Request a quote
Free tool

Do you have to report this breach, and to whom?

Answer a few questions about the incident. The tool maps them to every Canadian notification duty that applies, shows what each law says about timing with a countdown where the law sets a clock, and links the statute behind each one. Nothing you enter leaves your browser.

NO DATA LEAVES YOUR BROWSERCANADA WIDEEVERY RULE SOURCEDVERIFIED 2026-10-29
Start Read the rules first

Which Canadian laws require breach notification?

Federally, PIPEDA requires private sector organizations to report a breach of security safeguards to the Privacy Commissioner and notify affected individuals when it creates a real risk of significant harm, and to keep a record of every breach for 24 months. Alberta and Quebec have their own mandatory private sector regimes; British Columbia's private sector law has none, though the Commissioner asks for voluntary reports. Public bodies in most provinces, health custodians in most provinces, federal institutions, OSFI regulated financial institutions, CIRO dealers and, from 2026, Ontario school boards and hospitals each have separate duties with their own recipients and timing. Most say as soon as feasible or without unreasonable delay; a few set a clock in hours. The tool below works out which of these apply to your incident.

Not sure yet whether the harm threshold is met? Start with the harm assessment tool; it hands its answers to this one.

The questions

Four short steps.

Answer what you know. Pick Not sure where you do not; the result tells you what to confirm first. You can re-run it as the investigation firms up.

01 Where do the affected people live, and where do you operate?

Select every one that applies. Each province can engage its own law.

Outside Canada

02 What kind of organization are you?

Also true of us

03 What happened to the information?

Was personal information involved?

Was personal health information involved?

What categories of information?

Was the information encrypted or otherwise unreadable to whoever obtained it?

How likely is it that the information has been or will be misused?

Roughly how many people are affected?

04 The incident itself

Was it a deliberate act?

Are systems or services affected?

Deadlines count from this moment. Use the time the organization first became aware, not when the investigation finished.

Some clocks run from this moment rather than discovery: PIPEDA's record and report duties, the Treasury Board seven days, Ontario's critical incident 72 hours after confirmation. Leave it blank to count from discovery. Record the decision and who made it.

Runs in your browser. Nothing is sent or stored.
The rules

Every Canadian notification duty, on one page.

Every duty we have verified, with the date: each row links the statute or regulator page it comes from and shows when it was last checked. Dataset version 2026-10-29. Also available as JSON for your own tooling.

Download rules.json Plain text for AI assistants

Federal

Regime Applies to Notify Threshold Verified
PIPEDA Personal Information Protection and Electronic Documents Act, ss. 10.1 to 10.3, and the Breach of Security Safeguards Regulations (SOR/2018-64) In force since 2018-11-01
Private-sector organizations that collect, use or disclose personal information in the course of commercial activity anywhere in Canada, federal works, undertakings and businesses (banks, telecoms, airlines, inter-provincial transport) and their employee data, and organizations in provinces without substantially similar private-sector law (every province except BC, Alberta and Quebec; health custodians in Ontario, NB, NS and NL are also substantially similar for health information).
  • Office of the Privacy Commissioner of Canada (OPC): as soon as feasible after the organization determines that the breach has occurred report
  • Each affected individual: as soon as feasible after the organization determines that the breach has occurred report
  • Other organizations or government institutions that may be able to reduce or mitigate the harm (e.g., banks, credit bureaus, police): as soon as feasible after the organization determines that the breach has occurred report

Records: Keep a record of every breach of security safeguards (whether or not it met the RROSH threshold) for 24 months after the day the organization determines the breach occurred (SOR/2018-64 s. 6); provide records to the OPC on request (s. 10.3(2)).

Penalties: Knowingly contravening s. 10.1 or s. 10.3(1): fine up to $10,000 on summary conviction or up to $100,000 on indictment (s. 28).

real risk of significant harm

Bill C-27 (Consumer Privacy Protection Act) died on the Order Paper in January 2025. Bill C-36, the Protecting Privacy and Consumer Data Act, was tabled and received first reading on June 15, 2026; it would replace Part 1 of PIPEDA and carries the breach reporting duties forward, but it is not law. As of October 2026 PIPEDA remains the governing federal private-sector law (Justice Laws consolidation current to 2026-09-30). Organizations in Alberta, BC and Quebec must also apply provincial law; PIPEDA still applies to their federally regulated activities and inter-provincial/international flows.

2026-10-29
Privacy Act / TBS Directive on Privacy Practices Privacy Act (R.S.C. 1985, c. P-21) and Treasury Board Directive on Privacy Practices, Appendix B (Mandatory Procedures for Privacy Breaches) In force
Federal government institutions subject to the Privacy Act (departments, agencies, Crown corporations listed in the schedule).
  • Office of the Privacy Commissioner of Canada (OPC) and Treasury Board of Canada Secretariat (TBS): no later than seven days after the institution determines that a breach is material report
  • Affected individuals: as soon as possible following containment and assessment of the breach (TBS breach management guidance) report

Records: Institutions must document every privacy breach, including non-material ones, as part of breach management, and report breach statistics in their annual reports to Parliament.

Penalties: No statutory penalty for failure to report; non-compliance is a policy breach subject to TBS consequences under the Policy on Privacy Protection.

material privacy breach

The seven day timeline for reporting a material privacy breach to the OPC and TBS is set out in the Treasury Board Directive on Privacy Practices (Appendix B) and restated in TBS breach management guidance and Privacy Implementation Notice 2024-02. The Directive is policy, not statute, and is updated by TBS without legislative process, so confirm the current version on the TBS site when reporting.

