Breach notification: Manitoba

Privacy breach notification in Manitoba.

2 notification duties in Manitoba and 2 statutory harm tests, with who to tell, the timing the law sets, the threshold and the primary source for each. Last verified 2026-10-29.

Check your breach Assess the harm

At a glance

What applies in Manitoba.

Manitoba FIPPA s. 41.1 In force. public bodies. Threshold: real risk of significant harm. Manitoba Ombudsman: at the time and in the form and manner that the Ombudsman requires (s. 41.1(4)).
Manitoba PHIA s. 19.0.1 In force. health information custodians. Threshold: real risk of significant harm. Manitoba Ombudsman: at the time and in the form and manner that the Ombudsman requires.

The rules

Every notification duty in Manitoba.

Each row links the statute or regulator page it comes from and shows when it was last checked. Dataset version 2026-10-29.

Regime Applies to Notify Threshold Verified

Manitoba FIPPA s. 41.1 The Freedom of Information and Protection of Privacy Act, C.C.S.M. c. F175, s. 41.1 (added by S.M. 2021, c. 43) In force since 2022-01-01

Manitoba public bodies: departments, Crown agencies, municipalities, school divisions, universities, regional health authorities and other local public bodies.

Manitoba Ombudsman: at the time and in the form and manner that the Ombudsman requires (s. 41.1(4)) report
Affected individuals: as soon as practicable after the privacy breach becomes known to the head of the public body (s. 41.1(3)(a)) report

Records: Not specified in sources reviewed.

Penalties: FIPPA s. 85 offence provisions apply; amounts are set in the Act.

real risk of significant harm

Section 41.1 was added by S.M. 2021, c. 43 and has been in force since January 1, 2022. Before 2022 reporting to the Ombudsman was voluntary, and some older Ombudsman pages still describe the voluntary regime.

2026-10-29

Manitoba PHIA s. 19.0.1 The Personal Health Information Act, C.C.S.M. c. P33.5, s. 19.0.1 (added by S.M. 2021, c. 47) In force since 2022-01-01

Manitoba trustees: health professionals, health care facilities, regional health authorities, Shared Health, public bodies holding personal health information.

Affected individuals: as soon as practicable after the privacy breach becomes known to the trustee report
Manitoba Ombudsman: at the time and in the form and manner that the Ombudsman requires report

Records: Not specified.

Penalties: PHIA s. 63 offences include failing to comply with s. 19.0.1 (added by S.M. 2021, c. 47); amounts are set in the Act.

real risk of significant harm

In-force date January 1, 2022 per the consolidated Act's legislative history.

2026-10-29

Spotted an error or a change in the law? Report a correction with the source. The full dataset is rules.json (CC BY 4.0).

The harm test

When a breach in Manitoba has to be reported.

The statutory wording, the factors the law names and the record you have to keep, from the harm thresholds dataset.

Manitoba FIPPA

The Freedom of Information and Protection of Privacy Act, C.C.S.M. c. F175, s. 41.1, and the FIPPA Regulation ss. 3.1 to 3.3

A public body must notify an individual of a privacy breach that, after considering the factors prescribed by regulation, could reasonably be expected to create a real risk of significant harm to the individual (s. 41.1(2)).

Factors the law names

The factors prescribed by the FIPPA Regulation (ss. 3.1-3.3), including the sensitivity of the information and the probability of misuse
Whether the information was recovered, encrypted or otherwise protected
The number of individuals affected

Records: Not specified in the sources reviewed; document the assessment.

Verified 2026-10-29: Government of Manitoba: FIPPA Amendments (s. 41.1 breach notification) ; S.M. 2021, c. 43 (FIPPA amendments, s. 41.1 text)

Manitoba PHIA

The Personal Health Information Act, C.C.S.M. c. P33.5, s. 19.0.1

A trustee must notify the individual if a privacy breach could reasonably be expected to create a real risk of significant harm to the individual, having regard to the prescribed factors (s. 19.0.1(2)), as soon as practicable after the breach becomes known, directly and in the prescribed form (s. 19.0.1(3)), and must also notify the Ombudsman (s. 19.0.1(4)).

