Breach notification: British Columbia

Privacy breach notification in British Columbia.

2 notification duties in British Columbia and 2 statutory harm tests, with who to tell, the timing the law sets, the threshold and the primary source for each. Last verified 2026-10-29.

Check your breach Assess the harm

At a glance

What applies in British Columbia.

BC PIPA Voluntary. private sector. Threshold: none in statute; OIPC recommends reporting where significant harm is reasonably possible. Office of the Information and Privacy Commissioner for BC (voluntary) (conditional or voluntary): as soon as possible (OIPC guidance).
BC FIPPA s. 36.3 In force. public bodies. Threshold: could reasonably be expected to result in significant harm. Office of the Information and Privacy Commissioner for BC: without unreasonable delay.

The rules

Every notification duty in British Columbia.

Each row links the statute or regulator page it comes from and shows when it was last checked. Dataset version 2026-10-29.

Regime Applies to Notify Threshold Verified

BC PIPA Personal Information Protection Act, S.B.C. 2003, c. 63 Voluntary since 2004-01-01

Private-sector organizations in British Columbia (businesses, non-profits, private clinics and other health practitioners not covered by FIPPA).

Office of the Information and Privacy Commissioner for BC (voluntary): as soon as possible (OIPC guidance) (conditional or voluntary) report
Affected individuals (voluntary): OIPC best practice: notify without delay where significant harm is possible (conditional or voluntary) report

Records: No statutory requirement; OIPC recommends documenting breaches.

Penalties: PIPA s. 56 creates offences punishable by fine; there is no offence for failing to notify because there is no statutory duty to notify. Fine amounts are set in s. 56 of the Act.

none in statute; OIPC recommends reporting where significant harm is reasonably possible

No PIPA reform bill had been introduced as of October 2026 (McCarthy Tetrault, May 2026, confirms private-sector organizations in BC are not subject to mandatory breach reporting or notification; a September 2026 secondary review found no bill). Beware secondary sites that claim individual notification is mandatory under BC PIPA; the statute contains no such duty. BC Bill 9 (2026) amends FIPPA (public sector) and contains no private-sector breach duty; the 2021 Special Committee recommended mandatory PIPA breach notification but it has not been legislated.

2026-10-29

BC FIPPA s. 36.3 Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165, s. 36.3 In force since 2023-02-01

BC public bodies: ministries, Crown corporations, health authorities, universities, colleges, school boards, municipalities, police boards and other bodies listed in the Act.

Affected individuals: without unreasonable delay report
Office of the Information and Privacy Commissioner for BC: without unreasonable delay report

Records: Privacy management program requirements (s. 36.2) require documented breach processes; no fixed retention period in s. 36.3.

Penalties: FIPPA ss. 65.2 to 65.6 (added by Bill 22, 2021; the former ss. 74 and 74.1 are repealed): wilful unauthorized collection, use or disclosure and related offences carry fines of up to $50,000 for an individual or service provider and up to $500,000 for a corporation (s. 65.6). No specific offence for failing to notify under s. 36.3.

could reasonably be expected to result in significant harm

Section 36.3 was added by Bill 22 (2021) and the duty has applied since February 1, 2023. Bill 9 (2026) proposes further FIPPA amendments but does not change s. 36.3; check its status before relying on any new provision.

2026-10-29

Spotted an error or a change in the law? Report a correction with the source. The full dataset is rules.json (CC BY 4.0).

The harm test

When a breach in British Columbia has to be reported.

The statutory wording, the factors the law names and the record you have to keep, from the harm thresholds dataset.

BC PIPA (voluntary)

Personal Information Protection Act, S.B.C. 2003, c. 63

PIPA contains no mandatory breach notification provision. The Commissioner recommends, as best practice, notifying affected individuals and reporting to the OIPC where a breach could reasonably be expected to result in significant harm.

Factors the law names

OIPC checklist, when to report: the personal information involved is sensitive
There is a risk of identity theft or other harm including pain and suffering or loss of reputation
A large number of people are affected by the breach
The information has not been fully recovered
The breach is the result of a systemic problem or a similar breach has occurred before
Risk factors: the type and volume of information, its potential for fraudulent or harmful use, whether the cause was malicious, the extent of containment, whether records were recovered or securely destroyed, and whether they were password protected or encrypted

Records: No statutory requirement; the OIPC recommends documenting every breach and the response.

Verified 2026-10-29: OIPC BC: Breach notification for representatives of organizations and public bodies ; OIPC BC: Privacy Breach Checklist for private organizations ; OIPC BC: Privacy breach quick reference guide for small and medium-sized businesses

BC FIPPA

Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165, s. 36.3

If a privacy breach involving personal information in the custody or under the control of a public body occurs, the head must, without unreasonable delay, notify an affected individual if the privacy breach could reasonably be expected to result in significant harm to the individual, and notify the commissioner if the privacy breach could reasonably be expected to result in such harm (s. 36.3(2)). A privacy breach is the theft or loss, or the collection, use or disclosure that is not authorized by Part 3, of personal information in the custody or under the control of a public body (s. 36.3(1)).