2026-10-29
CCSPA (Bill C-8) Critical Cyber Systems Protection Act, S.C. 2026, c. 9, s. 11 (enacted by Bill C-8, An Act respecting cyber security) Not yet in force
Designated operators in federally regulated vital services and systems (telecommunications, interprovincial/international pipelines and power lines, nuclear, transportation, banking, clearing and settlement) once classes of operators are designated by regulation and listed in Schedule 2.
  • Communications Security Establishment (Canadian Centre for Cyber Security): within a period prescribed by the regulations, not to exceed 72 hours report
  • The operator's appropriate regulator (Minister of Industry, Minister of Transport, OSFI, Bank of Canada, Canada Energy Regulator or Canadian Nuclear Safety Commission): Immediately after reporting a cyber security incident report

Records: s. 30: keep records of program implementation, every reported incident, supply-chain mitigation and directive compliance; records must be kept in Canada; period and manner set by the regulator unless regulations provide otherwise.

Penalties: Administrative monetary penalties of up to $500,000 for an individual and $15,000,000 in any other case per violation (s. 91), each day a separate violation (s. 94); directors and officers who directed or acquiesced in a violation are parties to it (s. 93); contravening s. 17 or 18 is an offence (s. 136). Fine amounts for offences are set in ss. 136 and 137.

cyber security incident affecting a critical cyber system

Royal Assent June 15, 2026 (S.C. 2026, c. 9). The Act comes into force by order in council. As of the Justice Laws consolidation current to September 30, 2026, every provision, including the s. 17 reporting duty, is marked not in force, and no order in council, regulations or designated classes of operators had been published. Prepare for a reporting window of at most 72 hours once regulations set it. Part 1 of Bill C-8 (Telecommunications Act amendments) is a separate regime.

2026-10-29
OSFI Incident Reporting Advisory OSFI Technology and Cyber Security Incident Reporting Advisory (August 2021) and OSFI technology and cyber incident report detailed instructions (2025) In force since 2021-08-13
Federally regulated financial institutions (banks, foreign bank branches, federal credit unions, life and P&C insurers, trust and loan companies). Administrators of federally regulated private pension plans have a separate OSFI advisory (2023) with the same 24-hour window, reported to pensions@osfi-bsif.gc.ca.
  • OSFI Technology Risk Division and the institution's Lead Supervisor: within 24 hours, or sooner if possible report

Records: Not specified in the Advisory beyond the incident report and follow-up reporting; general record expectations under Guideline B-13.

Penalties: No fines; non-compliance can lead to enhanced monitoring, watch-listing or staging under OSFI's supervisory framework.

technology or cyber security incident meeting any one of OSFI's reportable-incident criteria

The Advisory has been in effect since August 13, 2021. Pension plan administrators: OSFI advisory 'Technology and cyber security incident reporting' (pensions page issued 2024-02-28) says to send the Incident Report within 24 hours of discovering an incident. Provincially regulated credit unions report to their provincial regulator (e.g., BCFSA, FSRA) under provincial rules, not to OSFI; those are out of scope here.

2026-10-29
CIRO Rule 3703 CIRO Investment Dealer and Partially Consolidated Rules, s. 3703 (cybersecurity incident reporting; formerly IIROC Dealer Member Rule 3100(1)(B)1.1) In force since 2019-11-14
CIRO investment dealer members. Mutual fund dealer members should confirm whether an equivalent reporting rule applies to them.
  • CIRO (via the Dealer's FinOps relationship manager): within three days of discovery of the cybersecurity incident report
  • CIRO: an incident investigation report within 30 days of discovery of the cybersecurity incident report

Records: Reporting and recordkeeping requirements in Rule 3700 series; no breach-specific retention period stated.

Penalties: CIRO disciplinary sanctions (fines, suspension) under the enforcement rules.

cybersecurity incident

IIROC Notice 19-0194 (November 14, 2019) brought the amendments into force immediately. CIRO's FAQ describes the initial deadline as three calendar days following discovery. The rule applies to investment dealer members; mutual fund dealer members should confirm their own reporting obligations with CIRO.

2026-10-29
CSA continuous disclosure CSA Multilateral Staff Notice 51-347 Disclosure of cyber security risks and incidents (Jan 19, 2017) applied under NI 51-102 Continuous Disclosure Obligations and NP 51-201 In force since 2017-01-19
Reporting issuers (public companies) in Canadian jurisdictions.
  • Securities regulators and the market (news release and material change report filed on SEDAR+): news release immediately on a material change; material change report as soon as practicable and in any event within 10 days (NI 51-102 s. 7.1) report

Records: Disclosure controls and procedures records under NI 52-109.

Penalties: Securities-law enforcement (administrative penalties, cease-trade orders, quasi-criminal prosecution) under provincial securities acts.

material fact or material change

Searches found no CSA rule proposal for a dedicated cyber-incident disclosure instrument as of October 2026 (the SEC has one; Canada relies on general materiality). CSA Staff Notice 11-332 (2016) covers cyber security generally.

2026-10-29
Cyber insurance policy conditions Contractual notice conditions in cyber liability / cyber first-party insurance policies In force
Any organization holding a cyber insurance policy (typically claims-made-and-reported).
  • Insurer (and broker, but notice to the broker alone may not satisfy the policy): as soon as practicable (policy-specific; some set fixed days) report

Records: Preserve evidence and document the timeline for the claim.

Penalties: Denial of coverage or reduced recovery for late notice.

discovery of a security or privacy incident, or receipt of a claim or circumstance

A contract condition, not a law. Notify the insurer before engaging outside counsel or forensic responders: most policies require the use of panel firms and treat late notice as grounds to deny the claim.

