Breach notification: New Brunswick

Privacy breach notification in New Brunswick.

2 notification duties in New Brunswick and 2 statutory harm tests, with who to tell, the timing the law sets, the threshold and the primary source for each. Last verified 2026-10-29.

Check your breach Assess the harm

At a glance

What applies in New Brunswick.

New Brunswick RTIPPA In force. public bodies. Threshold: risk of significant harm. New Brunswick Ombud (formerly Access to Information and Privacy Commissioner): as soon as possible.
New Brunswick PHIPAA s. 49 In force. health information custodians. Threshold: theft, loss, improper disposal, or unauthorized disclosure or access, unless no adverse impact. New Brunswick Ombud: at the first reasonable opportunity.

The rules

Every notification duty in New Brunswick.

Each row links the statute or regulator page it comes from and shows when it was last checked. Dataset version 2026-10-29.

Regime Applies to Notify Threshold Verified

New Brunswick RTIPPA Right to Information and Protection of Privacy Act, S.N.B. 2009, c. R-10.6, and General Regulation 2010-111, s. 4.2 (added by N.B. Reg. 2018-24) In force since 2018-04-01

New Brunswick public bodies: departments, Crown corporations, municipalities, universities, school districts, regional health authorities.

Affected individuals: as soon as possible report
New Brunswick Ombud (formerly Access to Information and Privacy Commissioner): as soon as possible report

Records: Investigate every actual or suspected breach and maintain a registry of every actual privacy breach and corrective measures (Reg s. 4.2(4)(b)).

Penalties: RTIPPA s. 87 offence provisions apply; amounts are set in the Act.

risk of significant harm

The Ombud's January 2026 submission to the RTIPPA legislative review asks for the duty to be moved into the Act; no amending bill in force.

2026-10-29

New Brunswick PHIPAA s. 49 Personal Health Information Privacy and Access Act, S.N.B. 2009, c. P-7.05, s. 49 In force since 2010-09-01

New Brunswick custodians: regional health authorities, physicians, pharmacists, nursing homes, Medavie, Department of Health.

Affected individuals: at the first reasonable opportunity report
New Brunswick Ombud: at the first reasonable opportunity report

Records: Not specified in s. 49.

Penalties: PHIPAA s. 76 offences apply; the fine category and amounts are set in the Act and the Provincial Offences Procedure Act.

theft, loss, improper disposal, or unauthorized disclosure or access, unless no adverse impact

In force September 1, 2010. The duty is in s. 49.

2026-10-29

Spotted an error or a change in the law? Report a correction with the source. The full dataset is rules.json (CC BY 4.0).

The harm test

When a breach in New Brunswick has to be reported.

The statutory wording, the factors the law names and the record you have to keep, from the harm thresholds dataset.

New Brunswick RTIPPA

Right to Information and Protection of Privacy Act, General Regulation 2010-111, s. 4.2

Where it is reasonable to believe that a privacy breach creates a risk of significant harm to an individual, considering the sensitivity of the information and the probability of misuse, the public body must notify the individual and the Ombud.

Factors the law names

The sensitivity of the personal information
The probability that the information has been, is being or will be misused

Records: Investigate every actual or suspected breach and maintain a registry of every actual privacy breach and the corrective measures taken (Reg s. 4.2(4)(b)).

Verified 2026-10-29: N.B. Regulation 2018-24 (laws.gnb.ca) ; GNB: Handling privacy breaches

New Brunswick PHIPAA

Personal Health Information Privacy and Access Act, S.N.B. 2009, c. P-7.05, s. 49

A custodian must notify the individual of any theft, loss, improper disposal, or unauthorized disclosure of or access to personal health information, unless the custodian reasonably believes the incident will not adversely impact the provision of health care or other benefits, will not adversely affect the individual's mental, physical, economic or social well-being, and will not lead to the identification of the individual (s. 49(2)).

Factors the law names

Whether the incident could adversely impact the provision of health care or other benefits
Whether it could adversely affect the individual's mental, physical, economic or social well-being
Whether it could lead to identification of the individual

Records: Not specified in s. 49; document the assessment.

Verified 2026-10-29: PHIPAA (laws.gnb.ca, consolidated)

Work through the test for your breach

Federal law

Federal rules that can apply in New Brunswick too.

Federal duties follow the organization, not the province: a bank, a telecom or a private company in a province without its own private sector law reports under these as well.

PIPEDA Private-sector organizations that collect, use or disclose personal information in the course of commercial activity anywhere in Canada, federal works, undertakings and businesses (banks, telecoms, airlines, inter-provincial transport) and their employee data, and organizations in provinces without substantially similar private-sector law (every province except BC, Alberta and Quebec; health custodians in Ontario, NB, NS and NL are also substantially similar for health information).
Privacy Act / TBS Directive on Privacy Practices Federal government institutions subject to the Privacy Act (departments, agencies, Crown corporations listed in the schedule).
CCSPA (Bill C-8) Designated operators in federally regulated vital services and systems (telecommunications, interprovincial/international pipelines and power lines, nuclear, transportation, banking, clearing and settlement) once classes of operators are designated by regulation and listed in Schedule 2.
OSFI Incident Reporting Advisory Federally regulated financial institutions (banks, foreign bank branches, federal credit unions, life and P&C insurers, trust and loan companies). Administrators of federally regulated private pension plans have a separate OSFI advisory (2023) with the same 24-hour window, reported to pensions@osfi-bsif.gc.ca.
CIRO Rule 3703 CIRO investment dealer members. Mutual fund dealer members should confirm whether an equivalent reporting rule applies to them.
CSA continuous disclosure Reporting issuers (public companies) in Canadian jurisdictions.

Questions

Breach reporting in New Brunswick, answered from the rules.

Do I have to report a privacy breach in New Brunswick?

It depends on the kind of organization and the information involved. New Brunswick RTIPPA (in force, public bodies): the threshold is risk of significant harm. New Brunswick PHIPAA s. 49 (in force, health information custodians): the threshold is theft, loss, improper disposal, or unauthorized disclosure or access, unless no adverse impact. Federal rules such as PIPEDA can apply as well, depending on the organization.

How long do I have to report a breach in New Brunswick?

New Brunswick RTIPPA: New Brunswick Ombud (formerly Access to Information and Privacy Commissioner), as soon as possible. New Brunswick PHIPAA s. 49: New Brunswick Ombud, at the first reasonable opportunity. Where a law sets a fixed number of hours or days, the breach notification tool shows a countdown.

Who has to be notified about a breach in New Brunswick?

New Brunswick RTIPPA: Affected individuals; New Brunswick Ombud (formerly Access to Information and Privacy Commissioner). New Brunswick PHIPAA s. 49: Affected individuals; New Brunswick Ombud. Conditional recipients apply only in the circumstances the law sets out; the rules table above gives the detail for each.

What harm test applies in New Brunswick?

New Brunswick RTIPPA: Where it is reasonable to believe that a privacy breach creates a risk of significant harm to an individual, considering the sensitivity of the information and the probability of misuse, the public body must notify the individual and the Ombud. New Brunswick PHIPAA: A custodian must notify the individual of any theft, loss, improper disposal, or unauthorized disclosure of or access to personal health information, unless the custodian reasonably believes the incident will not adversely impact the provision of health care or other benefits, will not adversely affect the individual's mental, physical, economic or social well-being, and will not lead to the identification of the individual (s. 49(2)).

This page summarizes the law; it is not legal advice. Confirm the decision with counsel for anything you will act on.

Other jurisdictions