Request a quote
Breach notification: Canada (federal)

Federal privacy breach notification in Canada.

9 notification duties under federal law and 2 statutory harm tests, with who to tell, the timing the law sets, the threshold and the primary source for each. Last verified 2026-10-29.

Check your breach Assess the harm
At a glance

What applies under federal law.

  • PIPEDA In force. private sector. Threshold: real risk of significant harm. Office of the Privacy Commissioner of Canada (OPC): as soon as feasible after the organization determines that the breach has occurred.
  • Privacy Act / TBS Directive on Privacy Practices In force. federal institutions. Threshold: material privacy breach. Office of the Privacy Commissioner of Canada (OPC) and Treasury Board of Canada Secretariat (TBS): no later than seven days after the institution determines that a breach is material.
  • CCSPA (Bill C-8) Not yet in force. designated critical infrastructure operators. Threshold: cyber security incident affecting a critical cyber system. Communications Security Establishment (Canadian Centre for Cyber Security): within a period prescribed by the regulations, not to exceed 72 hours.
  • OSFI Incident Reporting Advisory In force. federally regulated financial institutions. Threshold: technology or cyber security incident meeting any one of OSFI's reportable-incident criteria. OSFI Technology Risk Division and the institution's Lead Supervisor: within 24 hours, or sooner if possible.
  • CIRO Rule 3703 In force. securities dealers and issuers. Threshold: cybersecurity incident. CIRO (via the Dealer's FinOps relationship manager): within three days of discovery of the cybersecurity incident.
  • CSA continuous disclosure In force. securities dealers and issuers. Threshold: material fact or material change. Securities regulators and the market (news release and material change report filed on SEDAR+): news release immediately on a material change; material change report as soon as practicable and in any event within 10 days (NI 51-102 s. 7.1).
  • Cyber insurance policy conditions In force. contract and industry rules. Threshold: discovery of a security or privacy incident, or receipt of a claim or circumstance.
  • PCI DSS / card brand rules In force. contract and industry rules. Threshold: suspected or confirmed unauthorized access to cardholder data.
  • Service provider duty to the organizations whose data you hold In force. contract and industry rules. Threshold: any breach of security safeguards affecting information held for another organization.
The rules

Every notification duty under federal law.

Each row links the statute or regulator page it comes from and shows when it was last checked. Dataset version 2026-10-29.

Regime Applies to Notify Threshold Verified
PIPEDA Personal Information Protection and Electronic Documents Act, ss. 10.1 to 10.3, and the Breach of Security Safeguards Regulations (SOR/2018-64) In force since 2018-11-01
Private-sector organizations that collect, use or disclose personal information in the course of commercial activity anywhere in Canada, federal works, undertakings and businesses (banks, telecoms, airlines, inter-provincial transport) and their employee data, and organizations in provinces without substantially similar private-sector law (every province except BC, Alberta and Quebec; health custodians in Ontario, NB, NS and NL are also substantially similar for health information).
  • Office of the Privacy Commissioner of Canada (OPC): as soon as feasible after the organization determines that the breach has occurred report
  • Each affected individual: as soon as feasible after the organization determines that the breach has occurred report
  • Other organizations or government institutions that may be able to reduce or mitigate the harm (e.g., banks, credit bureaus, police): as soon as feasible after the organization determines that the breach has occurred report

Records: Keep a record of every breach of security safeguards (whether or not it met the RROSH threshold) for 24 months after the day the organization determines the breach occurred (SOR/2018-64 s. 6); provide records to the OPC on request (s. 10.3(2)).

Penalties: Knowingly contravening s. 10.1 or s. 10.3(1): fine up to $10,000 on summary conviction or up to $100,000 on indictment (s. 28).

real risk of significant harm

Bill C-27 (Consumer Privacy Protection Act) died on the Order Paper in January 2025. Bill C-36, the Protecting Privacy and Consumer Data Act, was tabled and received first reading on June 15, 2026; it would replace Part 1 of PIPEDA and carries the breach reporting duties forward, but it is not law. As of October 2026 PIPEDA remains the governing federal private-sector law (Justice Laws consolidation current to 2026-09-30). Organizations in Alberta, BC and Quebec must also apply provincial law; PIPEDA still applies to their federally regulated activities and inter-provincial/international flows.