2026-10-29
PCI DSS / card brand rules PCI DSS incident response requirements and card brand compromise rules (Visa What To Do If Compromised v5.0; Mastercard Account Data Compromise rules) In force
Merchants, service providers and acquirers that store, process or transmit payment card data, by contract with their acquirer and the card brands.
  • Acquiring bank (merchant bank) and Visa Risk Management / other card brands: Immediately notify all relevant parties; Visa Initial Investigation Report within three (3) business days report

Records: Preserve logs and forensic evidence; PCI DSS Requirement 12.10 incident response plan.

Penalties: Card brand non-compliance assessments, fraud recovery and possible loss of card acceptance.

suspected or confirmed unauthorized access to cardholder data

Visa may have issued a later WTDIC version; v5.0 is the version on visa.ca.

2026-10-29
Service provider duty to the organizations whose data you hold PIPEDA s. 10.2 and the accountability principle (Schedule 1, 4.1.3), Quebec Private Sector Act s. 3.5, Alberta PIPA s. 34.1 and OIPC guidance, plus your contracts In force
Organizations that hold or process personal information on behalf of other organizations: managed service providers, SaaS and cloud hosts, payroll and benefits providers, call centres, marketing agencies, law and accounting firms holding client data.
  • The organizations whose personal information you hold (the controllers or principal organizations): as required by your contract; in the absence of a contractual term, promptly enough that the controller can meet its own duties report
  • Other organizations or government institutions that can reduce the risk of harm (PIPEDA s. 10.2): as soon as feasible after determining the breach has occurred report

Records: Keep the notice you gave and when you gave it; the controller's PIPEDA breach record will rely on it.

Penalties: Contractual remedies under the agreement; for PIPEDA duties, see the PIPEDA regime.

any breach of security safeguards affecting information held for another organization

Compiled from the sources above; the contract term governs the deadline to the controller. The OPC guidance addresses who is responsible for reporting when a processor is breached, not a processor to controller deadline.

2026-10-29

British Columbia

Regime Applies to Notify Threshold Verified
BC PIPA Personal Information Protection Act, S.B.C. 2003, c. 63 Voluntary since 2004-01-01
Private-sector organizations in British Columbia (businesses, non-profits, private clinics and other health practitioners not covered by FIPPA).
  • Office of the Information and Privacy Commissioner for BC (voluntary): as soon as possible (OIPC guidance) (conditional or voluntary) report
  • Affected individuals (voluntary): OIPC best practice: notify without delay where significant harm is possible (conditional or voluntary) report

Records: No statutory requirement; OIPC recommends documenting breaches.

Penalties: PIPA s. 56 creates offences punishable by fine; there is no offence for failing to notify because there is no statutory duty to notify. Fine amounts are set in s. 56 of the Act.

none in statute; OIPC recommends reporting where significant harm is reasonably possible

No PIPA reform bill had been introduced as of October 2026 (McCarthy Tetrault, May 2026, confirms private-sector organizations in BC are not subject to mandatory breach reporting or notification; a September 2026 secondary review found no bill). Beware secondary sites that claim individual notification is mandatory under BC PIPA; the statute contains no such duty. BC Bill 9 (2026) amends FIPPA (public sector) and contains no private-sector breach duty; the 2021 Special Committee recommended mandatory PIPA breach notification but it has not been legislated.

2026-10-29
BC FIPPA s. 36.3 Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165, s. 36.3 In force since 2023-02-01
BC public bodies: ministries, Crown corporations, health authorities, universities, colleges, school boards, municipalities, police boards and other bodies listed in the Act.
  • Affected individuals: without unreasonable delay report
  • Office of the Information and Privacy Commissioner for BC: without unreasonable delay report

Records: Privacy management program requirements (s. 36.2) require documented breach processes; no fixed retention period in s. 36.3.

Penalties: FIPPA ss. 65.2 to 65.6 (added by Bill 22, 2021; the former ss. 74 and 74.1 are repealed): wilful unauthorized collection, use or disclosure and related offences carry fines of up to $50,000 for an individual or service provider and up to $500,000 for a corporation (s. 65.6). No specific offence for failing to notify under s. 36.3.

could reasonably be expected to result in significant harm

Section 36.3 was added by Bill 22 (2021) and the duty has applied since February 1, 2023. Bill 9 (2026) proposes further FIPPA amendments but does not change s. 36.3; check its status before relying on any new provision.

2026-10-29

Alberta

Regime Applies to Notify Threshold Verified
Alberta PIPA Personal Information Protection Act, S.A. 2003, c. P-6.5, ss. 34.1 and 37.1 In force since 2010-05-01
Private-sector organizations in Alberta (businesses, non-profits in commercial activity, professional regulatory organizations) with personal information under their control.
  • Office of the Information and Privacy Commissioner of Alberta: without unreasonable delay report
  • Affected individuals: as required by the Commissioner under s. 37.1 (conditional or voluntary) report

Records: No statutory breach register; OIPC expects documentation of the incident and assessment.

Penalties: Offence fines of up to $10,000 for an individual and up to $100,000 for a person other than an individual (PIPA s. 59).

real risk of significant harm

Mandatory breach reporting in force May 1, 2010 (OIPC Alberta). The Alberta legislature's 2025 PIPA review produced recommendations; no amending bill had been introduced as of September 2026 (secondary source) and none was found on October 29, 2026.

