How the tool decides, and what it will not decide.

Where the rules come from

Every regime in the dataset carries at least one primary source: the statute or regulation on a government legislation site, or the regulator's own guidance page. Deadlines and section numbers are read from that page, not from secondary commentary. Each regime shows the date it was last verified. The dataset version is 2026-10-29 and it holds 38 regimes.

How applicability is decided

The decision procedure is keyed on jurisdiction and sector first. A provincial private sector act applies when the organization is private sector and affected people live in that province. A public sector act applies when the organization is a public body in that province. A health act applies when the organization is a health information custodian and personal health information is involved. Federal rules apply to federally regulated businesses everywhere, to federal institutions, and to private organizations in provinces without a substantially similar law.

A short list of instruments has its own trigger: OSFI and CIRO incident reporting, the Critical Cyber Systems Protection Act, Ontario O. Reg. 51/26, securities disclosure, cyber insurance, PCI DSS, the GDPR, United States state laws, and the duty a service provider owes the organizations whose data it holds. Those are keyed on the flags you select about your organization, and several of them trigger on a cyber incident whether or not personal information was involved.

The procedure is open source in the site repository (src/lib/breach-engine.ts) with unit tests, and the same code runs in your browser.

What the harm indicators mean

Canadian privacy statutes use a threshold: a real risk of significant harm under PIPEDA and Alberta PIPA, a risk of serious injury under Quebec law, and similar language elsewhere. The tool does not decide whether the threshold is met. It scores the factors regulators say to weigh, sensitivity of the information and probability of misuse, and reports the result as strong, moderate or low indicators. Strong or moderate indicators label a statutory duty as Notify; low indicators label it Assess. Either way the regime, its recipients and its source are shown, and the conclusion is yours and your counsel's to record.

Not every duty has a harm threshold. Ontario PHIPA requires notice to individuals of any theft, loss or unauthorized use or disclosure of personal health information; Newfoundland and Labrador requires every unauthorized collection, use or disclosure to be reported to the Commissioner; several health acts require notice unless a narrow exception is shown. The dataset marks those notifications, and the tool labels the regime Notify whatever the harm indicators say. Recipients the statute makes conditional (for example individual notice in Alberta only where the Commissioner directs it) are shown on the regime card but are not counted in the timing list.

How deadlines are shown

Most Canadian privacy statutes do not set a clock. They say as soon as feasible, without unreasonable delay, promptly, or at the first reasonable opportunity. The tool shows that statutory wording and never converts it into a number of hours. Where an instrument does set a number, the tool counts it from the discovery time you entered and shows a countdown. In the current dataset that is true of 6 regimes: Privacy Act / TBS Directive on Privacy Practices, CCSPA (Bill C-8), OSFI Incident Reporting Advisory, CIRO Rule 3703, Ontario O. Reg. 51/26 (EDSTA), GDPR Art. 33-34. Practice benchmarks such as 72 hours that appear in vendor playbooks are not law and are not shown as law.

What the tool does not do

• It does not give legal advice or decide that a threshold is met or not met.
• It does not store, send or log your answers. The rules are embedded in the page and the page makes no network request with your data. The site's Content Security Policy restricts connections to this origin, which you can verify in your browser's developer tools.
• It does not cover every contractual duty. Customer contracts, data processing agreements and sector codes can add notice obligations the tool cannot know about.
• It does not replace the regulators' own forms. Each regime links to the official reporting page.
• It is not endorsed by, affiliated with or reviewed by any privacy commissioner or regulator.

How it is kept current

A scheduled review checks every source link monthly and re-verifies every rule quarterly against the page it cites. Instruments that are enacted but not yet in force are tracked for their in-force dates. Changes ship with a new dataset version and a note on the tool page. If you find an error, write to hello@frontiercyber.com with the source and it will be corrected.

Reuse

The dataset at /tools/breach-notification/rules.json is published under CC BY 4.0. Keep the lastVerified dates visible to your users if you build on it.