Breach notification: Newfoundland and Labrador

Privacy breach notification in Newfoundland and Labrador.

2 notification duties in Newfoundland and Labrador and 2 statutory harm tests, with who to tell, the timing the law sets, the threshold and the primary source for each. Last verified 2026-10-29.

Check your breach Assess the harm

At a glance

What applies in Newfoundland and Labrador.

NL ATIPPA, 2015 s. 64 In force. public bodies. Threshold: risk of significant harm (individuals); any unauthorized collection, use or disclosure (commissioner). Office of the Information and Privacy Commissioner of NL: no deadline in s. 64(4); OIPC practice: report promptly.
NL PHIA s. 15 In force. health information custodians. Threshold: theft, loss, improper disposal or unauthorized access/disclosure (individuals); material breach (commissioner). Office of the Information and Privacy Commissioner of NL: no deadline in s. 15(4); OIPC expects prompt reporting.

The rules

Every notification duty in Newfoundland and Labrador.

Each row links the statute or regulator page it comes from and shows when it was last checked. Dataset version 2026-10-29.

Regime Applies to Notify Threshold Verified

NL ATIPPA, 2015 s. 64 Access to Information and Protection of Privacy Act, 2015, S.N.L. 2015, c. A-1.2, s. 64 In force since 2015-06-01

Newfoundland and Labrador public bodies: departments, agencies, municipalities, school boards, universities, regional health authorities.

Affected individuals: at the first reasonable opportunity report
Office of the Information and Privacy Commissioner of NL: no deadline in s. 64(4); OIPC practice: report promptly (no harm threshold) report

Records: Not specified in s. 64.

Penalties: ATIPPA, 2015 s. 115 offence provisions apply; amounts are set in the Act.

risk of significant harm (individuals); any unauthorized collection, use or disclosure (commissioner)

Section 64(4) contains no 'material' threshold, so the commissioner must be told of every breach involving unauthorized collection, use or disclosure regardless of harm.

2026-10-29

ATIPPA, 2015 (House of Assembly consolidated statutes), s. 64

NL PHIA s. 15 Personal Health Information Act, S.N.L. 2008, c. P-7.01, s. 15 In force since 2011-04-01

NL custodians: NL Health Services, physicians, pharmacists, other health professionals, Department of Health and Community Services.

Affected individuals: at the first reasonable opportunity report
Office of the Information and Privacy Commissioner of NL: no deadline in s. 15(4); OIPC expects prompt reporting report

Records: Not specified.

Penalties: PHIA s. 88 offence provisions apply; amounts are set in the Act.

theft, loss, improper disposal or unauthorized access/disclosure (individuals); material breach (commissioner)

The duty is in s. 15. The Act has been in force since April 1, 2011.

2026-10-29

Spotted an error or a change in the law? Report a correction with the source. The full dataset is rules.json (CC BY 4.0).

The harm test

When a breach in Newfoundland and Labrador has to be reported.

The statutory wording, the factors the law names and the record you have to keep, from the harm thresholds dataset.

NL ATIPPA, 2015

Access to Information and Protection of Privacy Act, 2015, S.N.L. 2015, c. A-1.2, s. 64

Individuals must be notified at the first reasonable opportunity when personal information is stolen, lost, improperly disposed of, or accessed or disclosed without authority, unless the head reasonably believes the breach creates no risk of significant harm (s. 64(3), (7)). The commissioner must be informed of every breach involving unauthorized collection, use or disclosure, regardless of harm (s. 64(4)).

Factors the law names

The sensitivity of the personal information (s. 64(9)(a))
The probability that the personal information has been, is being or will be misused (s. 64(9)(b))

Records: Not specified in s. 64; document the assessment.

Verified 2026-10-29: ATIPPA, 2015 (House of Assembly consolidated statutes)

NL PHIA

Personal Health Information Act, S.N.L. 2008, c. P-7.01, s. 15

A custodian must notify the individual of any theft, loss, improper disposal, or unauthorized disclosure or access, unless the custodian reasonably believes it will not adversely affect the provision of health care or other benefits to the individual, or the individual's mental, physical, economic or social well-being (s. 15(3), (7)). The commissioner must be informed of a material breach involving unauthorized collection, use or disclosure.