2026-10-29
Alberta POPA Protection of Privacy Act, S.A. 2024, c. P-30.5, s. 10(2)-(3), and the Protection of Privacy (Ministerial) Regulation s. 4 In force since 2025-06-11
Alberta public bodies formerly under FOIP: ministries, agencies, boards, health authorities as public bodies, universities, colleges, school boards, municipalities, police services.
  • Each individual to whom there exists a real risk of significant harm: without unreasonable delay report
  • Information and Privacy Commissioner of Alberta: without unreasonable delay report
  • Minister of Technology and Innovation: without any unreasonable delay report

Records: Privacy management program (mandatory from June 11, 2026) must include breach handling and documentation; no fixed statutory retention period identified.

Penalties: Knowingly contravening Part 1 (personal information): fines of up to $125,000 for an individual and up to $750,000 for an organization (Government of Alberta Bill 33 information sheet, November 2024). The King's Printer text was not opened; confirm the section number in the Act.

real risk of significant harm

POPA replaced FOIP on June 11, 2025 (FOIP had no mandatory breach duty). Privacy management program obligations apply from June 11, 2026. Breaches that began under FOIP should still be reported on the POPA form with a note (OIPC).

2026-10-29
Alberta HIA s. 60.1 Health Information Act, R.S.A. 2000, c. H-5, s. 60.1 In force since 2018-08-31
Alberta custodians (Alberta Health Services, physicians, pharmacists, dentists, nursing homes, Alberta Health) and their affiliates.
  • Information and Privacy Commissioner of Alberta: as soon as practicable report
  • Minister of Health: as soon as practicable report
  • Affected individuals: as soon as practicable report

Records: Affiliates must notify the custodian; custodians should document breaches (OIPC assessment tool).

Penalties: Failing to notify is an offence under HIA s. 107 punishable by fine; amounts are set in the Act.

risk of harm to an individual

Section 60.1 has been in force since August 31, 2018.

2026-10-29

Saskatchewan

Regime Applies to Notify Threshold Verified
Saskatchewan FOIP / LA FOIP The Freedom of Information and Protection of Privacy Act, s. 29.1, and The Local Authority Freedom of Information and Protection of Privacy Act, s. 28.1 In force since 2018-01-01
Saskatchewan government institutions (FOIP) and local authorities such as municipalities, school divisions, universities and the Saskatchewan Health Authority (LA FOIP).
  • Affected individuals: take all reasonable steps to notify (no statutory deadline) report
  • Saskatchewan Information and Privacy Commissioner (voluntary): proactive reporting encouraged; OIPC asks for its questionnaire within 30 days of a proactive report (conditional or voluntary) report

Records: No statutory register; OIPC guidelines recommend documenting every breach and the response.

Penalties: FOIP s. 68: fines up to $50,000 and/or one year imprisonment for knowingly collecting, using or disclosing personal information in contravention of the Act; no offence for failing to notify.

real risk of significant harm

Section 29.1 was added by S.S. 2017, c. 12 and the FOIP and LA FOIP amendments came into force January 1, 2018. LA FOIP s. 28.1 is the equivalent duty for local authorities (municipalities, school divisions, health authorities); the Commissioner's guidance explains how both are applied.

2026-10-29
Saskatchewan HIPA The Health Information Protection Act, S.S. 1999, c. H-0.021, s. 16 and The Health Information Protection Regulations, 2023 Voluntary
Saskatchewan trustees: Saskatchewan Health Authority, eHealth, physicians, pharmacists, other health professionals and facilities.
  • Affected individuals (OIPC expectation): at the earliest opportunity (OIPC) (conditional or voluntary) report
  • Saskatchewan Information and Privacy Commissioner (voluntary): OIPC recommendation: within ten calendar days of initiating containment (conditional or voluntary) report

Records: Not specified.

Penalties: HIPA s. 64 offence provisions apply; amounts are set in the Act.

none in statute; OIPC applies the LA FOIP real-risk-of-significant-harm practice

Private clinics also fall under PIPEDA for commercial activity. Trustees that are also local authorities (the Saskatchewan Health Authority and others listed under LA FOIP) are bound by the mandatory LA FOIP s. 28.1 duty to notify individuals; see the Saskatchewan FOIP / LA FOIP regime. The August 1, 2023 HIPA changes (MLT Aikins) did not add a breach notification duty.

2026-10-29

Manitoba

Regime Applies to Notify Threshold Verified
Manitoba FIPPA s. 41.1 The Freedom of Information and Protection of Privacy Act, C.C.S.M. c. F175, s. 41.1 (added by S.M. 2021, c. 43) In force since 2022-01-01
Manitoba public bodies: departments, Crown agencies, municipalities, school divisions, universities, regional health authorities and other local public bodies.
  • Manitoba Ombudsman: at the time and in the form and manner that the Ombudsman requires (s. 41.1(4)) report
  • Affected individuals: as soon as practicable after the privacy breach becomes known to the head of the public body (s. 41.1(3)(a)) report

Records: Not specified in sources reviewed.

Penalties: FIPPA s. 85 offence provisions apply; amounts are set in the Act.

real risk of significant harm

Section 41.1 was added by S.M. 2021, c. 43 and has been in force since January 1, 2022. Before 2022 reporting to the Ombudsman was voluntary, and some older Ombudsman pages still describe the voluntary regime.

2026-10-29
Manitoba PHIA s. 19.0.1 The Personal Health Information Act, C.C.S.M. c. P33.5, s. 19.0.1 (added by S.M. 2021, c. 47) In force since 2022-01-01
Manitoba trustees: health professionals, health care facilities, regional health authorities, Shared Health, public bodies holding personal health information.
  • Affected individuals: as soon as practicable after the privacy breach becomes known to the trustee report
  • Manitoba Ombudsman: at the time and in the form and manner that the Ombudsman requires report

Records: Not specified.