2026-10-29
Privacy Act / TBS Directive on Privacy Practices Privacy Act (R.S.C. 1985, c. P-21) and Treasury Board Directive on Privacy Practices, Appendix B (Mandatory Procedures for Privacy Breaches) In force
Federal government institutions subject to the Privacy Act (departments, agencies, Crown corporations listed in the schedule).
  • Office of the Privacy Commissioner of Canada (OPC) and Treasury Board of Canada Secretariat (TBS): no later than seven days after the institution determines that a breach is material report
  • Affected individuals: as soon as possible following containment and assessment of the breach (TBS breach management guidance) report

Records: Institutions must document every privacy breach, including non-material ones, as part of breach management, and report breach statistics in their annual reports to Parliament.

Penalties: No statutory penalty for failure to report; non-compliance is a policy breach subject to TBS consequences under the Policy on Privacy Protection.

material privacy breach

The seven day timeline for reporting a material privacy breach to the OPC and TBS is set out in the Treasury Board Directive on Privacy Practices (Appendix B) and restated in TBS breach management guidance and Privacy Implementation Notice 2024-02. The Directive is policy, not statute, and is updated by TBS without legislative process, so confirm the current version on the TBS site when reporting.

2026-10-29
CCSPA (Bill C-8) Critical Cyber Systems Protection Act, S.C. 2026, c. 9, s. 11 (enacted by Bill C-8, An Act respecting cyber security) Not yet in force
Designated operators in federally regulated vital services and systems (telecommunications, interprovincial/international pipelines and power lines, nuclear, transportation, banking, clearing and settlement) once classes of operators are designated by regulation and listed in Schedule 2.
  • Communications Security Establishment (Canadian Centre for Cyber Security): within a period prescribed by the regulations, not to exceed 72 hours report
  • The operator's appropriate regulator (Minister of Industry, Minister of Transport, OSFI, Bank of Canada, Canada Energy Regulator or Canadian Nuclear Safety Commission): Immediately after reporting a cyber security incident report

Records: s. 30: keep records of program implementation, every reported incident, supply-chain mitigation and directive compliance; records must be kept in Canada; period and manner set by the regulator unless regulations provide otherwise.

Penalties: Administrative monetary penalties of up to $500,000 for an individual and $15,000,000 in any other case per violation (s. 91), each day a separate violation (s. 94); directors and officers who directed or acquiesced in a violation are parties to it (s. 93); contravening s. 17 or 18 is an offence (s. 136). Fine amounts for offences are set in ss. 136 and 137.

cyber security incident affecting a critical cyber system

Royal Assent June 15, 2026 (S.C. 2026, c. 9). The Act comes into force by order in council. As of the Justice Laws consolidation current to September 30, 2026, every provision, including the s. 17 reporting duty, is marked not in force, and no order in council, regulations or designated classes of operators had been published. Prepare for a reporting window of at most 72 hours once regulations set it. Part 1 of Bill C-8 (Telecommunications Act amendments) is a separate regime.

2026-10-29
OSFI Incident Reporting Advisory OSFI Technology and Cyber Security Incident Reporting Advisory (August 2021) and OSFI technology and cyber incident report detailed instructions (2025) In force since 2021-08-13
Federally regulated financial institutions (banks, foreign bank branches, federal credit unions, life and P&C insurers, trust and loan companies). Administrators of federally regulated private pension plans have a separate OSFI advisory (2023) with the same 24-hour window, reported to pensions@osfi-bsif.gc.ca.
  • OSFI Technology Risk Division and the institution's Lead Supervisor: within 24 hours, or sooner if possible report

Records: Not specified in the Advisory beyond the incident report and follow-up reporting; general record expectations under Guideline B-13.

Penalties: No fines; non-compliance can lead to enhanced monitoring, watch-listing or staging under OSFI's supervisory framework.

technology or cyber security incident meeting any one of OSFI's reportable-incident criteria

The Advisory has been in effect since August 13, 2021. Pension plan administrators: OSFI advisory 'Technology and cyber security incident reporting' (pensions page issued 2024-02-28) says to send the Incident Report within 24 hours of discovering an incident. Provincially regulated credit unions report to their provincial regulator (e.g., BCFSA, FSRA) under provincial rules, not to OSFI; those are out of scope here.

