 - Notify CIRO: an incident investigation report within 30 days of discovery of the cybersecurity incident. Detailed report: cause, scope (systems, client data, costs), mitigation and remediation, preparedness improvements. Extensions on request to the FinOps relationship manager. Report: https://www.ciro.ca/node/10904 - Records: Reporting and recordkeeping requirements in Rule 3700 series; no breach-specific retention period stated. - Penalties: CIRO disciplinary sanctions (fines, suspension) under the enforcement rules. - Notes: IIROC Notice 19-0194 (November 14, 2019) brought the amendments into force immediately. CIRO's FAQ describes the initial deadline as three calendar days following discovery. The rule applies to investment dealer members; mutual fund dealer members should confirm their own reporting obligations with CIRO. - Sources: CIRO/IIROC Notice: Amendments Respecting Mandatory Reporting of Cybersecurity Incidents https://www.ciro.ca/node/10904; CIRO FAQ: Mandatory Cybersecurity Incident Reporting https://www.ciro.ca/node/10897; CIRO Incident Reporting Summary https://www.ciro.ca/firms/educational-resources/cybersecurity-technology/incident-reporting-summary; IIROC Notice 19-0194 (OSC-hosted PDF, November 14, 2019) https://www.osc.ca/sites/default/files/2020-12/iiroc_20191114_iiroc-notice-amendments-respecting-mandatory-reporting_0.pdf - Last verified: 2026-10-29 ### CSA continuous disclosure - Law: CSA Multilateral Staff Notice 51-347 Disclosure of cyber security risks and incidents (Jan 19, 2017) applied under NI 51-102 Continuous Disclosure Obligations and NP 51-201 - Status: In force since 2017-01-19; covers securities dealers and issuers - Applies to: Reporting issuers (public companies) in Canadian jurisdictions. - Threshold: material fact or material change. No bright-line test. An issuer must assess whether a cyber incident (or a series of minor incidents) is a material fact or material change, assessing materiality throughout detection, assessment and remediation. Disclosure controls (NI 52-109) should capture detected incidents so management can decide on timely reporting. - Notify Securities regulators and the market (news release and material change report filed on SEDAR+): news release immediately on a material change; material change report as soon as practicable and in any event within 10 days (NI 51-102 s. 7.1). NI 51-102 s. 7.1 sets the general material change timing (news release immediately, material change report within 10 days); CSA Staff Notice 51-347 sets no cyber specific deadline. Provincial securities acts use 'forthwith' for the same duty. Whether a cyber incident is a material change is a judgment for the issuer and its counsel. Report: https://www.osc.ca/node/309201 - Records: Disclosure controls and procedures records under NI 52-109. - Penalties: Securities-law enforcement (administrative penalties, cease-trade orders, quasi-criminal prosecution) under provincial securities acts. - Notes: Searches found no CSA rule proposal for a dedicated cyber-incident disclosure instrument as of October 2026 (the SEC has one; Canada relies on general materiality). CSA Staff Notice 11-332 (2016) covers cyber security generally. - Sources: CSA Multilateral Staff Notice 51-347 (OSC) https://www.osc.ca/node/309201; MLT Aikins: Cybersecurity guidance for public companies in Canada and the U.S. https://www.mltaikins.com/insights/cybersecurity-guidance-for-public-companies-in-canada-and-the-u-s/ - Last verified: 2026-10-29 ### Cyber insurance policy conditions - Law: Contractual notice conditions in cyber liability / cyber first-party insurance policies - Status: In force; covers contract and industry rules - Applies to: Any organization holding a cyber insurance policy (typically claims-made-and-reported). - Threshold: discovery of a security or privacy incident, or receipt of a claim or circumstance. Most policies make timely notice a condition of coverage; the clock is tied to discovery or awareness of an incident (sometimes by a defined control group). Many policies also require insurer consent before incurring costs or retaining vendors, and steer insureds to panel breach coaches and forensic firms. - Notify Insurer (and broker, but notice to the broker alone may not satisfy the policy): as soon as practicable (policy-specific; some set fixed days). Late or defective notice can forfeit coverage; pre-notice legal fees may not be covered. Check the policy's notice clause, hotline and consent-to-incur-costs condition. Report: https://www.reedsmith.com/en/perspectives/cyber-insurance-claims/2023/06/best-practices-avoiding-notification-disputes-cyber-liability-insurance - Records: Preserve evidence and document the timeline for the claim. - Penalties: Denial of coverage or reduced recovery for late notice. - Notes: A contract condition, not a law. Notify the insurer before engaging outside counsel or forensic responders: most policies require the use of panel firms and treat late notice as grounds to deny the claim. - Sources: Reed Smith: Best practices for avoiding notification disputes in cyber liability insurance (June 2023) https://www.reedsmith.com/en/perspectives/cyber-insurance-claims/2023/06/best-practices-avoiding-notification-disputes-cyber-liability-insurance - Last verified: 2026-10-29 ### PCI DSS / card brand rules - Law: PCI DSS incident response requirements and card brand compromise rules (Visa What To Do If Compromised v5.0; Mastercard Account Data Compromise rules) - Status: In force; covers contract and industry rules - Applies to: Merchants, service providers and acquirers that store, process or transmit payment card data, by contract with their acquirer and the card brands. - Threshold: suspected or confirmed unauthorized access to cardholder data. Compromised entities must immediately notify their acquirer and the card brands (via the acquirer), preserve evidence, and may be required to engage a PCI Forensic Investigator (PFI). - Notify Acquiring bank (merchant bank) and Visa Risk Management / other card brands: Immediately notify all relevant parties; Visa Initial Investigation Report within three (3) business days. Visa What To Do If Compromised v5.0 (August 2016) and the Visa bulletin on data compromise reporting (July 2017): notify the acquirer and Visa immediately on discovery; share preliminary investigation findings within three business days; engage a PCI Forensic Investigator and report exposed accounts on Visa's timelines. Mastercard's Account Data Compromise rules are similar; confirm with your acquirer. Contractual, not statutory. Report: https://www.visa.ca/content/dam/VCOM/regional/na/canada/security/security-documents/what-to-do-if-compromised-english.pdf - Records: Preserve logs and forensic evidence; PCI DSS Requirement 12.10 incident response plan. - Penalties: Card brand non-compliance assessments, fraud recovery and possible loss of card acceptance. - Notes: Visa may have issued a later WTDIC version; v5.0 is the version on visa.ca. - Sources: Visa Canada: What To Do If Compromised (v5.0) https://www.visa.ca/content/dam/VCOM/regional/na/canada/security/security-documents/what-to-do-if-compromised-english.pdf; PCI SSC blog: Updated guidance, Responding to a Data Breach (April 2020) https://blog.pcisecuritystandards.org/updated-guidance-responding-to-a-data-breach; Visa bulletin: Data compromise reporting requirements (July 2017) https://usa.visa.com/dam/VCOM/global/support-legal/documents/visa-bulletin-data-compromise-reporting-requirements.pdf - Last verified: 2026-10-29 ### Service provider duty to the organizations whose data you hold - Law: PIPEDA s. 10.2 and the accountability principle (Schedule 1, 4.1.3), Quebec Private Sector Act s. 3.5, Alberta PIPA s. 34.1 and OIPC guidance, plus your contracts - Status: In force; covers contract and industry rules - Applies to: Organizations that hold or process personal information on behalf of other organizations: managed service providers, SaaS and cloud hosts, payroll and benefits providers, call centres, marketing agencies, law and accounting firms holding client data. - Threshold: any breach of security safeguards affecting information held for another organization. Under PIPEDA the organization in control of the information remains responsible for reporting and notification even when a processor suffers the breach; the OPC says the principal organization needs contractual arrangements with the processor to address breach obligations, and that a processor still has its own obligations under the Act. In practice the processor must tell the principal organization promptly and with enough detail to assess harm. Quebec's s. 3.5 duty applies to any enterprise holding the information, and Alberta OIPC guidance places the reporting duty on the organization with control. Most data processing agreements set a notice window of 24 to 72 hours. Separately, PIPEDA s. 10.2 requires an organization notifying individuals to also notify any other organization or government institution that may be able to reduce the risk of harm. - Notify The organizations whose personal information you hold (the controllers or principal organizations): as required by your contract; in the absence of a contractual term, promptly enough that the controller can meet its own duties. Read the data processing agreement or master services agreement for the notice period, the recipient and the required content. Many set 24, 48 or 72 hours. Report: https://www.priv.gc.ca/en/privacy-topics/privacy-breaches/respond-to-a-privacy-breach-at-your-business/gd_pb_201810/ - Notify Other organizations or government institutions that can reduce the risk of harm (PIPEDA s. 10.2): as soon as feasible after determining the breach has occurred. Applies to any organization that must notify individuals under PIPEDA: for example notifying a bank, a credit bureau or a payment processor so it can watch for fraud. Report: https://laws-lois.justice.gc.ca/eng/acts/P-8.6/page-2.html#h-416888 - Records: Keep the notice you gave and when you gave it; the controller's PIPEDA breach record will rely on it. - Penalties: Contractual remedies under the agreement; for PIPEDA duties, see the PIPEDA regime. - Notes: Compiled from the sources above; the contract term governs the deadline to the controller. The OPC guidance addresses who is responsible for reporting when a processor is breached, not a processor to controller deadline. - Sources: PIPEDA, s. 10.2, Notification to organizations https://laws-lois.justice.gc.ca/eng/acts/P-8.6/page-2.html#h-416888; OPC, What you need to know about mandatory reporting of breaches of security safeguards https://www.priv.gc.ca/en/privacy-topics/privacy-breaches/respond-to-a-privacy-breach-at-your-business/gd_pb_201810/ - Last verified: 2026-10-29 ### Harm test: PIPEDA - Statute: Personal Information Protection and Electronic Documents Act, s. 10.1, and the Breach of Security Safeguards Regulations (SOR/2018-64) - Test: An organization shall report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual (s. 10.1(1)). Unless otherwise prohibited by law, an organization shall notify an individual of any breach of security safeguards involving the individual's personal information under the organization's control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual (s. 10.1(3)). - Harm: Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property (s. 10.1(7)). - Factors: the sensitivity of the personal information involved in the breach; the probability that the personal information has been, is being or will be misused; any other prescribed factor (none has been prescribed); OPC on sensitivity: any information can be sensitive depending on the context; health and financial information, ethnic or racial origin, political opinions, genetic data, biometric data, sex life or sexual orientation and religious or philosophical beliefs are generally sensitive; look at both what was breached and the circumstances; OPC on probability: what happened and how likely is it that someone would be harmed by the breach; Who actually accessed or could have accessed the personal information; How long has the personal information been exposed; Is there evidence of malicious intent (theft, hacking); Were a number of pieces of personal information breached, raising the risk of misuse; Is the information in the hands of a person who represents a reputation risk to the individual (an ex-spouse, a boss); Was the information exposed to limited, known entities who have committed to destroy and not disclose it, or to individuals unlikely to share it, or to unknown or many individuals, or to those likely to attempt to cause harm; Has harm materialized (demonstration of misuse); Was the information lost, inappropriately accessed or stolen, and has it been recovered; Is the personal information adequately encrypted, anonymized or otherwise not easily accessible - Records: Keep a record of every breach of security safeguards, whether or not it met the real risk of significant harm threshold, for 24 months after the day the organization determines the breach occurred, with enough detail to show the assessment (s. 10.3; SOR/2018-64 s. 6). Provide the records to the Commissioner on request. - Consequence: Report to the Privacy Commissioner of Canada as soon as feasible, notify affected individuals as soon as feasible, and notify any other organization or government institution that may be able to reduce the risk of harm (ss. 10.1, 10.2). - Sources: PIPEDA s. 10.1 (Justice Laws) https://laws-lois.justice.gc.ca/eng/acts/P-8.6/section-10.1.html; PIPEDA ss. 10.2, 10.3 (Justice Laws) https://laws-lois.justice.gc.ca/eng/acts/P-8.6/page-3.html; Breach of Security Safeguards Regulations SOR/2018-64 https://laws-lois.justice.gc.ca/eng/regulations/SOR-2018-64/page-1.html; OPC: What you need to know about mandatory reporting of breaches of security safeguards (last modified 2025-08-11) https://www.priv.gc.ca/en/privacy-topics/business-privacy/safeguards-and-breaches/privacy-breaches/respond-to-a-privacy-breach-at-your-business/gd_pb_201810/; Breach of Security Safeguards Regulations SOR/2018-64 (full text) https://laws-lois.justice.gc.ca/eng/regulations/SOR-2018-64/FullText.html - Last verified: 2026-10-29 ### Harm test: Privacy Act institutions (TBS Directive) - Statute: Treasury Board Directive on Privacy Practices, Appendix B, Mandatory Procedures for Privacy Breaches - Test: A material privacy breach is a privacy breach that could reasonably be expected to create a real risk of significant harm to an individual (Policy on Privacy Protection, Appendix A, as restated in the TBS Privacy Breach Management Toolkit). A privacy breach is improper or unauthorized access to, creation, collection, use, disclosure, retention or disposal of personal information. - Factors: Assess how a reasonable person would react under similar circumstances; The sensitivity of the personal information: the more sensitive, the greater the potential harm, and context changes sensitivity; The potential harm to individuals and the likelihood of that harm materializing (risk to individuals); Materiality depends solely on the risk to the individual or individuals; a medium or high risk to individuals is treated as material; The OPC privacy breach risk self-assessment tool (2025) is the supporting instrument - Records: Keep a record of every privacy breach, material or not, for five years after the date the institution discovered the breach; records of material breaches include the report sent to the OPC and TBS. - Consequence: Report material privacy breaches to the Treasury Board Secretariat and the Privacy Commissioner no later than seven days after the institution determines the breach is material, and notify affected individuals unless notification would cause further harm (with the justification sent to the OPC and TBS). - Sources: TBS Privacy Breach Management Toolkit: definitions and scenarios https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/privacy/privacy-policies-guidance/breach-management/phase-1/definitions-scenarios.html; TBS Toolkit: Complete a risk assessment of the privacy breach https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/privacy/privacy-policies-guidance/breach-management/phase-2/complete-risk-assessment-privacy-breach.html; TBS Toolkit: Keep a record of the breach https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/privacy/privacy-policies-guidance/breach-management/phase-4/keep-record-breach.html; TBS Privacy Implementation Notice 2024-02 https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/access-information-privacy-notices/privacy-implementation-notice-2024-02.html - Last verified: 2026-10-29 ## British Columbia Page: https://frontiercyber.app/tools/breach-notification/british-columbia/ ### BC PIPA - Law: Personal Information Protection Act, S.B.C. 2003, c. 63 - Status: Voluntary since 2004-01-01; covers private sector - Applies to: Private-sector organizations in British Columbia (businesses, non-profits, private clinics and other health practitioners not covered by FIPPA). - Threshold: none in statute; OIPC recommends reporting where significant harm is reasonably possible. PIPA contains no mandatory breach notification or reporting provision. The OIPC strongly recommends, as best practice, notifying affected individuals and reporting to the OIPC where a breach could reasonably be expected to result in significant harm; it has publicly called for the law to be amended. - Notify Office of the Information and Privacy Commissioner for BC (voluntary) (conditional or voluntary): as soon as possible (OIPC guidance). Voluntary. Organizations may use the same online breach report form as public bodies, or email info@oipc.bc.ca. Report: https://oipc.bc.ca/forms/public-bodies/online-privacy-breach-report-form/ - Notify Affected individuals (voluntary) (conditional or voluntary): OIPC best practice: notify without delay where significant harm is possible. Not a statutory duty; PIPEDA may apply instead for federal works or inter-provincial/international data flows. Report: https://oipc.bc.ca/resources/breach-notification-representatives-of-organizations-and-public-bodies/ - Records: No statutory requirement; OIPC recommends documenting breaches. - Penalties: PIPA s. 56 creates offences punishable by fine; there is no offence for failing to notify because there is no statutory duty to notify. Fine amounts are set in s. 56 of the Act. - Notes: No PIPA reform bill had been introduced as of October 2026 (McCarthy Tetrault, May 2026, confirms private-sector organizations in BC are not subject to mandatory breach reporting or notification; a September 2026 secondary review found no bill). Beware secondary sites that claim individual notification is mandatory under BC PIPA; the statute contains no such duty. BC Bill 9 (2026) amends FIPPA (public sector) and contains no private-sector breach duty; the 2021 Special Committee recommended mandatory PIPA breach notification but it has not been legislated. - Sources: OIPC BC: Breach notification for representatives of organizations and public bodies https://oipc.bc.ca/resources/breach-notification-representatives-of-organizations-and-public-bodies/; OIPC BC online privacy breach report form https://oipc.bc.ca/forms/public-bodies/online-privacy-breach-report-form/; McCarthy Tetrault: 2026 Data Breach Insights Part 3 (May 7, 2026) https://www.mccarthy.ca/en/insights/publications/navigating-the-legislative-landscape-on-data-breaches-2026-data-breach-insights-part-3 - Last verified: 2026-10-29 ### BC FIPPA s. 36.3 - Law: Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165, s. 36.3 - Status: In force since 2023-02-01; covers public bodies - Applies to: BC public bodies: ministries, Crown corporations, health authorities, universities, colleges, school boards, municipalities, police boards and other bodies listed in the Act. - Threshold: could reasonably be expected to result in significant harm. A privacy breach (theft or loss, or unauthorized collection, use or disclosure of personal information in the public body's custody or control) that could reasonably be expected to result in significant harm, including identity theft, significant bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, negative impact on a credit record, or damage to or loss of property. - Notify Affected individuals: without unreasonable delay. s. 36.3(2)(a). Exception where notice could cause immediate and grave harm to the individual's safety or health, or threaten another individual's safety or health (s. 36.3(3)). Report: https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/96165_03 - Notify Office of the Information and Privacy Commissioner for BC: without unreasonable delay. s. 36.3(2)(b). The OIPC form asks for submission as soon as possible; a file is opened with contact details and a summary, with 'tbd' fields allowed. Report: https://oipc.bc.ca/forms/public-bodies/online-privacy-breach-report-form/ - Records: Privacy management program requirements (s. 36.2) require documented breach processes; no fixed retention period in s. 36.3. - Penalties: FIPPA ss. 65.2 to 65.6 (added by Bill 22, 2021; the former ss. 74 and 74.1 are repealed): wilful unauthorized collection, use or disclosure and related offences carry fines of up to $50,000 for an individual or service provider and up to $500,000 for a corporation (s. 65.6). No specific offence for failing to notify under s. 36.3. - Notes: Section 36.3 was added by Bill 22 (2021) and the duty has applied since February 1, 2023. Bill 9 (2026) proposes further FIPPA amendments but does not change s. 36.3; check its status before relying on any new provision. - Sources: FIPPA s. 36.3 (BC Laws) https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/96165_03; OIPC BC online privacy breach report form https://oipc.bc.ca/forms/public-bodies/online-privacy-breach-report-form/; FIPPA Part 5 Division 3, offences and penalties (BC Laws) https://www.bclaws.gov.bc.ca/civix/document/id/lc/statreg/96165_05a - Last verified: 2026-10-29 ### Harm test: BC PIPA (voluntary) - Statute: Personal Information Protection Act, S.B.C. 2003, c. 63 - Test: PIPA contains no mandatory breach notification provision. The Commissioner recommends, as best practice, notifying affected individuals and reporting to the OIPC where a breach could reasonably be expected to result in significant harm. - Factors: OIPC checklist, when to report: the personal information involved is sensitive; There is a risk of identity theft or other harm including pain and suffering or loss of reputation; A large number of people are affected by the breach; The information has not been fully recovered; The breach is the result of a systemic problem or a similar breach has occurred before; Risk factors: the type and volume of information, its potential for fraudulent or harmful use, whether the cause was malicious, the extent of containment, whether records were recovered or securely destroyed, and whether they were password protected or encrypted - Records: No statutory requirement; the OIPC recommends documenting every breach and the response. - Consequence: British Columbia has no health-specific privacy act: private clinics and practices fall under PIPA, health authorities and hospitals under FIPPA. Voluntary as of 2026-10-29: no PIPA amendment has been introduced (Bill 9, 2026 amends FIPPA only). The OIPC strongly recommends notifying individuals and reporting to it where significant harm is reasonably possible. Organizations with customers outside BC, Alberta and Quebec are bound by PIPEDA's mandatory test as well. - Sources: OIPC BC: Breach notification for representatives of organizations and public bodies https://oipc.bc.ca/resources/breach-notification-representatives-of-organizations-and-public-bodies/; OIPC BC: Privacy Breach Checklist for private organizations https://www.oipc.bc.ca/guidance-documents/3749; OIPC BC: Privacy breach quick reference guide for small and medium-sized businesses https://oipc.bc.ca/documents/guidance-documents/3134 - Last verified: 2026-10-29 ### Harm test: BC FIPPA - Statute: Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165, s. 36.3 - Test: If a privacy breach involving personal information in the custody or under the control of a public body occurs, the head must, without unreasonable delay, notify an affected individual if the privacy breach could reasonably be expected to result in significant harm to the individual, and notify the commissioner if the privacy breach could reasonably be expected to result in such harm (s. 36.3(2)). A privacy breach is the theft or loss, or the collection, use or disclosure that is not authorized by Part 3, of personal information in the custody or under the control of a public body (s. 36.3(1)). - Harm: Significant harm includes identity theft or significant (i) bodily harm, (ii) humiliation, (iii) damage to reputation or relationships, (iv) loss of employment, business or professional opportunities, (v) financial loss, (vi) negative impact on a credit record, or (vii) damage to, or loss of, property (s. 36.3(2)(a)). The FOIPPA Manual says the list is non-exhaustive and each breach needs a harms assessment. - Factors: The sensitivity, context, and amount of personal information involved; The individuals affected; The relationships of those involved; Ability to contain the breach; Whether the risk of harm from the breach outweighs the risk of further harm from notification (notice may be withheld only where it could reasonably be expected to result in immediate and grave harm to the individual's safety or health, or threaten another individual's, s. 36.3(3)); OIPC BC checklist harm types: identity theft (most likely with SIN, credit card, driver's licence, personal health number or debit card with password), bodily harm including stalking or harassment, humiliation (medical or disciplinary records), damage to reputation or relationships, loss of opportunities, financial loss, credit impact, loss of property - Records: The privacy management program (s. 36.2) must include documented breach processes; s. 36.3 sets no retention period. - Consequence: Notify affected individuals and the Information and Privacy Commissioner without unreasonable delay. Health authorities and hospitals in British Columbia are public bodies under FIPPA; private clinics fall under PIPA. - Sources: FIPPA s. 36.3 (BC Laws) https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/96165_03; BC Government FOIPPA Manual: Privacy breach notifications (updated 2026-04-22) https://www2.gov.bc.ca/gov/content/governments/services-for-government/policies-procedures/foippa-manual/privacy-breach-notifications; BC Government: Guidance on Mandatory Privacy Breach Notifications https://www2.gov.bc.ca/gov/content/governments/services-for-government/information-management-technology/privacy/guidance-on-mandatory-privacy-breach-notifications; OIPC BC: Privacy Breach Checklist for Public Bodies https://oipc.bc.ca/guidance-documents/3748 - Last verified: 2026-10-29 ## Alberta Page: https://frontiercyber.app/tools/breach-notification/alberta/ ### Alberta PIPA - Law: Personal Information Protection Act, S.A. 2003, c. P-6.5, ss. 34.1 and 37.1 - Status: In force since 2010-05-01; covers private sector - Applies to: Private-sector organizations in Alberta (businesses, non-profits in commercial activity, professional regulatory organizations) with personal information under their control. - Threshold: real risk of significant harm. Where a reasonable person would consider that there exists a real risk of significant harm to an individual as a result of the loss of or unauthorized access to or disclosure of personal information. Assessed on sensitivity, probability of misuse, malicious intent and mitigating measures. - Notify Office of the Information and Privacy Commissioner of Alberta: without unreasonable delay. s. 34.1(1). The Commissioner then decides whether individuals must be notified. Report: https://forms.oipc.ab.ca/pipa-privacy-breach-notification-form/ - Notify Affected individuals (conditional or voluntary): as required by the Commissioner under s. 37.1. Individual notification is mandatory only when the Commissioner requires it (s. 37.1); organizations may notify on their own initiative and should follow PIPA Regulation s. 19.1 content requirements. Report: https://oipc.ab.ca/breach-notification/ - Records: No statutory breach register; OIPC expects documentation of the incident and assessment. - Penalties: Offence fines of up to $10,000 for an individual and up to $100,000 for a person other than an individual (PIPA s. 59). - Notes: Mandatory breach reporting in force May 1, 2010 (OIPC Alberta). The Alberta legislature's 2025 PIPA review produced recommendations; no amending bill had been introduced as of September 2026 (secondary source) and none was found on October 29, 2026. - Sources: OIPC Alberta: Breach Notification Requirements https://oipc.ab.ca/breach-notification/; OIPC Alberta PIPA Privacy Breach Notification Form https://forms.oipc.ab.ca/pipa-privacy-breach-notification-form/; Government of Alberta: Organization responsibilities for protecting personal information (PIPA fines) https://www.alberta.ca/organization-responsibilities-for-protecting-personal-information.aspx; OIPC Alberta: Changes to PIPA take effect May 1, 2010 (breach notification) https://oipc.ab.ca/pipa-amendments-2/ - Last verified: 2026-10-29 ### Alberta POPA - Law: Protection of Privacy Act, S.A. 2024, c. P-30.5, s. 10(2)-(3), and the Protection of Privacy (Ministerial) Regulation s. 4 - Status: In force since 2025-06-11; covers public bodies - Applies to: Alberta public bodies formerly under FOIP: ministries, agencies, boards, health authorities as public bodies, universities, colleges, school boards, municipalities, police services. - Threshold: real risk of significant harm. Where a reasonable person would consider that there exists a real risk of significant harm to an individual from loss of, or unauthorized access to or disclosure of, personal information (or data derived from it). Regulation s. 4(1) factors: reasonable basis to believe the information has been misused, malicious intent, sensitivity, and mitigating measures. - Notify Each individual to whom there exists a real risk of significant harm: without unreasonable delay. s. 10(2); notice contents per Regulation s. 4(3). Report: https://www.alberta.ca/system/files/ti-popa-fact-sheet-privacy-incident-motification.pdf - Notify Information and Privacy Commissioner of Alberta: without unreasonable delay. s. 10(2); notice contents per Regulation s. 4(4); must not include affected individuals' personal information. Report: https://oipc.ab.ca/wp-content/uploads/2025/06/Form_POPA-Breach_Notification_202509.docx - Notify Minister of Technology and Innovation: without any unreasonable delay. s. 10(2); contents per Regulation s. 4(5). Report: https://www.alberta.ca/index%2Ephp/report-a-privacy-incident-public-bodies - Records: Privacy management program (mandatory from June 11, 2026) must include breach handling and documentation; no fixed statutory retention period identified. - Penalties: Knowingly contravening Part 1 (personal information): fines of up to $125,000 for an individual and up to $750,000 for an organization (Government of Alberta Bill 33 information sheet, November 2024). The King's Printer text was not opened; confirm the section number in the Act. - Notes: POPA replaced FOIP on June 11, 2025 (FOIP had no mandatory breach duty). Privacy management program obligations apply from June 11, 2026. Breaches that began under FOIP should still be reported on the POPA form with a note (OIPC). - Sources: Government of Alberta fact