Breach notification: Nova Scotia

Privacy breach notification in Nova Scotia.

2 notification duties in Nova Scotia and 2 statutory harm tests, with who to tell, the timing the law sets, the threshold and the primary source for each. Last verified 2026-10-29.

Check your breach Assess the harm

At a glance

What applies in Nova Scotia.

Nova Scotia FOIPOP / PIIDPA Voluntary. public bodies. Threshold: none under current FOIPOP; PIIDPA: foreign demand for disclosure (or unauthorized disclosure in response to one); new Act (April 1, 2027): real risk of significant harm. Minister of Justice (PIIDPA): immediately notify the Minister.
Nova Scotia PHIA ss. 69-70 In force. health information custodians. Threshold: potential for harm or embarrassment. Nova Scotia Information and Privacy Commissioner (Review Officer): as soon as possible (where the custodian decides not to notify the individual).

The rules

Every notification duty in Nova Scotia.

Each row links the statute or regulator page it comes from and shows when it was last checked. Dataset version 2026-10-29.

Regime Applies to Notify Threshold Verified

Nova Scotia FOIPOP / PIIDPA Freedom of Information and Protection of Privacy Act, S.N.S. 1993, c. 5 (current), Personal Information International Disclosure Protection Act, S.N.S. 2006, c. 3, and the new Freedom of Information and Protection of Privacy Act (Bill 150, 2025) Voluntary

Nova Scotia public bodies (departments, agencies, municipalities under Part XX of the MGA, school boards, universities, health authorities) and, for PIIDPA, their service providers.

Minister of Justice (PIIDPA): immediately notify the Minister report
Nova Scotia Information and Privacy Commissioner (voluntary until the new Act is in force): no statutory deadline; voluntary (conditional or voluntary) report

Records: None under current FOIPOP.

Penalties: PIIDPA s. 13(3): fines up to $2,000 (individuals), $25,000 (individual service providers) and $500,000 (corporations).

none under current FOIPOP; PIIDPA: foreign demand for disclosure (or unauthorized disclosure in response to one); new Act (April 1, 2027): real risk of significant harm

A new Freedom of Information and Protection of Privacy Act (Bill 150, S.N.S. 2025, c. 13, Royal Assent October 3, 2025) comes into force April 1, 2027 and introduces mandatory notification based on a real risk of significant harm. Until then public bodies in Nova Scotia have no statutory duty to notify; the Commissioner encourages voluntary reporting. PIIDPA applies only where personal information is disclosed in response to a foreign demand.

2026-10-29

Nova Scotia PHIA ss. 69-70 Personal Health Information Act, S.N.S. 2010, c. 41, ss. 69-70 In force since 2013-06-01

Nova Scotia custodians: Nova Scotia Health, IWK, physicians, pharmacists, long-term care, Department of Health and Wellness.

Affected individuals: at the first reasonable opportunity report
Nova Scotia Information and Privacy Commissioner (Review Officer): as soon as possible (where the custodian decides not to notify the individual) report

Records: Not specified.

Penalties: s. 107: fines up to $10,000 and/or six months imprisonment (individuals) and $50,000 (corporations).

potential for harm or embarrassment

The duties are in ss. 69 and 70(2), with offences in s. 107. The Act has been in force since June 1, 2013.

2026-10-29

Nova Scotia PHIA (consolidated PDF), ss. 69, 70, 107

Spotted an error or a change in the law? Report a correction with the source. The full dataset is rules.json (CC BY 4.0).

The harm test

When a breach in Nova Scotia has to be reported.

The statutory wording, the factors the law names and the record you have to keep, from the harm thresholds dataset.

Nova Scotia FOIPOP (new Act from April 1, 2027)

Freedom of Information and Protection of Privacy Act, S.N.S. 1993, c. 5 (current); new Act, S.N.S. 2025, c. 13, in force April 1, 2027

The current Act has no breach notification duty; reporting to the Information and Privacy Commissioner is voluntary. The new Act introduces mandatory notification where a breach creates a real risk of significant harm, from April 1, 2027.

Factors the law names

Sensitivity of the personal information
Probability of misuse

Records: None under the current Act.