Penalties: PHIA s. 63 offences include failing to comply with s. 19.0.1 (added by S.M. 2021, c. 47); amounts are set in the Act.

real risk of significant harm

In-force date January 1, 2022 per the consolidated Act's legislative history.

2026-10-29

Ontario

Regime Applies to Notify Threshold Verified
Ontario FIPPA s. 40.1 Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F.31, ss. 34 and 40.1, as amended by Bill 194 (Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024, Schedule 2) In force since 2025-07-01
Provincial institutions under FIPPA: ministries, agencies, hospitals, universities, colleges, Ontario Power Generation and other listed bodies. MFIPPA municipal institutions (municipalities, school boards, police boards) are NOT covered by the s. 40.1 duty.
  • Information and Privacy Commissioner of Ontario (IPC): as soon as feasible after the head determines that the theft, loss or unauthorized use or disclosure occurred report
  • Affected individuals: as soon as feasible after the head determines that the theft, loss or unauthorized use or disclosure occurred report
  • IPC (annual statistical report): by March 31 of the following year report

Records: s. 40.1(8): keep and maintain a record of every theft, loss or unauthorized use or disclosure reported to the IPC (number, type, individuals affected) for annual reporting.

Penalties: Bill 194 Schedule 2 added no breach-specific fine; the IPC gained binding order powers and a complaint regime .

real risk that a significant harm to an individual would result

Schedule 2 of Bill 194 (ss. 1 to 14) was proclaimed in force July 1, 2025. Subsection numbering within s. 40.1 follows the Bill text; confirm against the consolidated Act on e-Laws. MFIPPA institutions (municipalities, school boards, police boards) have no statutory breach duty; the IPC recommends they report significant breaches voluntarily.

2026-10-29
Ontario O. Reg. 51/26 (EDSTA) Ontario Regulation 51/26: Cyber Security, made under the Enhancing Digital Security and Trust Act, 2024 (Bill 194, Schedule 1) In force since 2026-07-01
Prescribed public sector entities: colleges and universities (as defined in FIPPA), Group A, B and C public hospitals and the University of Ottawa Heart Institute, school boards under the Education Act, and children's aid societies including Indigenous child and family well-being agencies.
  • Chief Information Security Officer, Ministry of Public and Business Service Delivery and Procurement: within 72 hours after confirmation of the incident report

Records: Maintain a cyber security program; complete a cyber security maturity assessment by July 1, 2027 and every two years, with a summary to the CISO within 30 days of completion.

Penalties: No fines in the regulation; compliance is enforced through the Minister's directive powers under EDSTA.

critical cyber security incident

EDSTA was in force January 29, 2025; O. Reg. 51/26 and the companion O. Reg. 52/26 (student digital information notices for school boards) took effect July 1, 2026. Reports go to the Ministry Chief Information Security Officer, not the IPC, and are in addition to any FIPPA s. 40.1 or PHIPA duty. Read the regulation text on e-Laws for the reporting clause and definitions.

2026-10-29
Ontario PHIPA s. 12 Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A, s. 12, and O. Reg. 329/04 ss. 6.3-6.4 In force since 2017-10-01
Health information custodians in Ontario (hospitals, physicians, clinics, pharmacies, long-term care homes, laboratories, Ontario Health) and their agents.
  • Affected individuals: at the first reasonable opportunity (no harm threshold) report
  • Information and Privacy Commissioner of Ontario: at the first reasonable opportunity report
  • IPC (annual statistics): annually by March 1 for the previous calendar year (no harm threshold) report
  • Regulatory College of the agent (s. 17.1): within 30 days after the disciplinary action or termination (conditional or voluntary) report

Records: Keep records sufficient to produce the annual statistical report; retain breach documentation.

Penalties: PHIPA s. 72, as amended in 2020: fines of up to $200,000 and up to one year of imprisonment for individuals, and up to $1,000,000 for organizations.

theft, loss or unauthorized use or disclosure (individuals); prescribed circumstances (IPC)

Hospitals are also prescribed entities under O. Reg. 51/26 (72-hour report to the Ministry CISO) and FIPPA institutions (s. 40.1), so a single incident can trigger three Ontario reports.

2026-10-29

Quebec

Regime Applies to Notify Threshold Verified
Quebec Law 25 (private sector) Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, ss. 3.5 to 3.8, and the Regulation respecting confidentiality incidents (CQLR c. A-2.1, r. 3.1) In force since 2022-09-22
Any enterprise (person carrying on an enterprise) that collects, holds, uses or communicates personal information in Quebec, including out-of-province organizations handling Quebec residents' data.
  • Commission d'accès à l'information du Québec (CAI): promptly (avec diligence) report
  • Persons concerned: promptly (avec diligence) report

Records: Keep a register of every confidentiality incident (including those without serious injury) with the eight prescribed categories; keep each entry up to date and retain it for at least five years after the enterprise became aware of the incident; provide a copy to the CAI on request (s. 3.8; Regulation ss. 7-8).

Penalties: Monetary administrative penalties of up to $50,000 for a natural person and, in all other cases, $10,000,000 or 2% of worldwide turnover for the preceding fiscal year, whichever is greater (s. 90.12); penal fines of $5,000 to $100,000 for a natural person and $15,000 to $25,000,000 or 4% of worldwide turnover, whichever is greater, in all other cases (s. 91), doubled for a subsequent offence (s. 92.1).

risk of serious injury

Confidentiality-incident duties in force since September 22, 2022; the Regulation (O.C. 1761-2022) applied from late December 2022. Statutory wording is 'promptly' (EN) / 'avec diligence' (FR). Quebec financial institutions and credit assessment agents regulated by the AMF have a separate duty: the Regulation respecting the management and reporting of information security incidents by certain financial institutions and by credit assessment agents has been in force since April 23, 2025 and requires a report to the AMF via E-Services no later than 24 hours from the time an officer (or manager) is informed, with updates every three days.

