Breach notification: Northwest Territories

Privacy breach notification in Northwest Territories.

2 notification duties in the Northwest Territories and 2 statutory harm tests, with who to tell, the timing the law sets, the threshold and the primary source for each. Last verified 2026-10-29.

Check your breach Assess the harm

At a glance

What applies in the Northwest Territories.

NWT ATIPP Act In force. public bodies. Threshold: material breach (Commissioner); real risk of significant harm (individuals). NWT Information and Privacy Commissioner: as soon as reasonably possible after the head knows or has reason to believe a breach occurred and determines it is material.
NWT Health Information Act In force. health information custodians. Threshold: reasonable risk of harm (commissioner); any inappropriate access, loss or theft (individuals). NWT Information and Privacy Commissioner and law enforcement: no deadline in Regulation s. 15.

The rules

Every notification duty in the Northwest Territories.

Each row links the statute or regulator page it comes from and shows when it was last checked. Dataset version 2026-10-29.

Regime Applies to Notify Threshold Verified

NWT ATIPP Act Access to Information and Protection of Privacy Act (NWT), Part 2 Division E Data Breach Notification, ss. 49.7-49.15 (added by S.N.W.T. 2019, c. 8) In force since 2021-07-30

NWT public bodies: departments, boards, agencies, Aurora College, health and social services authorities, and municipalities once designated.

NWT Information and Privacy Commissioner: as soon as reasonably possible after the head knows or has reason to believe a breach occurred and determines it is material report
Affected individuals: as soon as reasonably possible after the head knows or has reason to believe a breach occurred and determines it creates a real risk of significant harm report

Records: Not specified in the sources reviewed.

Penalties: Offence provisions apply; amounts are set in the Act.

material breach (Commissioner); real risk of significant harm (individuals)

Breach notification duties were added by S.N.W.T. 2019, c. 8 and came into force in July 2021. There is no s. 87.1; the duties are in ss. 49.9 and 49.10.

2026-10-29

NWT Health Information Act Health Information Act, S.N.W.T. 2014, c. 2, s. 87, and Health Information Regulations ss. 14-15 In force since 2015-10-01

NWT custodians: Department of Health and Social Services, health and social services authorities, physicians, pharmacists and other providers.

Affected individuals: as soon as reasonably possible (HIA s. 87) (no harm threshold) report
NWT Information and Privacy Commissioner and law enforcement: no deadline in Regulation s. 15 report

Records: Regulation s. 14: investigate, keep a record of the breach and corrective measures.

Penalties: HIA offence provisions apply; amounts are set in the Act.

reasonable risk of harm (commissioner); any inappropriate access, loss or theft (individuals)

Nunavut has no health-specific privacy act; its ATIPP Act and PIPEDA apply.

2026-10-29

NWT Health Information Regulations, ss. 14-15

Spotted an error or a change in the law? Report a correction with the source. The full dataset is rules.json (CC BY 4.0).

The harm test

When a breach in the Northwest Territories has to be reported.

The statutory wording, the factors the law names and the record you have to keep, from the harm thresholds dataset.

NWT ATIPP Act

Access to Information and Protection of Privacy Act (NWT), ss. 49.9 and 49.10

Notify affected individuals if it is reasonable to believe the breach creates a real risk of significant harm, considering the sensitivity of the information and the probability of misuse (s. 49.10). Report to the Commissioner only if the breach is material, considering sensitivity, the number of individuals, the likelihood of harm and whether the cause is systemic (s. 49.9).

Factors the law names

The sensitivity of the personal information
The probability that the information has been, is being or will be misused
For the report to the Commissioner: the number of individuals affected, the likelihood of harm and whether the cause of the breach is systemic

Records: Document the assessment; no retention period identified in the sources reviewed.

Verified 2026-10-29: An Act to Amend the ATIPP Act, S.N.W.T. 2019, c. 8

NWT Health Information Act

Health Information Act, S.N.W.T. 2014, c. 2, s. 87, and the Health Information Regulations ss. 14 and 15

Notify affected individuals of any inappropriate access, loss or theft of personal health information (s. 87). Notify the Commissioner and law enforcement where information is lost or stolen, or where fraud or identity theft leads to disclosure, alteration, destruction or disposal, unless the incident does not present a reasonable risk of harm (Regulation s. 15).