sheet: POPA Privacy Incident Notifications (June 9, 2025) https://www.alberta.ca/system/files/ti-popa-fact-sheet-privacy-incident-motification.pdf; Alberta.ca: Report a privacy incident (public bodies) https://www.alberta.ca/index%2Ephp/report-a-privacy-incident-public-bodies; OIPC Alberta: POPA overview (in force June 11, 2025) https://oipc.ab.ca/legislation/popa/; OIPC Alberta POPA Breach Notification Assessment Tool (June 2025) https://oipc.ab.ca/wp-content/uploads/2025/06/POPA_Breach_Notification_Assessment_Tool_202506.pdf; Government of Alberta: Protection of Privacy Act fact sheet (penalties and breach notification) https://www.alberta.ca/system/files/popa-fact-sheet-protection-of-privacy-act-for-albertans.pdf; BLG: Alberta overhauls its public sector access and privacy regime (January 2025) https://www.blg.com/en/insights/2025/01/alberta-overhauls-its-public-sector-access-and-privacy-regime - Last verified: 2026-10-29 ### Alberta HIA s. 60.1 - Law: Health Information Act, R.S.A. 2000, c. H-5, s. 60.1 - Status: In force since 2018-08-31; covers health information custodians - Applies to: Alberta custodians (Alberta Health Services, physicians, pharmacists, dentists, nursing homes, Alberta Health) and their affiliates. - Threshold: risk of harm to an individual. Where a custodian determines there is a risk of harm to an individual as a result of the loss of, or unauthorized access to or disclosure of, individually identifying health information (s. 60.1(2)); harm factors are in the HIA Regulation s. 8.1. - Notify Information and Privacy Commissioner of Alberta: as soon as practicable. s. 60.1(2). Report: https://oipc.ab.ca/wp-content/uploads/2025/06/Form_HIA-Breach_Notification_202509.docx - Notify Minister of Health: as soon as practicable. s. 60.1(3). Report: https://oipc.ab.ca/breach-notification/ - Notify Affected individuals: as soon as practicable. s. 60.1(3). Report: https://oipc.ab.ca/breach-notification/ - Records: Affiliates must notify the custodian; custodians should document breaches (OIPC assessment tool). - Penalties: Failing to notify is an offence under HIA s. 107 punishable by fine; amounts are set in the Act. - Notes: Section 60.1 has been in force since August 31, 2018. - Sources: OIPC Alberta: Breach Notification Requirements (HIA s. 60.1) https://oipc.ab.ca/breach-notification/; OIPC Alberta: Mandatory privacy breach reporting coming to Alberta's health sector (in force August 31, 2018) https://oipc.ab.ca/hia-breach-reporting/ - Last verified: 2026-10-29 ### Harm test: Alberta PIPA - Statute: Personal Information Protection Act, S.A. 2003, c. P-6.5, ss. 34.1 and 37.1 - Test: An organization having personal information under its control must, without unreasonable delay, provide notice to the Commissioner of any incident involving the loss of or unauthorized access to or disclosure of the personal information where a reasonable person would consider that there exists a real risk of significant harm to an individual as a result of the loss or unauthorized access or disclosure (s. 34.1(1)). - Harm: PIPA does not define significant harm. The Commissioner: harm is some damage or detriment or injury to the individual; significant means important, meaningful, with non-trivial consequences or effects; a real risk means the likelihood is more than mere speculation or conjecture, with a cause and effect relationship between the incident and the possible harm. Rating the risk only as low, medium or high is not an assessment. - Factors: The nature (sensitivity) of the information involved; Who obtained, or could have obtained, the information; How many persons the information was exposed to; Any personal or professional relationship between the affected individual and the unauthorized recipient; Security measures in place, such as encryption, and any known flaws in them; How long the information was exposed; Evidence of malicious intent, such as theft, hacking or malware; Whether the information could be used for criminal purposes, such as identity theft or fraud; Whether the information was recovered; How many individuals were affected; Whether vulnerable individuals, such as youth or seniors, are involved; The Commissioner's decisions add: absence of reported identity theft or fraud is not a mitigating factor, because identity theft can happen months or years after a breach; compromise by the malicious action of an unknown third party increases the likelihood of harm; safeguards added after the breach do not reduce the risk to affected individuals - Records: No statutory breach register. The notice to the Commissioner must be in writing and include the circumstances, the date or period, the information involved, an assessment of the risk of harm to individuals, the estimated number of individuals at real risk of significant harm, the steps taken to reduce harm and to notify individuals, and a contact person (PIPA Regulation s. 19). - Consequence: Notify the Commissioner without unreasonable delay; the Commissioner may then require the organization to notify affected individuals (s. 37.1), with an expedited process where the risk is obvious and immediate. Organizations may notify individuals on their own initiative. - Sources: OIPC Alberta: Guidance for Notifying the OIPC about a Privacy Breach Under PIPA (April 2024) https://oipc.ab.ca/wp-content/uploads/2024/04/Guidance-for-Notifying-the-OIPC-about-a-Privacy-Breach-Under-PIPA-April-2024.pdf; OIPC Alberta: PIPA Privacy Breach Process (April 2024) https://oipc.ab.ca/wp-content/uploads/2024/04/PIPA-Privacy-Breach-Process-April-2024.pdf; OIPC Alberta Breach Notification Decision P2023-ND-001 https://oipc.ab.ca/wp-content/uploads/2023/11/P2023-ND-001.pdf; OIPC Alberta: Breach Notification Requirements https://oipc.ab.ca/breach-notification/ - Last verified: 2026-10-29 ### Harm test: Alberta POPA - Statute: Protection of Privacy Act, S.A. 2024, c. P-30.5, s. 10, and the Protection of Privacy (Ministerial) Regulation s. 4 - Test: Where a reasonable person would consider that there exists a real risk of significant harm to an individual as a result of the loss of, or unauthorized access to or disclosure of, personal information or data derived from it, the public body must notify the Commissioner, the Minister and the affected individuals. - Factors: Whether there is a reasonable basis to believe the information has been or may be misused; Whether the loss, access or disclosure was the result of malicious intent; The sensitivity of the information; Mitigating measures taken, including recovery and encryption - Records: The privacy management program (mandatory from June 11, 2026) must include breach handling and documentation. - Consequence: Notify the Commissioner, the Minister and affected individuals as soon as reasonably practicable (s. 10(2)-(3)). - Sources: Government of Alberta fact sheet: POPA Privacy Incident Notifications https://www.alberta.ca/system/files/ti-popa-fact-sheet-privacy-incident-motification.pdf; OIPC Alberta POPA Breach Notification Assessment Tool (June 2025) https://oipc.ab.ca/wp-content/uploads/2025/06/POPA_Breach_Notification_Assessment_Tool_202506.pdf - Last verified: 2026-10-29 ### Harm test: Alberta HIA - Statute: Health Information Act, R.S.A. 2000, c. H-5, s. 60.1, and the Health Information Regulation s. 8.1 - Test: A custodian must, as soon as practicable, give notice of any loss of, or unauthorized access to or disclosure of, individually identifying health information in its custody or control where the custodian determines there is a risk of harm to an individual as a result (s. 60.1(2)). - Harm: Harm is some damage or detriment or injury that could be caused to affected individuals because of the incident (OIPC). The custodian must consider all relevant factors, including those in the Health Information Regulation s. 8.1. - Factors: (a) whether there is a reasonable basis to believe that the information has been or may be accessed by a person; (b) whether there is a reasonable basis to believe that the information has been misused or will be misused; (c) whether the information could be used for the purpose of identity theft or to commit fraud; (d) whether the information is of a type that could cause embarrassment or physical, mental or financial harm to the individual; (e) whether the loss or unauthorized access or disclosure has adversely affected or will adversely affect the provision of a health service to the individual; (f) for electronic information, whether the custodian can demonstrate it was encrypted or otherwise secured in a manner that would prevent unauthorized access or render it unintelligible; (g) for lost information, whether it was destroyed or rendered inaccessible or unintelligible; (h) for recovered lost information, whether the custodian can demonstrate it was not accessed before it was recovered; (i) for unauthorized access or disclosure, whether the only recipient was a custodian or affiliate subject to confidentiality policies who acted within their duties, did not use the information for an improper purpose and used it only to address the error - Records: No general breach record duty in s. 60.1; a decision not to notify an individual because notice could harm their mental or physical health must be reported to the Commissioner immediately with the breach report (Regulation s. 8.3). Affiliates must notify the custodian as soon as practicable (s. 60.1(1)). - Consequence: Notify the Commissioner, the Minister of Health and the affected individuals as soon as practicable. - Sources: OIPC Alberta: Breach Reporting (HIA s. 60.1 and Regulation s. 8.1) https://oipc.ab.ca/wp-content/uploads/2024/04/Breach-Reporting-2018.pdf; OIPC Alberta: Breach Notification Requirements https://oipc.ab.ca/breach-notification/; OIPC Alberta: Mandatory privacy breach reporting in Alberta's health sector https://oipc.ab.ca/hia-breach-reporting/ - Last verified: 2026-10-29 ## Saskatchewan Page: https://frontiercyber.app/tools/breach-notification/saskatchewan/ ### Saskatchewan FOIP / LA FOIP - Law: The Freedom of Information and Protection of Privacy Act, s. 29.1, and The Local Authority Freedom of Information and Protection of Privacy Act, s. 28.1 - Status: In force since 2018-01-01; covers public bodies - Applies to: Saskatchewan government institutions (FOIP) and local authorities such as municipalities, school divisions, universities and the Saskatchewan Health Authority (LA FOIP). - Threshold: real risk of significant harm. Where it is reasonable in the circumstances to believe that an unauthorized use or disclosure of personal information creates a real risk of significant harm to the individual, the public body must take all reasonable steps to notify that individual (FOIP s. 29.1; LA FOIP s. 28.1). Reporting to the Commissioner is not required by statute. - Notify Affected individuals: take all reasonable steps to notify (no statutory deadline). OIPC guidance: notify as soon as possible after key facts are established. Report: https://publications.saskatchewan.ca/api/v1/products/527/formats/694/download - Notify Saskatchewan Information and Privacy Commissioner (voluntary) (conditional or voluntary): proactive reporting encouraged; OIPC asks for its questionnaire within 30 days of a proactive report. Not mandatory under FOIP, LA FOIP or HIPA; the OIPC 'always' encourages it and in 2025 recommended trustees adopt policies to notify within ten calendar days of initiating containment. Report: https://oipc.sk.ca/assets/privacy-breach-guidelines-for-government-institutions-and-local-authorities.pdf - Records: No statutory register; OIPC guidelines recommend documenting every breach and the response. - Penalties: FOIP s. 68: fines up to $50,000 and/or one year imprisonment for knowingly collecting, using or disclosing personal information in contravention of the Act; no offence for failing to notify. - Notes: Section 29.1 was added by S.S. 2017, c. 12 and the FOIP and LA FOIP amendments came into force January 1, 2018. LA FOIP s. 28.1 is the equivalent duty for local authorities (municipalities, school divisions, health authorities); the Commissioner's guidance explains how both are applied. - Sources: FOIP (Saskatchewan) consolidated PDF https://publications.saskatchewan.ca/api/v1/products/527/formats/694/download; OIPC SK Privacy Breach Guidelines for Government Institutions and Local Authorities (May 2023) https://oipc.sk.ca/assets/privacy-breach-guidelines-for-government-institutions-and-local-authorities.pdf; Government of Saskatchewan news release, December 14, 2017: amendments in force January 1, 2018 https://www.saskatchewan.ca/government/news-and-media/2017/december/14/access-and-privacy-legislation - Last verified: 2026-10-29 ### Saskatchewan HIPA - Law: The Health Information Protection Act, S.S. 1999, c. H-0.021, s. 16 and The Health Information Protection Regulations, 2023 - Status: Voluntary; covers health information custodians - Applies to: Saskatchewan trustees: Saskatchewan Health Authority, eHealth, physicians, pharmacists, other health professionals and facilities. - Threshold: none in statute; OIPC applies the LA FOIP real-risk-of-significant-harm practice. HIPA s. 16 requires policies and safeguards but no breach notification provision was located; the OIPC's 2025 investigation report states trustees should follow the LA FOIP s. 28.1 practice (notify individuals where a real risk of significant harm) and recommends notifying the OIPC within ten calendar days of initiating containment. - Notify Affected individuals (OIPC expectation) (conditional or voluntary): at the earliest opportunity (OIPC). Recommendation of the Saskatchewan Information and Privacy Commissioner, not a statutory duty. HIPA itself contains no breach notification section; the Commissioner applies the public sector practice to trustees. Report: https://oipc.sk.ca/assets/hipa-investigation_193-2024-043-2025.pdf - Notify Saskatchewan Information and Privacy Commissioner (voluntary) (conditional or voluntary): OIPC recommendation: within ten calendar days of initiating containment. Recommendation of the Saskatchewan Information and Privacy Commissioner, not a statutory duty. HIPA itself contains no breach notification section; the Commissioner applies the public sector practice to trustees. Report: https://oipc.sk.ca/assets/hipa-investigation_193-2024-043-2025.pdf - Records: Not specified. - Penalties: HIPA s. 64 offence provisions apply; amounts are set in the Act. - Notes: Private clinics also fall under PIPEDA for commercial activity. Trustees that are also local authorities (the Saskatchewan Health Authority and others listed under LA FOIP) are bound by the mandatory LA FOIP s. 28.1 duty to notify individuals; see the Saskatchewan FOIP / LA FOIP regime. The August 1, 2023 HIPA changes (MLT Aikins) did not add a breach notification duty. - Sources: OIPC SK Investigation Report 193-2024, 043-2025 (SHA) https://oipc.sk.ca/assets/hipa-investigation_193-2024-043-2025.pdf; MLT Aikins: New privacy requirements for Saskatchewan health system (Aug 1, 2023 amendments) https://www.mltaikins.com/health-care/new-privacy-requirements-for-saskatchewan-health-system - Last verified: 2026-10-29 ### Harm test: Saskatchewan FOIP and LA FOIP - Statute: The Freedom of Information and Protection of Privacy Act, s. 29.1; The Local Authority Freedom of Information and Protection of Privacy Act, s. 28.1 - Test: A government institution shall take all reasonable steps to notify an individual of an unauthorized use or disclosure of that individual's personal information by the government institution if it is reasonable in the circumstances to believe that the incident creates a real risk of significant harm to the individual (FOIP s. 29.1; LA FOIP s. 28.1 for local authorities). Neither Act defines significant harm or lists factors. - Factors: The Commissioner's privacy breach