2026-10-29
CIRO Rule 3703 CIRO Investment Dealer and Partially Consolidated Rules, s. 3703 (cybersecurity incident reporting; formerly IIROC Dealer Member Rule 3100(1)(B)1.1) In force since 2019-11-14
CIRO investment dealer members. Mutual fund dealer members should confirm whether an equivalent reporting rule applies to them.
  • CIRO (via the Dealer's FinOps relationship manager): within three days of discovery of the cybersecurity incident report
  • CIRO: an incident investigation report within 30 days of discovery of the cybersecurity incident report

Records: Reporting and recordkeeping requirements in Rule 3700 series; no breach-specific retention period stated.

Penalties: CIRO disciplinary sanctions (fines, suspension) under the enforcement rules.

cybersecurity incident

IIROC Notice 19-0194 (November 14, 2019) brought the amendments into force immediately. CIRO's FAQ describes the initial deadline as three calendar days following discovery. The rule applies to investment dealer members; mutual fund dealer members should confirm their own reporting obligations with CIRO.

2026-10-29
CSA continuous disclosure CSA Multilateral Staff Notice 51-347 Disclosure of cyber security risks and incidents (Jan 19, 2017) applied under NI 51-102 Continuous Disclosure Obligations and NP 51-201 In force since 2017-01-19
Reporting issuers (public companies) in Canadian jurisdictions.
  • Securities regulators and the market (news release and material change report filed on SEDAR+): news release immediately on a material change; material change report as soon as practicable and in any event within 10 days (NI 51-102 s. 7.1) report

Records: Disclosure controls and procedures records under NI 52-109.

Penalties: Securities-law enforcement (administrative penalties, cease-trade orders, quasi-criminal prosecution) under provincial securities acts.

material fact or material change

Searches found no CSA rule proposal for a dedicated cyber-incident disclosure instrument as of October 2026 (the SEC has one; Canada relies on general materiality). CSA Staff Notice 11-332 (2016) covers cyber security generally.

2026-10-29
Cyber insurance policy conditions Contractual notice conditions in cyber liability / cyber first-party insurance policies In force
Any organization holding a cyber insurance policy (typically claims-made-and-reported).
  • Insurer (and broker, but notice to the broker alone may not satisfy the policy): as soon as practicable (policy-specific; some set fixed days) report

Records: Preserve evidence and document the timeline for the claim.

Penalties: Denial of coverage or reduced recovery for late notice.

discovery of a security or privacy incident, or receipt of a claim or circumstance

A contract condition, not a law. Notify the insurer before engaging outside counsel or forensic responders: most policies require the use of panel firms and treat late notice as grounds to deny the claim.

2026-10-29
PCI DSS / card brand rules PCI DSS incident response requirements and card brand compromise rules (Visa What To Do If Compromised v5.0; Mastercard Account Data Compromise rules) In force
Merchants, service providers and acquirers that store, process or transmit payment card data, by contract with their acquirer and the card brands.
  • Acquiring bank (merchant bank) and Visa Risk Management / other card brands: Immediately notify all relevant parties; Visa Initial Investigation Report within three (3) business days report

Records: Preserve logs and forensic evidence; PCI DSS Requirement 12.10 incident response plan.

Penalties: Card brand non-compliance assessments, fraud recovery and possible loss of card acceptance.

suspected or confirmed unauthorized access to cardholder data

Visa may have issued a later WTDIC version; v5.0 is the version on visa.ca.

2026-10-29
Service provider duty to the organizations whose data you hold PIPEDA s. 10.2 and the accountability principle (Schedule 1, 4.1.3), Quebec Private Sector Act s. 3.5, Alberta PIPA s. 34.1 and OIPC guidance, plus your contracts In force
Organizations that hold or process personal information on behalf of other organizations: managed service providers, SaaS and cloud hosts, payroll and benefits providers, call centres, marketing agencies, law and accounting firms holding client data.
  • The organizations whose personal information you hold (the controllers or principal organizations): as required by your contract; in the absence of a contractual term, promptly enough that the controller can meet its own duties report
  • Other organizations or government institutions that can reduce the risk of harm (PIPEDA s. 10.2): as soon as feasible after determining the breach has occurred report

Records: Keep the notice you gave and when you gave it; the controller's PIPEDA breach record will rely on it.

Penalties: Contractual remedies under the agreement; for PIPEDA duties, see the PIPEDA regime.

any breach of security safeguards affecting information held for another organization

Compiled from the sources above; the contract term governs the deadline to the controller. The OPC guidance addresses who is responsible for reporting when a processor is breached, not a processor to controller deadline.