Factors the law names

The sensitivity, context, and amount of personal information involved
The individuals affected
The relationships of those involved
Ability to contain the breach
Whether the risk of harm from the breach outweighs the risk of further harm from notification (notice may be withheld only where it could reasonably be expected to result in immediate and grave harm to the individual's safety or health, or threaten another individual's, s. 36.3(3))
OIPC BC checklist harm types: identity theft (most likely with SIN, credit card, driver's licence, personal health number or debit card with password), bodily harm including stalking or harassment, humiliation (medical or disciplinary records), damage to reputation or relationships, loss of opportunities, financial loss, credit impact, loss of property

Records: The privacy management program (s. 36.2) must include documented breach processes; s. 36.3 sets no retention period.

Verified 2026-10-29: FIPPA s. 36.3 (BC Laws) ; BC Government FOIPPA Manual: Privacy breach notifications (updated 2026-04-22) ; BC Government: Guidance on Mandatory Privacy Breach Notifications ; OIPC BC: Privacy Breach Checklist for Public Bodies

Work through the test for your breach

Federal law

Federal rules that can apply in British Columbia too.

Federal duties follow the organization, not the province: a bank, a telecom or a private company in a province without its own private sector law reports under these as well.

PIPEDA Private-sector organizations that collect, use or disclose personal information in the course of commercial activity anywhere in Canada, federal works, undertakings and businesses (banks, telecoms, airlines, inter-provincial transport) and their employee data, and organizations in provinces without substantially similar private-sector law (every province except BC, Alberta and Quebec; health custodians in Ontario, NB, NS and NL are also substantially similar for health information).
Privacy Act / TBS Directive on Privacy Practices Federal government institutions subject to the Privacy Act (departments, agencies, Crown corporations listed in the schedule).
CCSPA (Bill C-8) Designated operators in federally regulated vital services and systems (telecommunications, interprovincial/international pipelines and power lines, nuclear, transportation, banking, clearing and settlement) once classes of operators are designated by regulation and listed in Schedule 2.
OSFI Incident Reporting Advisory Federally regulated financial institutions (banks, foreign bank branches, federal credit unions, life and P&C insurers, trust and loan companies). Administrators of federally regulated private pension plans have a separate OSFI advisory (2023) with the same 24-hour window, reported to pensions@osfi-bsif.gc.ca.
CIRO Rule 3703 CIRO investment dealer members. Mutual fund dealer members should confirm whether an equivalent reporting rule applies to them.
CSA continuous disclosure Reporting issuers (public companies) in Canadian jurisdictions.

Questions

Breach reporting in British Columbia, answered from the rules.

Do I have to report a privacy breach in British Columbia?

It depends on the kind of organization and the information involved. BC PIPA (voluntary, private sector): the threshold is none in statute; OIPC recommends reporting where significant harm is reasonably possible. BC FIPPA s. 36.3 (in force, public bodies): the threshold is could reasonably be expected to result in significant harm. Federal rules such as PIPEDA can apply as well, depending on the organization.

How long do I have to report a breach in British Columbia?

BC PIPA: Office of the Information and Privacy Commissioner for BC (voluntary) (conditional or voluntary), as soon as possible (OIPC guidance). BC FIPPA s. 36.3: Office of the Information and Privacy Commissioner for BC, without unreasonable delay. Where a law sets a fixed number of hours or days, the breach notification tool shows a countdown.

Who has to be notified about a breach in British Columbia?

BC PIPA: Office of the Information and Privacy Commissioner for BC (voluntary) (conditional or voluntary); Affected individuals (voluntary) (conditional or voluntary). BC FIPPA s. 36.3: Affected individuals; Office of the Information and Privacy Commissioner for BC. Conditional recipients apply only in the circumstances the law sets out; the rules table above gives the detail for each.

What harm test applies in British Columbia?

BC PIPA (voluntary): PIPA contains no mandatory breach notification provision. The Commissioner recommends, as best practice, notifying affected individuals and reporting to the OIPC where a breach could reasonably be expected to result in significant harm. BC FIPPA: If a privacy breach involving personal information in the custody or under the control of a public body occurs, the head must, without unreasonable delay, notify an affected individual if the privacy breach could reasonably be expected to result in significant harm to the individual, and notify the commissioner if the privacy breach could reasonably be expected to result in such harm (s. 36.3(2)). A privacy breach is the theft or loss, or the collection, use or disclosure that is not authorized by Part 3, of personal information in the custody or under the control of a public body (s. 36.3(1)).

This page summarizes the law; it is not legal advice. Confirm the decision with counsel for anything you will act on.

Other jurisdictions