guidelines: sensitivity of the personal information, probability of misuse, whether the information was recovered or protected, and the harm the individual could suffer - Records: No statutory register; the Commissioner's guidelines recommend documenting every breach and the response. - Consequence: Take all reasonable steps to notify the affected individual. Reporting to the Commissioner is recommended, not required by statute. - Sources: FOIP (Saskatchewan) consolidated PDF https://publications.saskatchewan.ca/api/v1/products/527/formats/694/download; OIPC SK Privacy Breach Guidelines for Government Institutions and Local Authorities (May 2023) https://oipc.sk.ca/assets/privacy-breach-guidelines-for-government-institutions-and-local-authorities.pdf - Last verified: 2026-10-29 ### Harm test: Saskatchewan HIPA (Commissioner's practice) - Statute: The Health Information Protection Act, S.S. 1999, c. H-0.021, s. 16; LA FOIP s. 28.1 for trustees that are local authorities - Test: HIPA contains no breach notification provision and no significant harm test (consolidation with amendments to 2024, c. 4). The Commissioner directs trustees to follow the LA FOIP s. 28.1 practice: notify individuals where a real risk of significant harm exists, and report to the Commissioner within ten calendar days of initiating containment. - Factors: Sensitivity of the personal health information; Probability of misuse; Whether the information was recovered or protected - Records: Not specified; document the assessment. - Consequence: Notify individuals where a real risk of significant harm exists (mandatory for trustees that are local authorities under LA FOIP s. 28.1); report to the Commissioner as recommended. - Sources: OIPC SK Investigation Report 193-2024, 043-2025 (SHA) https://oipc.sk.ca/assets/hipa-investigation_193-2024-043-2025.pdf - Last verified: 2026-10-29 ## Manitoba Page: https://frontiercyber.app/tools/breach-notification/manitoba/ ### Manitoba FIPPA s. 41.1 - Law: The Freedom of Information and Protection of Privacy Act, C.C.S.M. c. F175, s. 41.1 (added by S.M. 2021, c. 43) - Status: In force since 2022-01-01; covers public bodies - Applies to: Manitoba public bodies: departments, Crown agencies, municipalities, school divisions, universities, regional health authorities and other local public bodies. - Threshold: real risk of significant harm. A privacy breach (theft or loss, or access, use, disclosure, destruction or alteration in contravention of the Act) that, after considering the factors prescribed by regulation, could reasonably be expected to create a real risk of significant harm to the individual (s. 41.1(2)). The FIPPA Regulation ss. 3.1-3.3 set the risk-assessment factors and notice contents, and permit indirect notice in some cases. - Notify Manitoba Ombudsman: at the time and in the form and manner that the Ombudsman requires (s. 41.1(4)). s. 41.1(4): required whenever notice to the individual is required under s. 41.1(2). The Ombudsman's reporting form fulfils the requirement. Report: https://www.ombudsman.mb.ca/for-public-bodies/report-a-privacy-breach/ - Notify Affected individuals: as soon as practicable after the privacy breach becomes known to the head of the public body (s. 41.1(3)(a)). Direct notice unless the regulation permits indirect notice (s. 41.1(3)(c)). Report: https://gov.mb.ca/fippa/print,amend_detail.html - Records: Not specified in sources reviewed. - Penalties: FIPPA s. 85 offence provisions apply; amounts are set in the Act. - Notes: Section 41.1 was added by S.M. 2021, c. 43 and has been in force since January 1, 2022. Before 2022 reporting to the Ombudsman was voluntary, and some older Ombudsman pages still describe the voluntary regime. - Sources: Government of Manitoba: FIPPA Amendments (s. 41.1 breach notification, in force Jan 1, 2022) https://gov.mb.ca/fippa/print,amend_detail.html; Manitoba Ombudsman: Report a Privacy Breach https://www.ombudsman.mb.ca/for-public-bodies/report-a-privacy-breach/; S.M. 2021, c. 43 (FIPPA amendments, s. 41.1 text) https://web2.gov.mb.ca/laws/statutes/2021/c04321e.php - Last verified: 2026-10-29 ### Manitoba PHIA s. 19.0.1 - Law: The Personal Health Information Act, C.C.S.M. c. P33.5, s. 19.0.1 (added by S.M. 2021, c. 47) - Status: In force since 2022-01-01; covers health information custodians - Applies to: Manitoba trustees: health professionals, health care facilities, regional health authorities, Shared Health, public bodies holding personal health information. - Threshold: real risk of significant harm. After considering the factors set by regulation, a privacy breach that could reasonably be expected to create a real risk of significant harm to the individual. - Notify Affected individuals: as soon as practicable after the privacy breach becomes known to the trustee. s. 19.0.1(2)-(3). Report: https://web2.gov.mb.ca/laws/statutes/ccsm/_pdf(toc).php?cap=p33.5 - Notify Manitoba Ombudsman: at the time and in the form and manner that the Ombudsman requires. s. 19.0.1(4); required whenever individual notice is required. Report: https://www.ombudsman.mb.ca/for-public-bodies/report-a-privacy-breach/ - Records: Not specified. - Penalties: PHIA s. 63 offences include failing to comply with s. 19.0.1 (added by S.M. 2021, c. 47); amounts are set in the Act. - Notes: In-force date January 1, 2022 per the consolidated Act's legislative history. - Sources: Manitoba PHIA (C.C.S.M. c. P33.5) consolidated https://web2.gov.mb.ca/laws/statutes/ccsm/_pdf(toc).php?cap=p33.5; S.M. 2021, c. 47 (PHIA amendments) https://web2.gov.mb.ca/laws/statutes/2021/c04721e.php - Last verified: 2026-10-29 ### Harm test: Manitoba FIPPA - Statute: The Freedom of Information and Protection of Privacy Act, C.C.S.M. c. F175, s. 41.1, and the FIPPA Regulation ss. 3.1 to 3.3 - Test: A public body must notify an individual of a privacy breach that, after considering the factors prescribed by regulation, could reasonably be expected to create a real risk of significant harm to the individual (s. 41.1(2)). - Factors: The factors prescribed by the FIPPA Regulation (ss. 3.1-3.3), including the sensitivity of the information and the probability of misuse; Whether the information was recovered, encrypted or otherwise protected; The number of individuals affected - Records: Not specified in the sources reviewed; document the assessment. - Consequence: Notify the affected individual as soon as reasonably practicable; report to the Ombudsman as the Regulation requires. - Sources: Government of Manitoba: FIPPA Amendments (s. 41.1 breach notification) https://gov.mb.ca/fippa/print,amend_detail.html; S.M. 2021, c. 43 (FIPPA amendments, s. 41.1 text) https://web2.gov.mb.ca/laws/statutes/2021/c04321e.php - Last verified: 2026-10-29 ### Harm test: Manitoba PHIA - Statute: The Personal Health Information Act, C.C.S.M. c. P33.5, s. 19.0.1 - Test: A trustee must notify the individual if a privacy breach could reasonably be expected to create a real risk of significant harm to the individual, having regard to the prescribed factors (s. 19.0.1(2)), as soon as practicable after the breach becomes known, directly and in the prescribed form (s. 19.0.1(3)), and must also notify the Ombudsman (s. 19.0.1(4)). - Harm: Significant harm includes bodily harm, humiliation, damage to the individual's reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record, and damage to or loss of property (s. 19.0.1(1)). - Factors: (a) the sensitivity of the personal health information involved; (b) the probability that the information could be used to cause significant harm, having regard for: (i) the event that caused the breach, including evidence of malicious intent such as theft or unauthorized access to a computer system; (ii) the number of persons who actually or potentially accessed the information; (iii) whether the identity of those persons is known or unknown; (iv) any known relationship between those persons and the individual, and its nature; (v) whether the trustee is reasonably satisfied that any such person has destroyed unauthorized copies and committed not to use or disclose it; (vi) the length of time since the breach first occurred and the period the information was available to be accessed, used, disclosed, destroyed or altered; (vii) the amount of personal health information involved; (viii) whether the information has been recovered; (ix) whether it was adequately encrypted, anonymized or otherwise not easily accessible; (x) whether harm has materialized; (c) any other factors that are reasonably relevant in the circumstances (Personal Health Information Regulation s. 8.7) - Records: Not specified in s. 19.0.1; the notice must contain the nine prescribed elements (Regulation s. 8.8), so keep the assessment that supports them. - Consequence: Notify the affected individual directly and in the prescribed form as soon as practicable, and notify the Ombudsman. - Sources: Manitoba PHIA (C.C.S.M. c. P33.5) consolidated https://web2.gov.mb.ca/laws/statutes/ccsm/_pdf.php?cap=p33.5; Personal Health Information Regulation, M.R. 245/97 https://web2.gov.mb.ca/laws/regs/current/_pdf-regs.php?reg=245/97; Manitoba Ombudsman practice note: Privacy breaches, key steps (January 2022) https://www.ombudsman.mb.ca/wp-content/uploads/2025/11/PN-FIPPA-PHIA-breach-key-steps-EN.pdf - Last verified: 2026-10-29 ## Ontario Page: https://frontiercyber.app/tools/breach-notification/ontario/ ### Ontario FIPPA s. 40.1 - Law: Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F.31, ss. 34 and 40.1, as amended by Bill 194 (Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024, Schedule 2) - Status: In force since 2025-07-01; covers public bodies - Applies to: Provincial institutions under FIPPA: ministries, agencies, hospitals, universities, colleges, Ontario Power Generation and other listed bodies. MFIPPA municipal institutions (municipalities, school boards, police boards) are NOT covered by the s. 40.1 duty. - Threshold: real risk that a significant harm to an individual would result. Theft, loss or unauthorized use or disclosure of personal information where it is reasonable in the circumstances to believe there is a real risk of significant harm, or other prescribed circumstances. Significant harm includes financial loss, identity theft and damage to reputation; factors include sensitivity, likelihood of misuse, mitigation steps and IPC guidance. In some prescribed cases the institution must report to the IPC but is prohibited from notifying individuals. - Notify Information and Privacy Commissioner of Ontario (IPC): as soon as feasible after the head determines that the theft, loss or unauthorized use or disclosure occurred. s. 40.1 (report in prescribed form and manner). Report: https://www.ipc.on.ca/en/resources/forms/report-privacy-breach-your-organization - Notify Affected individuals: as soon as feasible after the head determines that the theft, loss or unauthorized use or disclosure occurred. Unless another law prohibits notification; contents prescribed by regulation. Report: https://ola.org/en/legislative-business/bills/parliament-43/session-1/bill-194 - Notify IPC (annual statistical report): by March 31 of the following year. s. 34(2)(c.1): annual report must include the number of thefts, losses or unauthorized uses or disclosures recorded under s. 40.1(8). First report (covering July 1 to December 31, 2025) due March 31, 2026; submitted through the IPC statistical reporting portal. Report: https://www.ipc.on.ca/en/node/5047 - Records: s. 40.1(8): keep and maintain a record of every theft, loss or unauthorized use or disclosure reported to the IPC (number, type, individuals affected) for annual reporting. - Penalties: Bill 194 Schedule 2 added no breach-specific fine; the IPC gained binding order powers and a complaint regime . - Notes: Schedule 2 of Bill 194 (ss. 1 to 14) was proclaimed in force July 1, 2025. Subsection numbering within s. 40.1 follows the Bill text; confirm against the consolidated Act on e-Laws. MFIPPA institutions (municipalities, school boards, police boards) have no statutory breach duty; the IPC recommends they report significant breaches voluntarily. - Sources: Bill 194 as passed (Legislative Assembly of Ontario) https://ola.org/en/legislative-business/bills/parliament-43/session-1/bill-194; IPC FAQ: Schedule 2 of Bill 194 / FIPPA amendments https://www.ipc.on.ca/en/node/5061; IPC: Annual reporting of privacy breach statistics, provincial institutions https://www.ipc.on.ca/en/node/5047; Lexpert: FIPPA changes have taken effect https://www.lexpert.ca/news/technology-law/ontario-freedom-of-information-and-protection-of-privacy-act-changes-have-taken-effect/392932 - Last verified: 2026-10-29 ### Ontario O. Reg. 51/26 (EDSTA) - Law: Ontario Regulation 51/26: Cyber Security, made under the Enhancing Digital Security and Trust Act, 2024 (Bill 194, Schedule 1) - Status: In force since 2026-07-01; covers public bodies - Applies to: Prescribed public sector entities: colleges and universities (as defined in FIPPA), Group A, B and C public hospitals and the University of Ottawa Heart Institute, school boards under the Education Act, and children's aid societies including Indigenous child and family well-being agencies. - Threshold: critical cyber security incident. An incident compromising the security, continuity, confidentiality, integrity or availability of digital information the entity collects, uses, retains or discloses, or the infrastructure housing or transmitting it, AND meeting at least one threshold: significant adverse impact on public service delivery, risk to public safety, significant recovery effort or activation of incident response plans, or significant risk of reputational harm/loss of public confidence. Not limited to personal information. - Notify Chief Information Security Officer, Ministry of Public and Business Service Delivery and Procurement: within 72 hours after confirmation of the incident. Clock runs from confirmation that a critical incident occurred, so document the confirmation decision. This is separate from, and in addition to, any FIPPA s. 40.1 or PHIPA report to the IPC. Report: https://www.ontario.ca/page/enhancing-digital-security-and-trust-act - Records: Maintain a cyber security program; complete a cyber security maturity assessment by July 1, 2027 and every two years, with a summary to the CISO within 30 days of completion. - Penalties: No fines in the regulation; compliance is enforced through the Minister's directive powers under EDSTA. - Notes: EDSTA was in force January 29, 2025; O. Reg. 51/26 and the companion O. Reg. 52/26 (student digital information notices for school boards) took effect July 1, 2026. Reports go to the Ministry Chief Information Security Officer, not the IPC, and are in addition to any FIPPA s. 40.1 or PHIPA duty. Read the regulation text on e-Laws for the reporting clause and definitions. - Sources: Ontario.ca: Enhancing Digital Security and Trust Act (regulation summary) https://www.ontario.ca/page/enhancing-digital-security-and-trust-act; BLG: Ontario introduces cyber and educational technology regulations (April 2026) https://www.blg.com/en/insights/2026/04/ontario-introduces-cyber-and-educational-technology-regulations; Hicks Morley: obligations in force July 1, 2026 https://hicksmorley.com/2026/03/25/new-public-sector-cybersecurity-governance-student-digital-information-transparency-obligations-in-force-july-1/; Bill 194 (EDSTA regulation-making power s. 2(1)(c)-(d)) https://ola.org/en/legislative-business/bills/parliament-43/session-1/bill-194 - Last verified: 2026-10-29 ### Ontario PHIPA s. 12 - Law: Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A, s. 12, and O. Reg. 329/04 ss. 6.3-6.4 - Status: In force since 2017-10-01; covers health information custodians - Applies to: Health information custodians in Ontario (hospitals, physicians, clinics, pharmacies, long-term