2026-10-29
Quebec Access Act (public sector) Act respecting Access to documents held by public bodies and the Protection of personal information, CQLR c. A-2.1, ss. 63.8 to 63.11, and the Regulation respecting confidentiality incidents In force since 2022-09-22
Quebec public bodies: government departments, agencies, municipalities, school service centres, health and social services institutions, universities and colleges.
  • Commission d'accès à l'information du Québec: promptly (avec diligence) report
  • Persons concerned: promptly (avec diligence) report

Records: Register of all confidentiality incidents (s. 63.11), retained at least five years after awareness (Regulation s. 8); copy to the CAI on request.

Penalties: Public bodies are subject to the Access Act's penal provisions. The monetary administrative penalties in s. 90.12 of the private sector Act apply to enterprises, not public bodies. Amounts are set in the Access Act.

risk of serious injury

Section numbering: the incident duties are ss. 63.8-63.11 (s. 63.7 is default confidentiality settings), not 63.7-63.10.

2026-10-29

New Brunswick

Regime Applies to Notify Threshold Verified
New Brunswick RTIPPA Right to Information and Protection of Privacy Act, S.N.B. 2009, c. R-10.6, and General Regulation 2010-111, s. 4.2 (added by N.B. Reg. 2018-24) In force since 2018-04-01
New Brunswick public bodies: departments, Crown corporations, municipalities, universities, school districts, regional health authorities.
  • Affected individuals: as soon as possible report
  • New Brunswick Ombud (formerly Access to Information and Privacy Commissioner): as soon as possible report

Records: Investigate every actual or suspected breach and maintain a registry of every actual privacy breach and corrective measures (Reg s. 4.2(4)(b)).

Penalties: RTIPPA s. 87 offence provisions apply; amounts are set in the Act.

risk of significant harm

The Ombud's January 2026 submission to the RTIPPA legislative review asks for the duty to be moved into the Act; no amending bill in force.

2026-10-29
New Brunswick PHIPAA s. 49 Personal Health Information Privacy and Access Act, S.N.B. 2009, c. P-7.05, s. 49 In force since 2010-09-01
New Brunswick custodians: regional health authorities, physicians, pharmacists, nursing homes, Medavie, Department of Health.
  • Affected individuals: at the first reasonable opportunity report
  • New Brunswick Ombud: at the first reasonable opportunity report

Records: Not specified in s. 49.

Penalties: PHIPAA s. 76 offences apply; the fine category and amounts are set in the Act and the Provincial Offences Procedure Act.

theft, loss, improper disposal, or unauthorized disclosure or access, unless no adverse impact

In force September 1, 2010. The duty is in s. 49.

2026-10-29

Nova Scotia

Regime Applies to Notify Threshold Verified
Nova Scotia FOIPOP / PIIDPA Freedom of Information and Protection of Privacy Act, S.N.S. 1993, c. 5 (current), Personal Information International Disclosure Protection Act, S.N.S. 2006, c. 3, and the new Freedom of Information and Protection of Privacy Act (Bill 150, 2025) Voluntary
Nova Scotia public bodies (departments, agencies, municipalities under Part XX of the MGA, school boards, universities, health authorities) and, for PIIDPA, their service providers.
  • Minister of Justice (PIIDPA): immediately notify the Minister report
  • Nova Scotia Information and Privacy Commissioner (voluntary until the new Act is in force): no statutory deadline; voluntary (conditional or voluntary) report

Records: None under current FOIPOP.

Penalties: PIIDPA s. 13(3): fines up to $2,000 (individuals), $25,000 (individual service providers) and $500,000 (corporations).

none under current FOIPOP; PIIDPA: foreign demand for disclosure (or unauthorized disclosure in response to one); new Act (April 1, 2027): real risk of significant harm

A new Freedom of Information and Protection of Privacy Act (Bill 150, S.N.S. 2025, c. 13, Royal Assent October 3, 2025) comes into force April 1, 2027 and introduces mandatory notification based on a real risk of significant harm. Until then public bodies in Nova Scotia have no statutory duty to notify; the Commissioner encourages voluntary reporting. PIIDPA applies only where personal information is disclosed in response to a foreign demand.

2026-10-29
Nova Scotia PHIA ss. 69-70 Personal Health Information Act, S.N.S. 2010, c. 41, ss. 69-70 In force since 2013-06-01
Nova Scotia custodians: Nova Scotia Health, IWK, physicians, pharmacists, long-term care, Department of Health and Wellness.
  • Affected individuals: at the first reasonable opportunity report
  • Nova Scotia Information and Privacy Commissioner (Review Officer): as soon as possible (where the custodian decides not to notify the individual) report

Records: Not specified.

Penalties: s. 107: fines up to $10,000 and/or six months imprisonment (individuals) and $50,000 (corporations).

potential for harm or embarrassment

The duties are in ss. 69 and 70(2), with offences in s. 107. The Act has been in force since June 1, 2013.

2026-10-29

Prince Edward Island

Regime Applies to Notify Threshold Verified
PEI FOIPP Freedom of Information and Protection of Privacy Act, R.S.P.E.I. 1988, c. F-15.01 Voluntary
PEI public bodies: departments, agencies, municipalities, Health PEI, UPEI, Holland College, school authorities.
  • PEI Information and Privacy Commissioner (voluntary): no statutory deadline (conditional or voluntary) report

Records: None required.

Penalties: FOIPP s. 75 offence provisions apply; amounts are set in the Act.

none in statute

No amending bill introducing mandatory FOIPP breach notification was found.