Factors the law names

Whether the incident will adversely affect the provision of health care or other benefits to the individual (s. 15(7)(a))
Whether it will adversely affect the individual's mental, physical, economic or social well-being (s. 15(7)(b))
For the commissioner, materiality under the Regulations s. 5: (a) the sensitivity of the personal health information involved; (b) the number of people whose information was involved; (c) whether the custodian reasonably believes the information has been or will be misused; (d) whether the cause of the breach or the pattern of breaches indicates a systemic problem

Records: Not specified; document the assessment.

Verified 2026-10-29: NL PHIA (House of Assembly consolidated statutes) ; Personal Health Information Regulations, N.L.R. 38/11

Work through the test for your breach

Federal law

Federal rules that can apply in Newfoundland and Labrador too.

Federal duties follow the organization, not the province: a bank, a telecom or a private company in a province without its own private sector law reports under these as well.

PIPEDA Private-sector organizations that collect, use or disclose personal information in the course of commercial activity anywhere in Canada, federal works, undertakings and businesses (banks, telecoms, airlines, inter-provincial transport) and their employee data, and organizations in provinces without substantially similar private-sector law (every province except BC, Alberta and Quebec; health custodians in Ontario, NB, NS and NL are also substantially similar for health information).
Privacy Act / TBS Directive on Privacy Practices Federal government institutions subject to the Privacy Act (departments, agencies, Crown corporations listed in the schedule).
CCSPA (Bill C-8) Designated operators in federally regulated vital services and systems (telecommunications, interprovincial/international pipelines and power lines, nuclear, transportation, banking, clearing and settlement) once classes of operators are designated by regulation and listed in Schedule 2.
OSFI Incident Reporting Advisory Federally regulated financial institutions (banks, foreign bank branches, federal credit unions, life and P&C insurers, trust and loan companies). Administrators of federally regulated private pension plans have a separate OSFI advisory (2023) with the same 24-hour window, reported to pensions@osfi-bsif.gc.ca.
CIRO Rule 3703 CIRO investment dealer members. Mutual fund dealer members should confirm whether an equivalent reporting rule applies to them.
CSA continuous disclosure Reporting issuers (public companies) in Canadian jurisdictions.

Questions

Breach reporting in Newfoundland and Labrador, answered from the rules.

Do I have to report a privacy breach in Newfoundland and Labrador?

It depends on the kind of organization and the information involved. NL ATIPPA, 2015 s. 64 (in force, public bodies): the threshold is risk of significant harm (individuals); any unauthorized collection, use or disclosure (commissioner). NL PHIA s. 15 (in force, health information custodians): the threshold is theft, loss, improper disposal or unauthorized access/disclosure (individuals); material breach (commissioner). Federal rules such as PIPEDA can apply as well, depending on the organization.

How long do I have to report a breach in Newfoundland and Labrador?

NL ATIPPA, 2015 s. 64: Office of the Information and Privacy Commissioner of NL, no deadline in s. 64(4); OIPC practice: report promptly. NL PHIA s. 15: Office of the Information and Privacy Commissioner of NL, no deadline in s. 15(4); OIPC expects prompt reporting. Where a law sets a fixed number of hours or days, the breach notification tool shows a countdown.

Who has to be notified about a breach in Newfoundland and Labrador?

NL ATIPPA, 2015 s. 64: Affected individuals; Office of the Information and Privacy Commissioner of NL. NL PHIA s. 15: Affected individuals; Office of the Information and Privacy Commissioner of NL. Conditional recipients apply only in the circumstances the law sets out; the rules table above gives the detail for each.

What harm test applies in Newfoundland and Labrador?

NL ATIPPA, 2015: Individuals must be notified at the first reasonable opportunity when personal information is stolen, lost, improperly disposed of, or accessed or disclosed without authority, unless the head reasonably believes the breach creates no risk of significant harm (s. 64(3), (7)). The commissioner must be informed of every breach involving unauthorized collection, use or disclosure, regardless of harm (s. 64(4)). NL PHIA: A custodian must notify the individual of any theft, loss, improper disposal, or unauthorized disclosure or access, unless the custodian reasonably believes it will not adversely affect the provision of health care or other benefits to the individual, or the individual's mental, physical, economic or social well-being (s. 15(3), (7)). The commissioner must be informed of a material breach involving unauthorized collection, use or disclosure.

This page summarizes the law; it is not legal advice. Confirm the decision with counsel for anything you will act on.

Other jurisdictions