care homes, laboratories, Ontario Health) and their agents. - Threshold: theft, loss or unauthorized use or disclosure (individuals); prescribed circumstances (IPC). Individuals must be notified of any theft, loss or unauthorized use or disclosure of their personal health information. The IPC must be notified where a prescribed circumstance exists: use or disclosure by a person who knew or ought to have known it was unauthorized; theft; further unauthorized use or disclosure after an initial incident; a pattern of similar incidents; a College notice under s. 17.1 (or would be if the agent were a College member); or the custodian determines the incident is significant having regard to sensitivity, volume, number of individuals and number of custodians or agents involved. - Notify Affected individuals: at the first reasonable opportunity. s. 12(2); the notice must state the individual's right to complain to the IPC. Report: https://www.ipc.on.ca/en/media/3363/download - Notify Information and Privacy Commissioner of Ontario: at the first reasonable opportunity. s. 12(3) with O. Reg. 329/04 s. 6.3(3); in force October 1, 2017. Report: https://www.ipc.on.ca/en/resources/forms/report-privacy-breach-your-organization - Notify IPC (annual statistics): annually by March 1 for the previous calendar year. O. Reg. 329/04 s. 6.4: the annual report covers the number of thefts, losses and unauthorized uses or disclosures in the previous calendar year, due to the IPC by March 1 (first report March 1, 2019). Add this incident to the count. Report: https://www.ipc.on.ca/en/node/2484 - Notify Regulatory College of the agent (s. 17.1) (conditional or voluntary): within 30 days after the disciplinary action or termination. s. 17.1: applies only where the custodian takes disciplinary action against an agent who is a member of a regulated health profession (or the agent resigns in response), for unauthorized collection, use, disclosure or disposal of personal health information. Written notice to the College within 30 days. Report: https://www.ipc.on.ca/en/node/2484 - Records: Keep records sufficient to produce the annual statistical report; retain breach documentation. - Penalties: PHIPA s. 72, as amended in 2020: fines of up to $200,000 and up to one year of imprisonment for individuals, and up to $1,000,000 for organizations. - Notes: Hospitals are also prescribed entities under O. Reg. 51/26 (72-hour report to the Ministry CISO) and FIPPA institutions (s. 40.1), so a single incident can trigger three Ontario reports. - Sources: IPC: Regulations - prescribed circumstances for notifying the Commissioner (O. Reg. 329/04 s. 6.3) https://www.ipc.on.ca/en/node/2484; IPC presentation: Mandatory Reporting Obligations (PHIPA s. 12(2), prescribed circumstances in force Oct 1, 2017) https://www.ipc.on.ca/en/media/3363/download; IPC breach report form https://www.ipc.on.ca/en/resources/forms/report-privacy-breach-your-organization; CMPA: The new reality of reporting a privacy breach (annual report by March 1) https://www.cmpa-acpm.ca/en/advice-publications/browse-articles/2018/the-new-reality-of-reporting-a-privacy-breach; College of Respiratory Therapists of Ontario: Changes to PHIPA (s. 17.1 College notice within 30 days) https://www.crto.on.ca/?p=4724; McCarthy Tetrault: Amendments to Ontario's health information legislation bring new obligations and penalties (June 22, 2020) https://www.mccarthy.ca/en/insights/blogs/techlex/amendments-to-ontario-s-health-information-legislation-bring-new-obligations-and-penalties - Last verified: 2026-10-29 ### Harm test: Ontario FIPPA - Statute: Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F.31, s. 40.1 (Bill 194, Schedule 2, in force July 1, 2025) - Test: Where personal information is stolen, lost or used or disclosed without authority and it is reasonable in the circumstances to believe that there is a real risk that a significant harm to an individual would result, or in other prescribed circumstances, the institution must notify the Commissioner and the affected individuals. - Harm: Significant harm includes financial loss, identity theft and damage to reputation. - Factors: The sensitivity of the personal information; The likelihood that the information has been or will be misused; Steps taken to mitigate the breach; Any guidance issued by the Commissioner - Records: Keep and maintain a record of every theft, loss or unauthorized use or disclosure reported to the Commissioner, for the annual statistical report (s. 40.1(8)). - Consequence: Notify the Information and Privacy Commissioner and affected individuals as soon as feasible. Municipal institutions under MFIPPA have no statutory duty; the Commissioner recommends the same practice. - Sources: Bill 194 as passed (Legislative Assembly of Ontario) https://ola.org/en/legislative-business/bills/parliament-43/session-1/bill-194; IPC FAQ: Schedule 2 of Bill 194 / FIPPA amendments https://www.ipc.on.ca/en/node/5061 - Last verified: 2026-10-29 ### Harm test: Ontario PHIPA - Statute: Personal Health Information Protection Act, 2004, s. 12, and O. Reg. 329/04 ss. 6.3 to 6.4 - Test: A health information custodian that has custody or control of personal health information about an individual shall notify the individual at the first reasonable opportunity if the information is stolen or lost or if it is used or disclosed without authority (s. 12(2)). The Commissioner must be notified where a prescribed circumstance exists (s. 12(3)). - Factors: Prescribed circumstances for notifying the Commissioner (O. Reg. 329/04 s. 6.3): use or disclosure without authority by a person who knew or ought to have known it was unauthorized; The information was stolen; Further use or disclosure without authority after an initial loss or unauthorized use or disclosure; The incident is part of a pattern of similar incidents; The custodian is required to give notice to a College of a disciplinary matter; The custodian would have been required to give notice to a College had the agent been a member; The incident is significant having regard to the sensitivity of the information, the number of individuals and custodians or agents involved, and the circumstances - Records: Keep records sufficient to produce the annual statistical report to the Commissioner (O. Reg. 329/04 s. 6.4) and retain the breach documentation. - Consequence: Notify the individual at the first reasonable opportunity in every case; notify the Commissioner where a prescribed circumstance exists; report annual statistics by March 1. - Sources: IPC Ontario: Reporting a Privacy Breach to the Commissioner, Guidelines for the Health Sector (March 2021, reproduces O. Reg. 329/04 s. 6.3) https://ipc.on.ca/media/3430/download; IPC: Regulations, prescribed circumstances for notifying the Commissioner (O. Reg. 329/04 s. 6.3) https://www.ipc.on.ca/en/node/2484; IPC breach report form https://www.ipc.on.ca/en/resources/forms/report-privacy-breach-your-organization - Last verified: 2026-10-29 ## Quebec Page: https://frontiercyber.app/tools/breach-notification/quebec/ ### Quebec Law 25 (private sector) - Law: Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, ss. 3.5 to 3.8, and the Regulation respecting confidentiality incidents (CQLR c. A-2.1, r. 3.1) - Status: In force since 2022-09-22; covers private sector - Applies to: Any enterprise (person carrying on an enterprise) that collects, holds, uses or communicates personal information in Quebec, including out-of-province organizations handling Quebec residents' data. - Threshold: risk of serious injury. A confidentiality incident is access, use or communication not authorized by law, or loss or any other breach of protection (s. 3.6). If the incident presents a risk of serious injury, the Commission and affected persons must be notified. Assess sensitivity of the information, anticipated consequences of its use and likelihood of use for injurious purposes, and consult the person in charge of personal information protection (s. 3.7). - Notify Commission d'accès à l'information du Québec (CAI): promptly (avec diligence). s. 3.5. Notice in writing with the eleven items listed in the Regulation (ss. 3-4); send newly discovered information promptly afterwards. Report: https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1 - Notify Persons concerned: promptly (avec diligence). May be deferred while notice could hamper a criminal investigation. Contents per Regulation ss. 5-6; public notice permitted where direct notice could increase harm, cause undue hardship or contact details are unavailable. Report: https://www.legisquebec.gouv.qc.ca/fr/document/rc/A-2.1,%20r.%203.1 - Records: Keep a register of every confidentiality incident (including those without serious injury) with the eight prescribed categories; keep each entry up to date and retain it for at least five years after the enterprise became aware of the incident; provide a copy to the CAI on request (s. 3.8; Regulation ss. 7-8). - Penalties: Monetary administrative penalties of up to $50,000 for a natural person and, in all other cases, $10,000,000 or 2% of worldwide turnover for the preceding fiscal year, whichever is greater (s. 90.12); penal fines of $5,000 to $100,000 for a natural person and $15,000 to $25,000,000 or 4% of worldwide turnover, whichever is greater, in all other cases (s. 91), doubled for a subsequent offence (s. 92.1). - Notes: Confidentiality-incident duties in force since September 22, 2022; the Regulation (O.C. 1761-2022) applied from late December 2022. Statutory wording is 'promptly' (EN) / 'avec diligence' (FR). Quebec financial institutions and credit assessment agents regulated by the AMF have a separate duty: the Regulation respecting the management and reporting of information security incidents by certain financial institutions and by credit assessment agents has been in force since April 23, 2025 and requires a report to the AMF via E-Services no later than 24 hours from the time an officer (or manager) is informed, with updates every three days. - Sources: Act respecting the protection of personal information in the private sector (Légis Québec, EN) https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1; Regulation respecting confidentiality incidents (Légis Québec, FR) https://www.legisquebec.gouv.qc.ca/fr/document/rc/A-2.1,%20r.%203.1; Act respecting the protection of personal information in the private sector (Legis Quebec PDF) https://www.legisquebec.gouv.qc.ca/en/pdf/cs/P-39.1.pdf; AMF: Information security incident management (regulation in force April 23, 2025) https://lautorite.qc.ca/en/professionals/insurers/information-security-incident-management - Last verified: 2026-10-29 ### Quebec Access Act (public sector) - Law: Act respecting Access to documents held by public bodies and the Protection of personal information, CQLR c. A-2.1, ss. 63.8 to 63.11, and the Regulation respecting confidentiality incidents - Status: In force since 2022-09-22; covers public bodies - Applies to: Quebec public bodies: government departments, agencies, municipalities, school service centres, health and social services institutions, universities and colleges. - Threshold: risk of serious injury. A confidentiality incident (unauthorized access, use or communication, or loss or other breach, s. 63.9) presenting a risk of serious injury, assessed on sensitivity, anticipated consequences and likelihood of injurious use, after consulting the person in charge of personal information protection (s. 63.10). - Notify Commission d'accès à l'information du Québec: promptly (avec diligence). s. 63.8. Quebec government guidance says notify the CAI as soon as possible even before all facts are gathered and complete the declaration afterwards. Report: https://www.legisquebec.gouv.qc.ca/fr/document/lc/A-2.1 - Notify Persons concerned: promptly (avec diligence). May be deferred while notice could hamper a police investigation. The CAI may order notification. Report: https://www.quebec.ca/gouvernement/travailler-gouvernement/normes-gouvernance-pratiques-internes/protection-des-renseignements-personnels/incident-de-confidentialite - Records: Register of all confidentiality incidents (s. 63.11), retained at least five years after awareness (Regulation s. 8); copy to the CAI on request. - Penalties: Public bodies are subject to the Access Act's penal provisions. The monetary administrative penalties in s. 90.12 of the private sector Act apply to enterprises, not public bodies. Amounts are set in the Access Act. - Notes: Section numbering: the incident duties are ss. 63.8-63.11 (s. 63.7 is default confidentiality settings), not 63.7-63.10. - Sources: Loi sur l'accès (Légis Québec, FR) https://www.legisquebec.gouv.qc.ca/fr/document/lc/A-2.1; Québec.ca: Incident de confidentialité (public bodies) https://www.quebec.ca/gouvernement/travailler-gouvernement/normes-gouvernance-pratiques-internes/protection-des-renseignements-personnels/incident-de-confidentialite; Règlement sur les incidents de confidentialité https://www.legisquebec.gouv.qc.ca/fr/document/rc/A-2.1,%20r.%203.1 - Last verified: 2026-10-29 ### Harm test: Quebec Law 25 (private sector) - Statute: Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, ss. 3.5 to 3.8 - Test: If the incident presents a risk of serious injury, the person carrying on an enterprise must promptly notify the Commission d'acces a l'information and any person whose personal information is concerned by the incident (s. 3.5). - Harm: In assessing the risk of injury to a person whose personal information is concerned by a confidentiality incident, the enterprise must consider, in particular, the sensitivity of the information concerned, the anticipated consequences of its use and the likelihood that such information will be used for injurious purposes, and must consult the person in charge of the protection of personal information (s. 3.7). - Factors: The sensitivity of the information concerned; The anticipated consequences of its use; The likelihood that the information will be used for injurious purposes; The person in charge of the protection of personal information must be consulted - Records: Keep a register of every confidentiality incident, whether or not the risk of injury is serious, recording the information involved, the circumstances, the date or period, the date the enterprise became aware, the number of persons concerned, the elements leading it to conclude whether there is a risk of serious injury, the dates of any notices and the measures taken after the incident; keep each entry up to date for at least five years after awareness and provide a copy to the Commission on request (s. 3.8; Regulation respecting confidentiality incidents, CQLR c. A-2.1, r. 3.1, ss. 7 and 8). - Consequence: Notify the Commission d'acces a l'information and the persons concerned promptly, and take reasonable measures to reduce the risk of injury and prevent new incidents of the same nature (s. 3.5). Quebec has no separate health privacy act: private clinics and practices fall under this Act, public health institutions under the Access Act. - Sources: Act respecting the protection of personal information in the private sector (Legis Quebec, EN) https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1; Regulation respecting confidentiality incidents, CQLR c. A-2.1, r. 3.1 (Legis Quebec) https://www.legisquebec.gouv.qc.ca/en/document/cr/a-2.1,%20r.