2026-10-29
PEI Health Information Act Health Information Act, R.S.P.E.I. 1988, c. H-1.41 In force since 2017-07-01
PEI custodians: Health PEI, physicians, pharmacists, other health professionals and facilities.
  • Affected individuals: at the first reasonable opportunity report
  • PEI Information and Privacy Commissioner: at the first reasonable opportunity report

Records: Not specified.

Penalties: Offence provisions apply; amounts are set in the Act.

theft, loss, or unauthorized access or disclosure, unless no adverse impact

In force July 1, 2017. The custodian's duty and the Commissioner's expectations are described in the PEI OIPC breach guidelines (April 2024); confirm the section reference against the Act.

2026-10-29

Newfoundland and Labrador

Regime Applies to Notify Threshold Verified
NL ATIPPA, 2015 s. 64 Access to Information and Protection of Privacy Act, 2015, S.N.L. 2015, c. A-1.2, s. 64 In force since 2015-06-01
Newfoundland and Labrador public bodies: departments, agencies, municipalities, school boards, universities, regional health authorities.
  • Affected individuals: at the first reasonable opportunity report
  • Office of the Information and Privacy Commissioner of NL: no deadline in s. 64(4); OIPC practice: report promptly (no harm threshold) report

Records: Not specified in s. 64.

Penalties: ATIPPA, 2015 s. 115 offence provisions apply; amounts are set in the Act.

risk of significant harm (individuals); any unauthorized collection, use or disclosure (commissioner)

Section 64(4) contains no 'material' threshold, so the commissioner must be told of every breach involving unauthorized collection, use or disclosure regardless of harm.

2026-10-29
NL PHIA s. 15 Personal Health Information Act, S.N.L. 2008, c. P-7.01, s. 15 In force since 2011-04-01
NL custodians: NL Health Services, physicians, pharmacists, other health professionals, Department of Health and Community Services.
  • Affected individuals: at the first reasonable opportunity report
  • Office of the Information and Privacy Commissioner of NL: no deadline in s. 15(4); OIPC expects prompt reporting report

Records: Not specified.

Penalties: PHIA s. 88 offence provisions apply; amounts are set in the Act.

theft, loss, improper disposal or unauthorized access/disclosure (individuals); material breach (commissioner)

The duty is in s. 15. The Act has been in force since April 1, 2011.

2026-10-29

Yukon

Regime Applies to Notify Threshold Verified
Yukon ATIPP Act Access to Information and Protection of Privacy Act, S.Y. 2018, c. 9, Part 3 Division on privacy breaches (ss. 31-34 region) In force since 2021-04-01
Yukon public bodies: departments, Crown corporations, Yukon University, Yukon Hospital Corporation, municipalities and school councils.
  • Affected individuals: no statutory timeline (Yukon ATIPP Office: timelines are not included in the Act or Regulation) report
  • Yukon Information and Privacy Commissioner: no statutory timeline report

Records: Public bodies must keep a written record of each privacy breach (government information note on s. 32(7)(b)).

Penalties: Offence provisions apply; amounts are set in the Act.

risk of significant harm

In force April 1, 2021. The Act and Regulation set no fixed timelines for notification; Yukon government procedures describe the expected steps and the s. 32(7)(b) duty to notify individuals.

2026-10-29
Yukon HIPMA ss. 30-31 Health Information Privacy and Management Act, S.Y. 2013, c. 16, ss. 30-31 In force since 2016-08-31
Yukon custodians: Department of Health and Social Services, Yukon Hospital Corporation, physicians, pharmacists and other health care providers.
  • Affected individuals: as soon as reasonably possible report
  • Yukon Information and Privacy Commissioner: within a reasonable timeframe report

Records: Not specified.

Penalties: Offence provisions apply; amounts are set in the Act.

likelihood of significant harm

Wording taken from a Yukon government sample protocol, not the Act. In-force date: the Whitehorse Daily Star reported on September 6, 2016 that HIPMA 'came into force last Wednesday', i.e. August 31, 2016.

2026-10-29

the Northwest Territories

Regime Applies to Notify Threshold Verified
NWT ATIPP Act Access to Information and Protection of Privacy Act (NWT), Part 2 Division E Data Breach Notification, ss. 49.7-49.15 (added by S.N.W.T. 2019, c. 8) In force since 2021-07-30
NWT public bodies: departments, boards, agencies, Aurora College, health and social services authorities, and municipalities once designated.
  • NWT Information and Privacy Commissioner: as soon as reasonably possible after the head knows or has reason to believe a breach occurred and determines it is material report
  • Affected individuals: as soon as reasonably possible after the head knows or has reason to believe a breach occurred and determines it creates a real risk of significant harm report

Records: Not specified in the sources reviewed.

Penalties: Offence provisions apply; amounts are set in the Act.

material breach (Commissioner); real risk of significant harm (individuals)

Breach notification duties were added by S.N.W.T. 2019, c. 8 and came into force in July 2021. There is no s. 87.1; the duties are in ss. 49.9 and 49.10.

2026-10-29
NWT Health Information Act Health Information Act, S.N.W.T. 2014, c. 2, s. 87, and Health Information Regulations ss. 14-15 In force since 2015-10-01
NWT custodians: Department of Health and Social Services, health and social services authorities, physicians, pharmacists and other providers.
  • Affected individuals: as soon as reasonably possible (HIA s. 87) (no harm threshold) report
  • NWT Information and Privacy Commissioner and law enforcement: no deadline in Regulation s. 15 report

Records: Regulation s. 14: investigate, keep a record of the breach and corrective measures.