Factors the law names

(a) the sensitivity of the personal health information involved
(b) the probability that the information could be used to cause significant harm, having regard for: (i) the event that caused the breach, including evidence of malicious intent such as theft or unauthorized access to a computer system
(ii) the number of persons who actually or potentially accessed the information
(iii) whether the identity of those persons is known or unknown
(iv) any known relationship between those persons and the individual, and its nature
(v) whether the trustee is reasonably satisfied that any such person has destroyed unauthorized copies and committed not to use or disclose it
(vi) the length of time since the breach first occurred and the period the information was available to be accessed, used, disclosed, destroyed or altered
(vii) the amount of personal health information involved
(viii) whether the information has been recovered
(ix) whether it was adequately encrypted, anonymized or otherwise not easily accessible
(x) whether harm has materialized
(c) any other factors that are reasonably relevant in the circumstances (Personal Health Information Regulation s. 8.7)

Records: Not specified in s. 19.0.1; the notice must contain the nine prescribed elements (Regulation s. 8.8), so keep the assessment that supports them.

Verified 2026-10-29: Manitoba PHIA (C.C.S.M. c. P33.5) consolidated ; Personal Health Information Regulation, M.R. 245/97 ; Manitoba Ombudsman practice note: Privacy breaches, key steps (January 2022)

Work through the test for your breach

Federal law

Federal rules that can apply in Manitoba too.

Federal duties follow the organization, not the province: a bank, a telecom or a private company in a province without its own private sector law reports under these as well.

PIPEDA Private-sector organizations that collect, use or disclose personal information in the course of commercial activity anywhere in Canada, federal works, undertakings and businesses (banks, telecoms, airlines, inter-provincial transport) and their employee data, and organizations in provinces without substantially similar private-sector law (every province except BC, Alberta and Quebec; health custodians in Ontario, NB, NS and NL are also substantially similar for health information).
Privacy Act / TBS Directive on Privacy Practices Federal government institutions subject to the Privacy Act (departments, agencies, Crown corporations listed in the schedule).
CCSPA (Bill C-8) Designated operators in federally regulated vital services and systems (telecommunications, interprovincial/international pipelines and power lines, nuclear, transportation, banking, clearing and settlement) once classes of operators are designated by regulation and listed in Schedule 2.
OSFI Incident Reporting Advisory Federally regulated financial institutions (banks, foreign bank branches, federal credit unions, life and P&C insurers, trust and loan companies). Administrators of federally regulated private pension plans have a separate OSFI advisory (2023) with the same 24-hour window, reported to pensions@osfi-bsif.gc.ca.
CIRO Rule 3703 CIRO investment dealer members. Mutual fund dealer members should confirm whether an equivalent reporting rule applies to them.
CSA continuous disclosure Reporting issuers (public companies) in Canadian jurisdictions.

Questions

Breach reporting in Manitoba, answered from the rules.

Do I have to report a privacy breach in Manitoba?

It depends on the kind of organization and the information involved. Manitoba FIPPA s. 41.1 (in force, public bodies): the threshold is real risk of significant harm. Manitoba PHIA s. 19.0.1 (in force, health information custodians): the threshold is real risk of significant harm. Federal rules such as PIPEDA can apply as well, depending on the organization.

How long do I have to report a breach in Manitoba?

Manitoba FIPPA s. 41.1: Manitoba Ombudsman, at the time and in the form and manner that the Ombudsman requires (s. 41.1(4)). Manitoba PHIA s. 19.0.1: Manitoba Ombudsman, at the time and in the form and manner that the Ombudsman requires. Where a law sets a fixed number of hours or days, the breach notification tool shows a countdown.

Who has to be notified about a breach in Manitoba?

Manitoba FIPPA s. 41.1: Manitoba Ombudsman; Affected individuals. Manitoba PHIA s. 19.0.1: Affected individuals; Manitoba Ombudsman. Conditional recipients apply only in the circumstances the law sets out; the rules table above gives the detail for each.

What harm test applies in Manitoba?

Manitoba FIPPA: A public body must notify an individual of a privacy breach that, after considering the factors prescribed by regulation, could reasonably be expected to create a real risk of significant harm to the individual (s. 41.1(2)). Manitoba PHIA: A trustee must notify the individual if a privacy breach could reasonably be expected to create a real risk of significant harm to the individual, having regard to the prescribed factors (s. 19.0.1(2)), as soon as practicable after the breach becomes known, directly and in the prescribed form (s. 19.0.1(3)), and must also notify the Ombudsman (s. 19.0.1(4)).

This page summarizes the law; it is not legal advice. Confirm the decision with counsel for anything you will act on.

Other jurisdictions