%203.1; CAI: Prevenir les incidents de confidentialite, guide explicatif pour les entreprises (January 2026) https://www.cai.gouv.qc.ca/uploads/pdfs/CAI_GU_ENTR_Prevention_incidents.pdf; CAI: Incidents de confidentialite et mesures de securite (entreprises) https://www.cai.gouv.qc.ca/protection-renseignements-personnels/information-entreprises-privees/incidents-confidentialite-mesures-securite-entreprises - Last verified: 2026-10-29 ### Harm test: Quebec Access Act (public bodies) - Statute: Act respecting Access to documents held by public bodies and the Protection of personal information, CQLR c. A-2.1, ss. 63.8 to 63.11 - Test: A public body that has cause to believe a confidentiality incident has occurred must take reasonable measures to reduce the risk of injury; if the incident presents a risk of serious injury, it must promptly notify the Commission d'acces a l'information and the persons concerned (s. 63.8). - Factors: The sensitivity of the information concerned; The anticipated consequences of its use; The likelihood that the information will be used for injurious purposes; The person in charge of the protection of personal information must be consulted (s. 63.10) - Records: Register of all confidentiality incidents (s. 63.11), retained at least five years after awareness (Regulation s. 8); copy to the Commission on request. - Consequence: Notify the Commission d'acces a l'information and the persons concerned promptly. Public health institutions in Quebec are public bodies under this Act; private clinics fall under the private sector Act. - Sources: Loi sur l'acces (Legis Quebec, FR) https://www.legisquebec.gouv.qc.ca/fr/document/lc/A-2.1; Reglement sur les incidents de confidentialite https://www.legisquebec.gouv.qc.ca/fr/document/rc/A-2.1,%20r.%203.1 - Last verified: 2026-10-29 ## New Brunswick Page: https://frontiercyber.app/tools/breach-notification/new-brunswick/ ### New Brunswick RTIPPA - Law: Right to Information and Protection of Privacy Act, S.N.B. 2009, c. R-10.6, and General Regulation 2010-111, s. 4.2 (added by N.B. Reg. 2018-24) - Status: In force since 2018-04-01; covers public bodies - Applies to: New Brunswick public bodies: departments, Crown corporations, municipalities, universities, school districts, regional health authorities. - Threshold: risk of significant harm. Where it is reasonable to believe a privacy breach creates a risk of significant harm to an individual, considering the sensitivity of the information and the probability of misuse. Significant harm includes humiliation, damage to reputation or relationships, financial loss, identity theft and damage to property. - Notify Affected individuals: as soon as possible. Regulation 2010-111 s. 4.2(4)-(5). The duty is in the regulation, not in a s. 49.1 of the Act. Report: https://laws.gnb.ca/en/document/ar/2018-24 - Notify New Brunswick Ombud (formerly Access to Information and Privacy Commissioner): as soon as possible. Reg s. 4.2(4)(d): 'notify the Commissioner as soon as possible of any privacy breach under paragraph (c)'; the Commissioner's functions passed to the Ombud in 2016. The regulation has been in force since April 1, 2018. Report: https://ombudnb.ca/wp-content/uploads/2024/11/FORM-Privacy-Breach-Notification-RTIPPA-2024-E.pdf - Records: Investigate every actual or suspected breach and maintain a registry of every actual privacy breach and corrective measures (Reg s. 4.2(4)(b)). - Penalties: RTIPPA s. 87 offence provisions apply; amounts are set in the Act. - Notes: The Ombud's January 2026 submission to the RTIPPA legislative review asks for the duty to be moved into the Act; no amending bill in force. - Sources: N.B. Regulation 2018-24 (laws.gnb.ca) https://laws.gnb.ca/en/document/ar/2018-24; GNB: Handling privacy breaches https://www.gnb.ca/en/gov/information-access-privacy/resources-gov-public-bodies/handling-privacy-breaches.html - Last verified: 2026-10-29 ### New Brunswick PHIPAA s. 49 - Law: Personal Health Information Privacy and Access Act, S.N.B. 2009, c. P-7.05, s. 49 - Status: In force since 2010-09-01; covers health information custodians - Applies to: New Brunswick custodians: regional health authorities, physicians, pharmacists, nursing homes, Medavie, Department of Health. - Threshold: theft, loss, improper disposal, or unauthorized disclosure or access, unless no adverse impact. Notify unless the custodian reasonably believes the incident will not adversely impact health care or other benefits, will not adversely affect the individual's mental, physical, economic or social well-being, and will not lead to identification of the individual (s. 49(2)). - Notify Affected individuals: at the first reasonable opportunity. s. 49(1)(c), in the manner prescribed by regulation. Report: https://laws.gnb.ca/en/document/cs/P-7.05 - Notify New Brunswick Ombud: at the first reasonable opportunity. s. 49(1)(c). Report: https://laws.gnb.ca/en/document/cs/P-7.05 - Records: Not specified in s. 49. - Penalties: PHIPAA s. 76 offences apply; the fine category and amounts are set in the Act and the Provincial Offences Procedure Act. - Notes: In force September 1, 2010. The duty is in s. 49. - Sources: PHIPAA (laws.gnb.ca) https://laws.gnb.ca/en/document/cs/P-7.05; GNB: Privacy notice (PHIPAA in force September 1, 2010) https://gnb.ca/en/topic/health-wellness/patient-engagement-privacy/privacy-notice.html - Last verified: 2026-10-29 ### Harm test: New Brunswick RTIPPA - Statute: Right to Information and Protection of Privacy Act, General Regulation 2010-111, s. 4.2 - Test: Where it is reasonable to believe that a privacy breach creates a risk of significant harm to an individual, considering the sensitivity of the information and the probability of misuse, the public body must notify the individual and the Ombud. - Harm: Significant harm includes humiliation, damage to reputation or relationships, financial loss, identity theft and damage to property. - Factors: The sensitivity of the personal information; The probability that the information has been, is being or will be misused - Records: Investigate every actual or suspected breach and maintain a registry of every actual privacy breach and the corrective measures taken (Reg s. 4.2(4)(b)). - Consequence: Notify the affected individual and the Ombud. - Sources: N.B. Regulation 2018-24 (laws.gnb.ca) https://laws.gnb.ca/en/document/ar/2018-24; GNB: Handling privacy breaches https://www.gnb.ca/en/gov/information-access-privacy/resources-gov-public-bodies/handling-privacy-breaches.html - Last verified: 2026-10-29 ### Harm test: New Brunswick PHIPAA - Statute: Personal Health Information Privacy and Access Act, S.N.B. 2009, c. P-7.05, s. 49 - Test: A custodian must notify the individual of any theft, loss, improper disposal, or unauthorized disclosure of or access to personal health information, unless the custodian reasonably believes the incident will not adversely impact the provision of health care or other benefits, will not adversely affect the individual's mental, physical, economic or social well-being, and will not lead to the identification of the individual (s. 49(2)). - Factors: Whether the incident could adversely impact the provision of health care or other benefits; Whether it could adversely affect the individual's mental, physical, economic or social well-being; Whether it could lead to identification of the individual - Records: Not specified in s. 49; document the assessment. - Consequence: Notify the individual and the Ombud at the first reasonable opportunity, in the prescribed manner, unless all three exceptions are reasonably believed to apply (s. 49(1)(c), (2)). - Sources: PHIPAA (laws.gnb.ca, consolidated) https://laws.gnb.ca/en/showfulldoc/cs/P-7.05/ - Last verified: 2026-10-29 ## Nova Scotia Page: https://frontiercyber.app/tools/breach-notification/nova-scotia/ ### Nova Scotia FOIPOP / PIIDPA - Law: Freedom of Information and Protection of Privacy Act, S.N.S. 1993, c. 5 (current), Personal Information International Disclosure Protection Act, S.N.S. 2006, c. 3, and the new Freedom of Information and Protection of Privacy Act (Bill 150, 2025) - Status: Voluntary; covers public bodies - Applies to: Nova Scotia public bodies (departments, agencies, municipalities under Part XX of the MGA, school boards, universities, health authorities) and, for PIIDPA, their service providers. - Threshold: none under current FOIPOP; PIIDPA: foreign demand for disclosure (or unauthorized disclosure in response to one); new Act (April 1, 2027): real risk of significant harm. The current FOIPOP Act has no breach notification duty; reporting to the Information and Privacy Commissioner is voluntary. PIIDPA s. 6(1) requires a public body, its employees and service providers to immediately notify the Minister of Justice when they receive a foreign demand for disclosure, receive a request they know or suspect is made to answer one, or have reason to suspect an unauthorized disclosure has occurred in response to a foreign demand; it does not cover unauthorized disclosures generally. The new Freedom of Information and Protection of Privacy Act (Bill 150, S.N.S. 2025, c. 13, Royal Assent October 3, 2025, in force April 1, 2027) will require notifying affected individuals and the Commissioner where a breach poses a real risk of significant harm; details depend on regulations. - Notify Minister of Justice (PIIDPA): immediately notify the Minister. PIIDPA s. 6(1) applies only to foreign demands for disclosure, requests suspected to be made to answer one, and suspected unauthorized disclosures made in response to a foreign demand. Report: https://nslegislature.ca/sites/default/files/legc/PDFs/annual%20statutes/2006/c003.pdf - Notify Nova Scotia Information and Privacy Commissioner (voluntary until the new Act is in force) (conditional or voluntary): no statutory deadline; voluntary. Becomes mandatory (real risk of significant harm) when the new Act takes effect on April 1, 2027 (Government of Nova Scotia release, September 26, 2025; nslegislature.ca bill page). Report: https://nslegislature.ca/node/131065 - Records: None under current FOIPOP. - Penalties: PIIDPA s. 13(3): fines up to $2,000 (individuals), $25,000 (individual service providers) and $500,000 (corporations). - Notes: A new Freedom of Information and Protection of Privacy Act (Bill 150, S.N.S. 2025, c. 13, Royal Assent October 3, 2025) comes into force April 1, 2027 and introduces mandatory notification based on a real risk of significant harm. Until then public bodies in Nova Scotia have no statutory duty to notify; the Commissioner encourages voluntary reporting. PIIDPA applies only where personal information is disclosed in response to a foreign demand. - Sources: PIIDPA, S.N.S. 2006, c. 3 https://nslegislature.ca/sites/default/files/legc/PDFs/annual%20statutes/2006/c003.pdf; PEI/NS context: Canadian Privacy Law Blog on NS Bill 150 https://blog.privacylawyer.ca/2025/11/nova-scotias-new-freedom-of-information.html; Nova Scotia Legislature: Bill 150, Freedom of Information and Protection of Privacy Act (Royal Assent October 3, 2025; 2025 c. 13) https://nslegislature.ca/node/131065; Government of Nova Scotia news release, September 26, 2025: new Act in effect April 1, 2027 https://news.novascotia.ca/en/2025/09/26/province-introduces-modernized-access-privacy-legislation - Last verified: 2026-10-29 ### Nova Scotia PHIA ss. 69-70 - Law: Personal Health Information Act, S.N.S. 2010, c. 41, ss. 69-70 - Status: In force since 2013-06-01; covers health information custodians - Applies to: Nova Scotia custodians: Nova Scotia Health, IWK, physicians, pharmacists, long-term care, Department of Health and Wellness. - Threshold: potential for harm or embarrassment. Notify the individual where the custodian believes on a reasonable basis that personal health information was stolen, lost, or accessed or disclosed without authority and that this creates potential for harm or embarrassment (s. 69). If the custodian decides not to notify (breach unlikely or no potential for harm or embarrassment, s. 70(1)), it must instead notify the Review Officer (Commissioner). - Notify Affected individuals: at the first reasonable opportunity. s. 69. Report: https://nslegislature.ca/sites/default/files/legc/statutes/personal%20health%20information.pdf - Notify Nova Scotia Information and Privacy Commissioner (Review Officer): as soon as possible (where the custodian decides not to notify the individual). s. 70(2). Reporting to the Commissioner is otherwise voluntary; the 2025 PHIA s. 70 guidelines describe practice. Report: https://nslegislature.ca/sites/default/files/legc/statutes/personal%20health%20information.pdf - Records: Not specified. - Penalties: s. 107: fines up to $10,000 and/or six months imprisonment (individuals) and $50,000 (corporations). - Notes: The duties are in ss. 69 and 70(2), with offences in s. 107. The Act has been in force since June 1, 2013. - Sources: Nova Scotia PHIA (consolidated PDF) https://nslegislature.ca/sites/default/files/legc/statutes/personal%20health%20information.pdf - Last verified: 2026-10-29 ### Harm test: Nova Scotia FOIPOP (new Act from April 1, 2027) - Statute: Freedom of Information and Protection of Privacy Act, S.N.S. 1993, c. 5 (current); new Act, S.N.S. 2025, c. 13, in force April 1, 2027 - Test: The current Act has no breach notification duty; reporting to the Information and Privacy Commissioner is voluntary. The new Act introduces mandatory notification where a breach creates a real risk of significant harm, from April 1, 2027. - Factors: Sensitivity of the personal information; Probability of misuse - Records: None under the current Act. - Consequence: Voluntary until April 1, 2027; thereafter notify the Commissioner and affected individuals where a real risk of significant harm exists. - Sources: Nova Scotia Legislature: Bill 150, Freedom of Information and Protection of Privacy Act (2025 c. 13) https://nslegislature.ca/node/131065; Government of Nova Scotia news release, September 26, 2025 https://news.novascotia.ca/en/2025/09/26/province-introduces-modernized-access-privacy-legislation - Last verified: 2026-10-29 ### Harm test: Nova Scotia PHIA - Statute: Personal Health Information Act, S.N.S. 2010, c. 41, ss. 69 and 70 - Test: Where a custodian believes on a reasonable basis that personal health information has been stolen, lost, or accessed or disclosed without authority, and that this creates potential for harm or embarrassment to the individual, the custodian must notify the individual at the first reasonable opportunity (s. 69). A custodian that decides not to notify because there is no potential for harm or embarrassment must instead notify the Review Officer (s. 70). - Factors: Whether the information was stolen, lost or accessed or disclosed without authority; Whether this creates potential for harm or embarrassment to the individual - Records: Not specified; document the assessment and any decision not to notify. - Consequence: Notify the individual, or, where you conclude there is no potential for harm or embarrassment, notify the Review Officer of that decision. - Sources: Nova Scotia PHIA (consolidated PDF) https://nslegislature.ca/sites/default/files/legc/statutes/personal%20health%20information.pdf; OIPC Nova Scotia: Reporting Breaches, s. 70 of PHIA guidelines (reissued 2025-11-06) https://oipc.novascotia.ca/sites/default/files/2025%2011%2006%20S.