2026-10-29

Spotted an error or a change in the law? Report a correction with the source. The full dataset is rules.json (CC BY 4.0).

The harm test

When a breach under federal law has to be reported.

The statutory wording, the factors the law names and the record you have to keep, from the harm thresholds dataset.

PIPEDA

Personal Information Protection and Electronic Documents Act, s. 10.1, and the Breach of Security Safeguards Regulations (SOR/2018-64)

An organization shall report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual (s. 10.1(1)). Unless otherwise prohibited by law, an organization shall notify an individual of any breach of security safeguards involving the individual's personal information under the organization's control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual (s. 10.1(3)).

Factors the law names

  • the sensitivity of the personal information involved in the breach
  • the probability that the personal information has been, is being or will be misused
  • any other prescribed factor (none has been prescribed)
  • OPC on sensitivity: any information can be sensitive depending on the context; health and financial information, ethnic or racial origin, political opinions, genetic data, biometric data, sex life or sexual orientation and religious or philosophical beliefs are generally sensitive; look at both what was breached and the circumstances
  • OPC on probability: what happened and how likely is it that someone would be harmed by the breach
  • Who actually accessed or could have accessed the personal information
  • How long has the personal information been exposed
  • Is there evidence of malicious intent (theft, hacking)
  • Were a number of pieces of personal information breached, raising the risk of misuse
  • Is the information in the hands of a person who represents a reputation risk to the individual (an ex-spouse, a boss)
  • Was the information exposed to limited, known entities who have committed to destroy and not disclose it, or to individuals unlikely to share it, or to unknown or many individuals, or to those likely to attempt to cause harm
  • Has harm materialized (demonstration of misuse)
  • Was the information lost, inappropriately accessed or stolen, and has it been recovered
  • Is the personal information adequately encrypted, anonymized or otherwise not easily accessible

Records: Keep a record of every breach of security safeguards, whether or not it met the real risk of significant harm threshold, for 24 months after the day the organization determines the breach occurred, with enough detail to show the assessment (s. 10.3; SOR/2018-64 s. 6). Provide the records to the Commissioner on request.

Verified 2026-10-29: PIPEDA s. 10.1 (Justice Laws) ; PIPEDA ss. 10.2, 10.3 (Justice Laws) ; Breach of Security Safeguards Regulations SOR/2018-64 ; OPC: What you need to know about mandatory reporting of breaches of security safeguards (last modified 2025-08-11) ; Breach of Security Safeguards Regulations SOR/2018-64 (full text)

Privacy Act institutions (TBS Directive)

Treasury Board Directive on Privacy Practices, Appendix B, Mandatory Procedures for Privacy Breaches

A material privacy breach is a privacy breach that could reasonably be expected to create a real risk of significant harm to an individual (Policy on Privacy Protection, Appendix A, as restated in the TBS Privacy Breach Management Toolkit). A privacy breach is improper or unauthorized access to, creation, collection, use, disclosure, retention or disposal of personal information.

Factors the law names

  • Assess how a reasonable person would react under similar circumstances
  • The sensitivity of the personal information: the more sensitive, the greater the potential harm, and context changes sensitivity
  • The potential harm to individuals and the likelihood of that harm materializing (risk to individuals)
  • Materiality depends solely on the risk to the individual or individuals; a medium or high risk to individuals is treated as material
  • The OPC privacy breach risk self-assessment tool (2025) is the supporting instrument

Records: Keep a record of every privacy breach, material or not, for five years after the date the institution discovered the breach; records of material breaches include the report sent to the OPC and TBS.

Verified 2026-10-29: TBS Privacy Breach Management Toolkit: definitions and scenarios ; TBS Toolkit: Complete a risk assessment of the privacy breach ; TBS Toolkit: Keep a record of the breach ; TBS Privacy Implementation Notice 2024-02

Work through the test for your breach

Questions

Breach reporting under federal law, answered from the rules.

Do I have to report a privacy breach under federal law?