Factors the law names

Whether the incident presents a reasonable risk of harm to the individual
Whether the information was lost, stolen or obtained by fraud or identity theft

Records: Investigate, and keep a record of the breach and the corrective measures taken (Regulation s. 14).

Verified 2026-10-29: NWT Health Information Regulations

Work through the test for your breach

Federal law

Federal rules that can apply in the Northwest Territories too.

Federal duties follow the organization, not the province: a bank, a telecom or a private company in a province without its own private sector law reports under these as well.

PIPEDA Private-sector organizations that collect, use or disclose personal information in the course of commercial activity anywhere in Canada, federal works, undertakings and businesses (banks, telecoms, airlines, inter-provincial transport) and their employee data, and organizations in provinces without substantially similar private-sector law (every province except BC, Alberta and Quebec; health custodians in Ontario, NB, NS and NL are also substantially similar for health information).
Privacy Act / TBS Directive on Privacy Practices Federal government institutions subject to the Privacy Act (departments, agencies, Crown corporations listed in the schedule).
CCSPA (Bill C-8) Designated operators in federally regulated vital services and systems (telecommunications, interprovincial/international pipelines and power lines, nuclear, transportation, banking, clearing and settlement) once classes of operators are designated by regulation and listed in Schedule 2.
OSFI Incident Reporting Advisory Federally regulated financial institutions (banks, foreign bank branches, federal credit unions, life and P&C insurers, trust and loan companies). Administrators of federally regulated private pension plans have a separate OSFI advisory (2023) with the same 24-hour window, reported to pensions@osfi-bsif.gc.ca.
CIRO Rule 3703 CIRO investment dealer members. Mutual fund dealer members should confirm whether an equivalent reporting rule applies to them.
CSA continuous disclosure Reporting issuers (public companies) in Canadian jurisdictions.

Questions

Breach reporting in the Northwest Territories, answered from the rules.

Do I have to report a privacy breach in the Northwest Territories?

It depends on the kind of organization and the information involved. NWT ATIPP Act (in force, public bodies): the threshold is material breach (Commissioner); real risk of significant harm (individuals). NWT Health Information Act (in force, health information custodians): the threshold is reasonable risk of harm (commissioner); any inappropriate access, loss or theft (individuals). Federal rules such as PIPEDA can apply as well, depending on the organization.

How long do I have to report a breach in the Northwest Territories?

NWT ATIPP Act: NWT Information and Privacy Commissioner, as soon as reasonably possible after the head knows or has reason to believe a breach occurred and determines it is material. NWT Health Information Act: NWT Information and Privacy Commissioner and law enforcement, no deadline in Regulation s. 15. Where a law sets a fixed number of hours or days, the breach notification tool shows a countdown.

Who has to be notified about a breach in the Northwest Territories?

NWT ATIPP Act: NWT Information and Privacy Commissioner; Affected individuals. NWT Health Information Act: Affected individuals; NWT Information and Privacy Commissioner and law enforcement. Conditional recipients apply only in the circumstances the law sets out; the rules table above gives the detail for each.

What harm test applies in the Northwest Territories?

NWT ATIPP Act: Notify affected individuals if it is reasonable to believe the breach creates a real risk of significant harm, considering the sensitivity of the information and the probability of misuse (s. 49.10). Report to the Commissioner only if the breach is material, considering sensitivity, the number of individuals, the likelihood of harm and whether the cause is systemic (s. 49.9). NWT Health Information Act: Notify affected individuals of any inappropriate access, loss or theft of personal health information (s. 87). Notify the Commissioner and law enforcement where information is lost or stolen, or where fraud or identity theft leads to disclosure, alteration, destruction or disposal, unless the incident does not present a reasonable risk of harm (Regulation s. 15).

This page summarizes the law; it is not legal advice. Confirm the decision with counsel for anything you will act on.

Other jurisdictions