%2070%20PHIA%20Guidelines.pdf - Last verified: 2026-10-29 ## Prince Edward Island Page: https://frontiercyber.app/tools/breach-notification/prince-edward-island/ ### PEI FOIPP - Law: Freedom of Information and Protection of Privacy Act, R.S.P.E.I. 1988, c. F-15.01 - Status: Voluntary; covers public bodies - Applies to: PEI public bodies: departments, agencies, municipalities, Health PEI, UPEI, Holland College, school authorities. - Threshold: none in statute. The FOIPP Act requires reasonable security arrangements (s. 35) but contains no breach notification duty; the PEI OIPC states that the FOIPP Act has no mandatory reporting and encourages voluntary reporting using the same process as the Health Information Act. - Notify PEI Information and Privacy Commissioner (voluntary) (conditional or voluntary): no statutory deadline. Voluntary, encouraged for transparency. Report: https://www.assembly.pe.ca/sites/www.assembly.pe.ca/files/OIPC%20FOIPP%20Breach%20Notification%20Form%20October%206%202022.pdf - Records: None required. - Penalties: FOIPP s. 75 offence provisions apply; amounts are set in the Act. - Notes: No amending bill introducing mandatory FOIPP breach notification was found. - Sources: PEI OIPC Privacy Breach Reporting Guidelines https://www.assembly.pe.ca/sites/www.assembly.pe.ca/files/oipc-privacy-breach-reporting-guidelines.pdf; PEI FOIPP Act (consolidated PDF) https://www.princeedwardisland.ca/sites/default/files/legislation/f-15-01-freedom_of_information_and_protection_of_privacy_act.pdf - Last verified: 2026-10-29 ### PEI Health Information Act - Law: Health Information Act, R.S.P.E.I. 1988, c. H-1.41 - Status: In force since 2017-07-01; covers health information custodians - Applies to: PEI custodians: Health PEI, physicians, pharmacists, other health professionals and facilities. - Threshold: theft, loss, or unauthorized access or disclosure, unless no adverse impact. Notify unless the custodian reasonably believes the breach will not have an adverse impact on health care or other benefits or on the individual's mental, physical, economic or social well-being (PEI OIPC guidelines). - Notify Affected individuals: at the first reasonable opportunity. Confirm the section reference against the Health Information Act; the duty is described in the PEI OIPC guidelines. Report: https://www.assembly.pe.ca/sites/www.assembly.pe.ca/files/oipc-privacy-breach-reporting-guidelines.pdf - Notify PEI Information and Privacy Commissioner: at the first reasonable opportunity. Same exception as above. Report: https://www.assembly.pe.ca/sites/www.assembly.pe.ca/files/OIPC%20PHI%20Breach%20Notification%20Form%20Oct%206%202022.pdf - Records: Not specified. - Penalties: Offence provisions apply; amounts are set in the Act. - Notes: In force July 1, 2017. The custodian's duty and the Commissioner's expectations are described in the PEI OIPC breach guidelines (April 2024); confirm the section reference against the Act. - Sources: PEI OIPC Privacy Breach Reporting Guidelines https://www.assembly.pe.ca/sites/www.assembly.pe.ca/files/oipc-privacy-breach-reporting-guidelines.pdf; CBC: PEI Health Information Act takes effect July 1, 2017 https://www.cbc.ca/lite/story/1.4184704 - Last verified: 2026-10-29 ### Harm test: PEI FOIPP (voluntary) - Statute: Freedom of Information and Protection of Privacy Act, R.S.P.E.I. 1988, c. F-15.01 - Test: The FOIPP Act contains no breach notification duty. The Commissioner encourages voluntary reporting using the same process as the Health Information Act, assessing the risk of harm to individuals. - Factors: Sensitivity of the personal information; Probability of misuse; Whether the breach will adversely affect the individual - Records: None required; document the assessment. - Consequence: Voluntary: report to the Commissioner and notify individuals where harm is reasonably possible. - Sources: PEI OIPC Privacy Breach Reporting Guidelines https://www.assembly.pe.ca/sites/www.assembly.pe.ca/files/oipc-privacy-breach-reporting-guidelines.pdf - Last verified: 2026-10-29 ### Harm test: PEI Health Information Act - Statute: Health Information Act, R.S.P.E.I. 1988, c. H-1.41 - Test: A custodian must notify the individual of theft, loss, or unauthorized access or disclosure of personal health information, unless the custodian reasonably believes the breach will not have an adverse impact on the provision of health care or other benefits, or on the individual's mental, physical, economic or social well-being. - Factors: Whether the breach could adversely impact health care or other benefits; Whether it could adversely affect the individual's mental, physical, economic or social well-being - Records: Not specified; the Commissioner's guidelines expect documentation. - Consequence: Notify the individual, and the Commissioner, as the Act and the Commissioner's guidelines require. - Sources: PEI OIPC Privacy Breach Reporting Guidelines https://www.assembly.pe.ca/sites/www.assembly.pe.ca/files/oipc-privacy-breach-reporting-guidelines.pdf - Last verified: 2026-10-29 ## Newfoundland and Labrador Page: https://frontiercyber.app/tools/breach-notification/newfoundland-and-labrador/ ### NL ATIPPA, 2015 s. 64 - Law: Access to Information and Protection of Privacy Act, 2015, S.N.L. 2015, c. A-1.2, s. 64 - Status: In force since 2015-06-01; covers public bodies - Applies to: Newfoundland and Labrador public bodies: departments, agencies, municipalities, school boards, universities, regional health authorities. - Threshold: risk of significant harm (individuals); any unauthorized collection, use or disclosure (commissioner). Individuals must be notified at the first reasonable opportunity when personal information is stolen, lost, improperly disposed of, or accessed or disclosed without authority, unless the head reasonably believes the breach creates no risk of significant harm (s. 64(3), (7)); factors are sensitivity and probability of misuse (s. 64(9)). Separately, the head must inform the commissioner whenever it reasonably believes a breach involving unauthorized collection, use or disclosure has occurred (s. 64(4)). - Notify Affected individuals: at the first reasonable opportunity. s. 64(3); exception s. 64(7) (no risk of significant harm); commissioner may recommend notice anyway (s. 64(5)). Report: https://www.assembly.nl.ca/Legislation/sr/statutes/a01-2.htm - Notify Office of the Information and Privacy Commissioner of NL: no deadline in s. 64(4); OIPC practice: report promptly. Duty applies to all unauthorized collection, use or disclosure breaches, not only material ones. Report: https://www.assembly.nl.ca/Legislation/sr/statutes/a01-2.htm - Records: Not specified in s. 64. - Penalties: ATIPPA, 2015 s. 115 offence provisions apply; amounts are set in the Act. - Notes: Section 64(4) contains no 'material' threshold, so the commissioner must be told of every breach involving unauthorized collection, use or disclosure regardless of harm. - Sources: ATIPPA, 2015 (House of Assembly consolidated statutes) https://www.assembly.nl.ca/Legislation/sr/statutes/a01-2.htm - Last verified: 2026-10-29 ### NL PHIA s. 15 - Law: Personal Health Information Act, S.N.L. 2008, c. P-7.01, s. 15 - Status: In force since 2011-04-01; covers health information custodians - Applies to: NL custodians: NL Health Services, physicians, pharmacists, other health professionals, Department of Health and Community Services. - Threshold: theft, loss, improper disposal or unauthorized access/disclosure (individuals); material breach (commissioner). Notify individuals of any theft, loss, improper disposal, or unauthorized disclosure or access, unless the custodian reasonably believes it will not adversely affect their health care or benefits or their well-being (s. 15(3), (7)). Inform the commissioner where the custodian reasonably believes there has been a material breach involving unauthorized collection, use or disclosure, as defined in the regulations (s. 15(4)). - Notify Affected individuals: at the first reasonable opportunity. s. 15(3). Report: https://www.assembly.nl.ca/Legislation/sr/statutes/p07-01.htm - Notify Office of the Information and Privacy Commissioner of NL: no deadline in s. 15(4); OIPC expects prompt reporting. Whether a breach is material turns on the factors in the PHIA Regulations: sensitivity of the information, number of individuals affected and whether the cause is systemic. Report: https://www.assembly.nl.ca/Legislation/sr/statutes/p07-01.htm - Records: Not specified. - Penalties: PHIA s. 88 offence provisions apply; amounts are set in the Act. - Notes: The duty is in s. 15. The Act has been in force since April 1, 2011. - Sources: NL PHIA (House of Assembly consolidated statutes) https://www.assembly.nl.ca/Legislation/sr/statutes/p07-01.htm; Government of NL news release, May 25, 2011 (PHIA in force April 1, 2011) https://www.releases.gov.nl.ca/releases/2011/health/0525n04.htm - Last verified: 2026-10-29 ### Harm test: NL ATIPPA, 2015 - Statute: Access to Information and Protection of Privacy Act, 2015, S.N.L. 2015, c. A-1.2, s. 64 - Test: Individuals must be notified at the first reasonable opportunity when personal information is stolen, lost, improperly disposed of, or accessed or disclosed without authority, unless the head reasonably believes the breach creates no risk of significant harm (s. 64(3), (7)). The commissioner must be informed of every breach involving unauthorized collection, use or disclosure, regardless of harm (s. 64(4)). - Harm: Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record, and damage to or loss of property (s. 64(8)). - Factors: The sensitivity of the personal information (s. 64(9)(a)); The probability that the personal information has been, is being or will be misused (s. 64(9)(b)) - Records: Not specified in s. 64; document the assessment. - Consequence: Notify individuals at the first reasonable opportunity unless the head reasonably believes there is no risk of significant harm (the commissioner may still recommend notification); inform the commissioner of every reasonably believed breach involving unauthorized collection, use or disclosure. - Sources: ATIPPA, 2015 (House of Assembly consolidated statutes) https://www.assembly.nl.ca/Legislation/sr/statutes/a01-2.htm - Last verified: 2026-10-29 ### Harm test: NL PHIA - Statute: Personal Health Information Act, S.N.L. 2008, c. P-7.01, s. 15 - Test: A custodian must notify the individual of any theft, loss, improper disposal, or unauthorized disclosure or access, unless the custodian reasonably believes it will not adversely affect the provision of health care or other benefits to the individual, or the individual's mental, physical, economic or social well-being (s. 15(3), (7)). The commissioner must be informed of a material breach involving unauthorized collection, use or disclosure. - Factors: Whether the incident will adversely affect the provision of health care or other benefits to the individual (s. 15(7)(a)); Whether it will adversely affect the individual's mental, physical, economic or social well-being (s. 15(7)(b)); For the commissioner, materiality under the Regulations s. 5: (a) the sensitivity of the personal health information involved; (b) the number of people whose information was involved; (c) whether the custodian reasonably believes the information has been or will be misused; (d) whether the cause of the breach or the pattern of breaches indicates a systemic problem - Records: Not specified; document the assessment. - Consequence: Notify the individual at the first reasonable opportunity unless the exception is reasonably believed to apply; inform the commissioner of material breaches. - Sources: NL PHIA (House of Assembly consolidated statutes) https://www.assembly.nl.ca/Legislation/sr/statutes/p07-01.htm; Personal Health Information Regulations, N.L.R. 38/11 https://www.assembly.nl.ca/legislation/sr/regulations/rc110038.htm - Last verified: 2026-10-29 ## Yukon Page: https://frontiercyber.app/tools/breach-notification/yukon/ ### Yukon ATIPP Act - Law: Access to Information and Protection of Privacy Act, S.Y. 2018, c. 9, Part 3 Division on privacy breaches (ss. 31-34 region) - Status: In force since 2021-04-01; covers public bodies - Applies to: Yukon public bodies: departments, Crown corporations, Yukon University, Yukon Hospital Corporation, municipalities and school councils. - Threshold: risk of significant harm. The Designated Privacy Officer assesses each breach; if there is a risk of significant harm to an individual, all affected individuals must be notified and the Information and Privacy Commissioner and the head must be informed. Factors include sensitivity and probability of misuse. - Notify Affected individuals: no statutory timeline (Yukon ATIPP Office: timelines are not included in the Act or Regulation). Direct notice unless a Regulation s. 10 circumstance permits public notice; the OIPC must receive at least one day's notice before a public notice. Report: https://open.yukon.ca/fr/information/da85dad0-08a1-48c8-8c39-f187771def1e/resource/5c2c400b-7c92-3e40-8385-960b53068855/download/privacy-breach-procedures-may-2021.pdf - Notify Yukon Information and Privacy Commissioner: no statutory timeline. Government procedures recommend 5 working days for assessment and 2-3 weeks for the risk determination (not statutory). Report: https://open.yukon.ca/fr/information/60a2d4cc-2741-47b7-83bf-9cd524fda142/resource/9eb8b28e-ab89-37dd-b384-13db52325223/download/information-note-327b-notification-of-privacy-breach_2.pdf - Records: Public bodies must keep a written record of each privacy breach (government information note on s. 32(7)(b)). - Penalties: Offence provisions apply; amounts are set in the Act. - Notes: In force April 1, 2021. The Act and Regulation set no fixed timelines for notification; Yukon government procedures describe the expected steps and the s. 32(7)(b) duty to notify individuals. - Sources: Yukon Government Privacy Breach Procedures (May 2021) https://open.yukon.ca/fr/information/da85dad0-08a1-48c8-8c39-f187771def1e/resource/5c2c400b-7c92-3e40-8385-960b53068855/download/privacy-breach-procedures-may-2021.pdf; Yukon Information Note 32(7)(b) Notification of Privacy Breach https://open.yukon.ca/fr/information/60a2d4cc-2741-47b7-83bf-9cd524fda142/resource/9eb8b28e-ab89-37dd-b384-13db52325223/download/information-note-327b-notification-of-privacy-breach_2.pdf; Government of Yukon news release: new ATIPP Act in force April 1, 2021 https://yukon.ca/en/news/new-access-information-and-protection-privacy-act-coming-force-april-1-2021 - Last verified: 2026-10-29 ### Yukon HIPMA ss. 30-31 - Law: Health Information Privacy and Management Act, S.Y. 2013, c. 16, ss. 30-31 - Status: In force since 2016-08-31; covers health information custodians - Applies to: Yukon custodians: Department of Health and Social Services, Yukon Hospital Corporation, physicians, pharmacists and other health care providers. - Threshold: likelihood of significant harm. Where there is a likelihood of significant harm to an individual from a security breach, the custodian must notify the individual and the Commissioner; where there is no such likelihood no notice is required. - Notify Affected individuals: as soon as reasonably possible. s. 30(1). Report: https://yukon.ca/sites/yukon.ca/files/hss/hss-sample-breach-protocol.pdf - Notify Yukon Information and Privacy Commissioner: within a reasonable timeframe. s. 30(2)(b) and s. 31: written report on risk of harm, estimated number affected and mitigation. Report: https://yukon.ca/sites/yukon.ca/files/hss/hss-sample-breach-protocol.pdf - Records: Not specified. - Penalties: Offence provisions apply; amounts are set in the Act. - Notes: Wording taken from a Yukon government sample protocol, not the Act. In-force date: the Whitehorse Daily Star reported on September 6, 2016 that HIPMA 'came into force last Wednesday', i.e. August 31, 2016. - Sources: Yukon HSS Sample Breach Protocol (cites HIPMA ss. 30-31) https://yukon.ca/sites/yukon.ca/files/hss/hss-sample-breach-protocol.pdf; Whitehorse Daily Star: Health Information Privacy and Management Act now in force (September 6, 2016) https://www.whitehorsestar.com/News/health-information-privacy-and-management-act-now-in-force - Last verified: 2026-10-29 ### Harm test: Yukon ATIPP Act - Statute: Access to Information and Protection of Privacy Act, S.Y. 2018, c. 9, ss. 30 to 32 - Test: The Designated Privacy Officer assesses each privacy breach; if there is a risk of significant harm to an individual, all affected individuals must be notified and the Information and Privacy Commissioner and the head informed (s. 32). Significant harm means bodily harm, personal humiliation, reputational or relationship damage, loss of employment, business or professional