It depends on the kind of organization and the information involved. PIPEDA (in force, private sector): the threshold is real risk of significant harm. Privacy Act / TBS Directive on Privacy Practices (in force, federal institutions): the threshold is material privacy breach. CCSPA (Bill C-8) (not yet in force, designated critical infrastructure operators): the threshold is cyber security incident affecting a critical cyber system. OSFI Incident Reporting Advisory (in force, federally regulated financial institutions): the threshold is technology or cyber security incident meeting any one of OSFI's reportable-incident criteria. CIRO Rule 3703 (in force, securities dealers and issuers): the threshold is cybersecurity incident. CSA continuous disclosure (in force, securities dealers and issuers): the threshold is material fact or material change. Cyber insurance policy conditions (in force, contract and industry rules): the threshold is discovery of a security or privacy incident, or receipt of a claim or circumstance. PCI DSS / card brand rules (in force, contract and industry rules): the threshold is suspected or confirmed unauthorized access to cardholder data. Service provider duty to the organizations whose data you hold (in force, contract and industry rules): the threshold is any breach of security safeguards affecting information held for another organization. Provincial and territorial law can apply as well.

How long do I have to report a breach under federal law?

PIPEDA: Office of the Privacy Commissioner of Canada (OPC), as soon as feasible after the organization determines that the breach has occurred. Privacy Act / TBS Directive on Privacy Practices: Office of the Privacy Commissioner of Canada (OPC) and Treasury Board of Canada Secretariat (TBS), no later than seven days after the institution determines that a breach is material. CCSPA (Bill C-8): Communications Security Establishment (Canadian Centre for Cyber Security), within a period prescribed by the regulations, not to exceed 72 hours. CCSPA (Bill C-8): The operator's appropriate regulator (Minister of Industry, Minister of Transport, OSFI, Bank of Canada, Canada Energy Regulator or Canadian Nuclear Safety Commission), Immediately after reporting a cyber security incident. OSFI Incident Reporting Advisory: OSFI Technology Risk Division and the institution's Lead Supervisor, within 24 hours, or sooner if possible. CIRO Rule 3703: CIRO (via the Dealer's FinOps relationship manager), within three days of discovery of the cybersecurity incident. CIRO Rule 3703: CIRO, an incident investigation report within 30 days of discovery of the cybersecurity incident. CSA continuous disclosure: Securities regulators and the market (news release and material change report filed on SEDAR+), news release immediately on a material change; material change report as soon as practicable and in any event within 10 days (NI 51-102 s. 7.1). Where a law sets a fixed number of hours or days, the breach notification tool shows a countdown.

Who has to be notified about a breach under federal law?

PIPEDA: Office of the Privacy Commissioner of Canada (OPC); Each affected individual; Other organizations or government institutions that may be able to reduce or mitigate the harm (e.g., banks, credit bureaus, police). Privacy Act / TBS Directive on Privacy Practices: Office of the Privacy Commissioner of Canada (OPC) and Treasury Board of Canada Secretariat (TBS); Affected individuals. CCSPA (Bill C-8): Communications Security Establishment (Canadian Centre for Cyber Security); The operator's appropriate regulator (Minister of Industry, Minister of Transport, OSFI, Bank of Canada, Canada Energy Regulator or Canadian Nuclear Safety Commission). OSFI Incident Reporting Advisory: OSFI Technology Risk Division and the institution's Lead Supervisor. CIRO Rule 3703: CIRO (via the Dealer's FinOps relationship manager); CIRO. CSA continuous disclosure: Securities regulators and the market (news release and material change report filed on SEDAR+). Cyber insurance policy conditions: Insurer (and broker, but notice to the broker alone may not satisfy the policy). PCI DSS / card brand rules: Acquiring bank (merchant bank) and Visa Risk Management / other card brands. Service provider duty to the organizations whose data you hold: The organizations whose personal information you hold (the controllers or principal organizations); Other organizations or government institutions that can reduce the risk of harm (PIPEDA s. 10.2). Conditional recipients apply only in the circumstances the law sets out; the rules table above gives the detail for each.

What harm test applies under federal law?

PIPEDA: An organization shall report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual (s. 10.1(1)). Unless otherwise prohibited by law, an organization shall notify an individual of any breach of security safeguards involving the individual's personal information under the organization's control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual (s. 10.1(3)). Privacy Act institutions (TBS Directive): A material privacy breach is a privacy breach that could reasonably be expected to create a real risk of significant harm to an individual (Policy on Privacy Protection, Appendix A, as restated in the TBS Privacy Breach Management Toolkit). A privacy breach is improper or unauthorized access to, creation, collection, use, disclosure, retention or disposal of personal information.

This page summarizes the law; it is not legal advice. Confirm the decision with counsel for anything you will act on.

Other jurisdictions

Breach notification across Canada.