Penalties: HIA offence provisions apply; amounts are set in the Act.

reasonable risk of harm (commissioner); any inappropriate access, loss or theft (individuals)

Nunavut has no health-specific privacy act; its ATIPP Act and PIPEDA apply.

2026-10-29

Nunavut

Regime Applies to Notify Threshold Verified
Nunavut ATIPP Act Access to Information and Protection of Privacy Act (Nunavut), Part 2 Division E Data Breach Notification, ss. 49.7-49.14 (S.Nu. 2012, c. 13; amended S.Nu. 2017, c. 26) In force since 2013-05-11
Nunavut public bodies: departments, boards and agencies of the Government of Nunavut and designated bodies.
  • Nunavut Information and Privacy Commissioner: as soon as reasonably possible after the public body knows or has reason to believe a breach occurred and determines it is material report
  • Affected individuals: as soon as reasonably possible after the public body knows or has reason to believe a breach occurred and determines it creates a real risk of significant harm report

Records: GN Privacy Breach Policy requires documentation; no retention period identified.

Penalties: ATIPP s. 59 offence provisions apply; amounts are set in the Act.

material breach (Commissioner); real risk of significant harm (individuals)

Division E was added by S.Nu. 2012, c. 13 (in force May 11, 2013) and amended by S.Nu. 2017, c. 26. Nunavut had mandatory breach notification earlier than most provinces. Bill 59 (2024) was withdrawn; no newer amendments found.

2026-10-29

Outside Canada: EU and UK

Regime Applies to Notify Threshold Verified
GDPR Art. 33-34 EU General Data Protection Regulation (EU) 2016/679, Articles 33 and 34 In force since 2018-05-25
Canadian organizations that are controllers or processors subject to the GDPR (Art. 3: establishment in the EU, or offering goods/services to, or monitoring, individuals in the EU/EEA; UK GDPR mirrors this for the UK).
  • Competent EU/EEA supervisory authority (lead authority or authority of the affected member state): without undue delay and, where feasible, not later than 72 hours after having become aware of it report
  • Data subjects: without undue delay report

Records: Art. 33(5): document every personal data breach (facts, effects, remedial action).

Penalties: Art. 83: up to EUR 10,000,000 or 2% of worldwide annual turnover for breach of Arts. 33-34.

personal data breach, unless unlikely to result in a risk to rights and freedoms (authority); high risk (individuals)

gdpr-info.eu reproduces the official text; EUR-Lex is the primary source.

2026-10-29

Outside Canada: United States

Regime Applies to Notify Threshold Verified
US state breach laws (prompt only) All 50 US states, DC and territories have breach notification statutes with differing triggers, deadlines (often 30-60 days) and attorney-general reporting thresholds In force
Any organization holding personal information of US residents.
  • Affected United States residents, and in many states the state attorney general: set by each state's law; several states require notice within 30, 45 or 60 days of discovery report

Records: n/a

Penalties: varies

varies by state

Every US state has its own breach notification law. This entry is a prompt to obtain US counsel; state rules are not applied here.

2026-10-29

Spotted an error or a change in the law? Report a correction with the source and we will fix the dataset in a pull request. Corrections ship with a new version date.

Questions

How the tool works and what it is not.

Does this tool give legal advice?

No. It maps your answers to the notification duties in Canadian law and shows you the deadlines, the recipients and the source text. Whether a specific threshold is met is a judgment for your counsel. The tool is built so counsel can make that judgment faster.

Where do my answers go?

Nowhere. The questionnaire runs entirely in your browser. Nothing you type is sent to Frontier Cyber or to anyone else, and nothing is stored when you close the page. Print or save the result if you need to keep it.

What is a real risk of significant harm?

The threshold PIPEDA uses for mandatory reporting. Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment or business opportunities, financial loss, identity theft, negative effects on a credit record, and damage to or loss of property. Whether the risk is real turns on the sensitivity of the information and the probability it will be misused. Alberta uses a similar test; Quebec asks whether there is a risk of serious injury.

What if the incident touches several provinces?

Each province where affected people live can engage its own law, and PIPEDA applies to information that crosses borders in commercial activity. Select every region involved and the tool lists each regime separately with its own deadline.

Does a cyber incident without personal information still need reporting?

Sometimes. OSFI regulated institutions, CIRO dealers, designated operators under the Critical Cyber Systems Protection Act and Ontario broader public sector bodies under O. Reg. 51/26 report cyber incidents regardless of whether personal information was involved. The tool covers those regimes too.

How current are the rules?

Every regime shows the date it was last verified against the statute or regulator page it cites. A scheduled review checks the sources monthly and re-verifies every rule quarterly. If you spot an error, write to the address on the Contact page and we will correct it.

Can I use the rules in my own tooling?

Yes. The dataset is published at /tools/breach-notification/rules.json with a version date and a source for every rule. Use it with attribution and keep the lastVerified dates visible to your users.

Corrections

Spotted an error or a change in the law?

Tell us which entry and what the source says. We read every report, correct the dataset in a pull request with the source quoted, and ship the fix with a new version date. Expect a reply within five business days.

Do not include details of your own incident here.
Privacy and cyber updates

What regulators and counsel published this month.

Pulled from the privacy commissioners, the Cyber Centre and Canadian law firm bulletins, refreshed hourly. Read these when a rule in the tool looks out of date; the law moves faster than any dataset.

Loading the latest items.

In an incident now?

Get a consultant on the call today.

Frontier Cyber runs incident response, breach coaching and the regulator conversation, and designs tabletop exercises so the next one goes better. Request help and a consultant replies the same business day.

Start on Frontier Verify
No mailing list. Your details go to the consultant who scopes your work.