opportunities, financial loss, negative effects on a credit rating, or damage to or loss of property, or any other similar type of harm (s. 1). - Factors: The sensitivity of the personal information (s. 32(6)(a)); The probability that the personal information is, has been or will be used or disclosed in an unauthorized manner (s. 32(6)(b)); The number of affected individuals; Any relationship between the affected individuals and a recipient; The time elapsed since the breach; Mitigation measures taken; Whether lost or stolen information was recovered; Any other information that is relevant in the circumstances and is reasonably available (s. 32(6)(h)) - Records: Keep a written record of each privacy breach; the report to the Commissioner must give the reasons for the risk finding and a copy of the individual notice. - Consequence: Notify affected individuals and inform the Commissioner and the head of the public body. - Sources: Yukon Government Privacy Breach Procedures (May 2021) https://open.yukon.ca/fr/information/da85dad0-08a1-48c8-8c39-f187771def1e/resource/5c2c400b-7c92-3e40-8385-960b53068855/download/privacy-breach-procedures-may-2021.pdf; Yukon University Privacy Breach Procedures IT 11.1 (March 2025), reproducing ATIPP s. 1 and s. 32(6) https://www.yukonu.ca/sites/default/files/policies/IT%2011.1%20-%20Privacy%20Breach%20Procedures_approved%20Mar%2018%202025.pdf - Last verified: 2026-10-29 ### Harm test: Yukon HIPMA - Statute: Health Information Privacy and Management Act, S.Y. 2013, c. 16, ss. 30 and 31 - Test: Where there is a likelihood of significant harm to an individual from a security breach, the custodian must notify the individual and the Commissioner; where there is no such likelihood no notice is required. - Factors: Sensitivity of the personal health information; Probability of misuse; Whether the information was recovered or protected - Records: Not specified; document the assessment. - Consequence: Notify the individual and the Commissioner where significant harm is likely. - Sources: Yukon HSS Sample Breach Protocol (cites HIPMA ss. 30-31) https://yukon.ca/sites/yukon.ca/files/hss/hss-sample-breach-protocol.pdf - Last verified: 2026-10-29 ## Northwest Territories Page: https://frontiercyber.app/tools/breach-notification/northwest-territories/ ### NWT ATIPP Act - Law: Access to Information and Protection of Privacy Act (NWT), Part 2 Division E Data Breach Notification, ss. 49.7-49.15 (added by S.N.W.T. 2019, c. 8) - Status: In force since 2021-07-30; covers public bodies - Applies to: NWT public bodies: departments, boards, agencies, Aurora College, health and social services authorities, and municipalities once designated. - Threshold: material breach (Commissioner); real risk of significant harm (individuals). Report to the Commissioner only if the breach is material, considering sensitivity, number of individuals, likelihood of harm and whether the cause is systemic (s. 49.9(2)). Notify individuals if it is reasonable to believe the breach creates a real risk of significant harm, considering sensitivity and probability of misuse (s. 49.10). - Notify NWT Information and Privacy Commissioner: as soon as reasonably possible after the head knows or has reason to believe a breach occurred and determines it is material. s. 49.9(1), (3). Report: https://laws.opennwt.ca/bills/snwt-2019-c08/?lang=en - Notify Affected individuals: as soon as reasonably possible after the head knows or has reason to believe a breach occurred and determines it creates a real risk of significant harm. s. 49.10(1), (3). Report: https://laws.opennwt.ca/bills/snwt-2019-c08/?lang=en - Records: Not specified in the sources reviewed. - Penalties: Offence provisions apply; amounts are set in the Act. - Notes: Breach notification duties were added by S.N.W.T. 2019, c. 8 and came into force in July 2021. There is no s. 87.1; the duties are in ss. 49.9 and 49.10. - Sources: An Act to Amend the ATIPP Act, S.N.W.T. 2019, c. 8 (OpenNWT reading copy) https://laws.opennwt.ca/bills/snwt-2019-c08/?lang=en; NWT IPC Annual Report 2021-22 (in force July 30, 2021) https://ntlegislativeassembly.ca/sites/default/files/legacy/td_711-192.pdf - Last verified: 2026-10-29 ### NWT Health Information Act - Law: Health Information Act, S.N.W.T. 2014, c. 2, s. 87, and Health Information Regulations ss. 14-15 - Status: In force since 2015-10-01; covers health information custodians - Applies to: NWT custodians: Department of Health and Social Services, health and social services authorities, physicians, pharmacists and other providers. - Threshold: reasonable risk of harm (commissioner); any inappropriate access, loss or theft (individuals). Regulation s. 15(1): notify the Commissioner and law enforcement where personal health information is lost or stolen, or where fraud or identity theft leads to disclosure, alteration, destruction or disposal; exempt where the incident does not present a reasonable risk of harm (s. 15(2)). The Act (s. 87) requires notifying the individuals affected. - Notify Affected individuals: as soon as reasonably possible (HIA s. 87). Confirm the current wording of s. 87 of the Act and ss. 14 and 15 of the Regulations before relying on a specific timeline. Report: https://www.justice.gov.nt.ca/en/files/legislation/health-information/health-information.r1.pdf - Notify NWT Information and Privacy Commissioner and law enforcement: no deadline in Regulation s. 15. Confirm the current wording of s. 87 of the Act and ss. 14 and 15 of the Regulations before relying on a specific timeline. Report: https://www.justice.gov.nt.ca/en/files/legislation/health-information/health-information.r1.pdf - Records: Regulation s. 14: investigate, keep a record of the breach and corrective measures. - Penalties: HIA offence provisions apply; amounts are set in the Act. - Notes: Nunavut has no health-specific privacy act; its ATIPP Act and PIPEDA apply. - Sources: NWT Health Information Regulations https://www.justice.gov.nt.ca/en/files/legislation/health-information/health-information.r1.pdf - Last verified: 2026-10-29 ### Harm test: NWT ATIPP Act - Statute: Access to Information and Protection of Privacy Act (NWT), ss. 49.9 and 49.10 - Test: Notify affected individuals if it is reasonable to believe the breach creates a real risk of significant harm, considering the sensitivity of the information and the probability of misuse (s. 49.10). Report to the Commissioner only if the breach is material, considering sensitivity, the number of individuals, the likelihood of harm and whether the cause is systemic (s. 49.9). - Harm: Harm includes bodily harm, humiliation, damage to reputation, damage to a relationship, loss of employment, business or professional opportunity, negative effects on credit records, damage to or loss of property, financial loss and identity theft (s. 49.7). - Factors: The sensitivity of the personal information; The probability that the information has been, is being or will be misused; For the report to the Commissioner: the number of individuals affected, the likelihood of harm and whether the cause of the breach is systemic - Records: Document the assessment; no retention period identified in the sources reviewed. - Consequence: Notify affected individuals as soon as reasonably possible where a real risk of significant harm exists, with enough information to understand the significance and take protective steps; report material breaches to the Commissioner as soon as reasonably possible after determining materiality; notify other bodies that can mitigate the harm (s. 49.11). - Sources: An Act to Amend the ATIPP Act, S.N.W.T. 2019, c. 8 https://laws.opennwt.ca/bills/snwt-2019-c08/?lang=en - Last verified: 2026-10-29 ### Harm test: NWT Health Information Act - Statute: Health Information Act, S.N.W.T. 2014, c. 2, s. 87, and the Health Information Regulations ss. 14 and 15 - Test: Notify affected individuals of any inappropriate access, loss or theft of personal health information (s. 87). Notify the Commissioner and law enforcement where information is lost or stolen, or where fraud or identity theft leads to disclosure, alteration, destruction or disposal, unless the incident does not present a reasonable risk of harm (Regulation s. 15). - Factors: Whether the incident presents a reasonable risk of harm to the individual; Whether the information was lost, stolen or obtained by fraud or identity theft - Records: Investigate, and keep a record of the breach and the corrective measures taken (Regulation s. 14). - Consequence: Notify affected individuals; notify the Commissioner and law enforcement where a reasonable risk of harm exists. - Sources: NWT Health Information Regulations https://www.justice.gov.nt.ca/en/files/legislation/health-information/health-information.r1.pdf - Last verified: 2026-10-29 ## Nunavut Page: https://frontiercyber.app/tools/breach-notification/nunavut/ ### Nunavut ATIPP Act - Law: Access to Information and Protection of Privacy Act (Nunavut), Part 2 Division E Data Breach Notification, ss. 49.7-49.14 (S.Nu. 2012, c. 13; amended S.Nu. 2017, c. 26) - Status: In force since 2013-05-11; covers public bodies - Applies to: Nunavut public bodies: departments, boards and agencies of the Government of Nunavut and designated bodies. - Threshold: material breach (Commissioner); real risk of significant harm (individuals). Same structure as NWT: report material breaches (sensitivity, number of individuals, likelihood of harm, systemic cause) to the Commissioner; notify individuals where a real risk of significant harm exists (sensitivity and probability of misuse). - Notify Nunavut Information and Privacy Commissioner: as soon as reasonably possible after the public body knows or has reason to believe a breach occurred and determines it is material. s. 49.9(3). Report: https://www.gov.nu.ca/sites/default/files/documents/2021-11/atipp_act_2018.pdf - Notify Affected individuals: as soon as reasonably possible after the public body knows or has reason to believe a breach occurred and determines it creates a real risk of significant harm. s. 49.10(3). Report: https://www.gov.nu.ca/sites/default/files/documents/2021-11/atipp_act_2018.pdf - Records: GN Privacy Breach Policy requires documentation; no retention period identified. - Penalties: ATIPP s. 59 offence provisions apply; amounts are set in the Act. - Notes: Division E was added by S.Nu. 2012, c. 13 (in force May 11, 2013) and amended by S.Nu. 2017, c. 26. Nunavut had mandatory breach notification earlier than most provinces. Bill 59 (2024) was withdrawn; no newer amendments found. - Sources: Nunavut ATIPP Act consolidation (GN, 2018) https://www.gov.nu.ca/sites/default/files/documents/2021-11/atipp_act_2018.pdf; GN Privacy Breach Policy (2025) https://www.gov.nu.ca/sites/default/files/policies-legislations/2025-08/Privacy_Breach_Policy_06__25.pdf - Last verified: 2026-10-29 ### Harm test: Nunavut ATIPP Act - Statute: Access to Information and Protection of Privacy Act (Nunavut), Division E, ss. 49.7 to 49.14 (added by S.Nu. 2012, c. 13) - Test: Notify affected individuals if it is reasonable to believe the breach creates a real risk of significant harm, considering the sensitivity of the information and the probability of misuse (s. 49.10). Report to the Commissioner only if the breach is material, considering sensitivity, the number of individuals, the likelihood of harm and whether the cause is systemic (s. 49.9). - Harm: Harm includes bodily harm, humiliation, damage to reputation, damage to a relationship, loss of employment, business or professional opportunity, negative effects on credit records, damage to or loss of property, financial loss and identity theft (s. 49.7). - Factors: The sensitivity of the personal information; The probability that the information has been, is being or will be misused; For the report to the Commissioner: the number of individuals affected, the likelihood of harm and whether the cause of the breach is systemic - Records: Document the assessment; no retention period identified in the sources reviewed. - Consequence: Notify affected individuals as soon as reasonably possible where a real risk of significant harm exists, with enough information to understand the significance and take protective steps; report material breaches to the Commissioner as soon as reasonably possible after determining materiality; notify other bodies that can mitigate the harm (s. 49.11). - Sources: An Act to Amend the Access to Information and Protection of Privacy Act, S.Nu. 2012, c. 13 https://nunavutlegislation.ca/in/file-download/download/public/3201 - Last verified: 2026-10-29 ## Outside Canada: EU and UK ### GDPR Art. 33-34 - Law: EU General Data Protection Regulation (EU) 2016/679, Articles 33 and 34 - Status: In force since 2018-05-25; covers private sector - Applies to: Canadian organizations that are controllers or processors subject to the GDPR (Art. 3: establishment in the EU, or offering goods/services to, or monitoring, individuals in the EU/EEA; UK GDPR mirrors this for the UK). - Threshold: personal data breach, unless unlikely to result in a risk to rights and freedoms (authority); high risk (individuals). Notify the competent supervisory authority of a personal data breach unless it is unlikely to result in a risk to individuals' rights and freedoms; communicate to data subjects where the breach is likely to result in a high risk. Processors must notify the controller without undue delay. - Notify Competent EU/EEA supervisory authority (lead authority or authority of the affected member state): without undue delay and, where feasible, not later than 72 hours after having become aware of it. Art. 33(1); reasons for any delay must accompany a late notification; information may be provided in phases. Report: https://gdpr-info.eu/art-33-gdpr/ - Notify Data subjects: without undue delay. Art. 34(1), only where likely to result in a high risk. Report: https://gdpr-info.eu/art-34-gdpr/ - Records: Art. 33(5): document every personal data breach (facts, effects, remedial action). - Penalties: Art. 83: up to EUR 10,000,000 or 2% of worldwide annual turnover for breach of Arts. 33-34. - Notes: gdpr-info.eu reproduces the official text; EUR-Lex is the primary source. - Sources: GDPR Article 33 (gdpr-info.eu) https://gdpr-info.eu/art-33-gdpr/; GDPR Article 34 (gdpr-info.eu) https://gdpr-info.eu/art-34-gdpr/ - Last verified: 2026-10-29 ## Outside Canada: United States ### US state breach laws (prompt only) - Law: All 50 US states, DC and territories have breach notification statutes with differing triggers, deadlines (often 30-60 days) and attorney-general reporting thresholds - Status: In force; covers private sector - Applies to: Any organization holding personal information of US residents. - Threshold: varies by state. If residents of the United States are affected, obtain US counsel. Each state law has its own definition of personal information, its own harm threshold and its own notice content and deadline, and several require notice to the state attorney general. - Notify Affected United States residents, and in many states the state attorney general: set by each state's law; several states require notice within 30, 45 or 60 days of discovery. All 50 states, the District of Columbia, Puerto Rico and the US Virgin Islands have breach notification laws with their own triggers, deadlines and regulator notices. Obtain US counsel for the states involved. Report: https://www.ncsl.org/technology-and-communication/security-breach-notification-laws - Records: n/a - Penalties: varies - Notes: Every US state has its own breach notification law. This entry is a prompt to obtain US counsel; state rules are not applied here. - Sources: NCSL, Security Breach Notification Laws https://www.ncsl.org/technology-and-communication/security-breach-notification-laws - Last verified: 2026-10-29