Verified 2026-10-29: Nova Scotia Legislature: Bill 150, Freedom of Information and Protection of Privacy Act (2025 c. 13) ; Government of Nova Scotia news release, September 26, 2025

Nova Scotia PHIA

Personal Health Information Act, S.N.S. 2010, c. 41, ss. 69 and 70

Where a custodian believes on a reasonable basis that personal health information has been stolen, lost, or accessed or disclosed without authority, and that this creates potential for harm or embarrassment to the individual, the custodian must notify the individual at the first reasonable opportunity (s. 69). A custodian that decides not to notify because there is no potential for harm or embarrassment must instead notify the Review Officer (s. 70).

Factors the law names

Whether the information was stolen, lost or accessed or disclosed without authority
Whether this creates potential for harm or embarrassment to the individual

Records: Not specified; document the assessment and any decision not to notify.

Verified 2026-10-29: Nova Scotia PHIA (consolidated PDF) ; OIPC Nova Scotia: Reporting Breaches, s. 70 of PHIA guidelines (reissued 2025-11-06)

Work through the test for your breach

Federal law

Federal rules that can apply in Nova Scotia too.

Federal duties follow the organization, not the province: a bank, a telecom or a private company in a province without its own private sector law reports under these as well.

PIPEDA Private-sector organizations that collect, use or disclose personal information in the course of commercial activity anywhere in Canada, federal works, undertakings and businesses (banks, telecoms, airlines, inter-provincial transport) and their employee data, and organizations in provinces without substantially similar private-sector law (every province except BC, Alberta and Quebec; health custodians in Ontario, NB, NS and NL are also substantially similar for health information).
Privacy Act / TBS Directive on Privacy Practices Federal government institutions subject to the Privacy Act (departments, agencies, Crown corporations listed in the schedule).
CCSPA (Bill C-8) Designated operators in federally regulated vital services and systems (telecommunications, interprovincial/international pipelines and power lines, nuclear, transportation, banking, clearing and settlement) once classes of operators are designated by regulation and listed in Schedule 2.
OSFI Incident Reporting Advisory Federally regulated financial institutions (banks, foreign bank branches, federal credit unions, life and P&C insurers, trust and loan companies). Administrators of federally regulated private pension plans have a separate OSFI advisory (2023) with the same 24-hour window, reported to pensions@osfi-bsif.gc.ca.
CIRO Rule 3703 CIRO investment dealer members. Mutual fund dealer members should confirm whether an equivalent reporting rule applies to them.
CSA continuous disclosure Reporting issuers (public companies) in Canadian jurisdictions.

Questions

Breach reporting in Nova Scotia, answered from the rules.

Do I have to report a privacy breach in Nova Scotia?

It depends on the kind of organization and the information involved. Nova Scotia FOIPOP / PIIDPA (voluntary, public bodies): the threshold is none under current FOIPOP; PIIDPA: foreign demand for disclosure (or unauthorized disclosure in response to one); new Act (April 1, 2027): real risk of significant harm. Nova Scotia PHIA ss. 69-70 (in force, health information custodians): the threshold is potential for harm or embarrassment. Federal rules such as PIPEDA can apply as well, depending on the organization.

How long do I have to report a breach in Nova Scotia?

Nova Scotia FOIPOP / PIIDPA: Minister of Justice (PIIDPA), immediately notify the Minister. Nova Scotia FOIPOP / PIIDPA: Nova Scotia Information and Privacy Commissioner (voluntary until the new Act is in force) (conditional or voluntary), no statutory deadline; voluntary. Nova Scotia PHIA ss. 69-70: Nova Scotia Information and Privacy Commissioner (Review Officer), as soon as possible (where the custodian decides not to notify the individual). Where a law sets a fixed number of hours or days, the breach notification tool shows a countdown.

Who has to be notified about a breach in Nova Scotia?

Nova Scotia FOIPOP / PIIDPA: Minister of Justice (PIIDPA); Nova Scotia Information and Privacy Commissioner (voluntary until the new Act is in force) (conditional or voluntary). Nova Scotia PHIA ss. 69-70: Affected individuals; Nova Scotia Information and Privacy Commissioner (Review Officer). Conditional recipients apply only in the circumstances the law sets out; the rules table above gives the detail for each.

What harm test applies in Nova Scotia?

Nova Scotia FOIPOP (new Act from April 1, 2027): The current Act has no breach notification duty; reporting to the Information and Privacy Commissioner is voluntary. The new Act introduces mandatory notification where a breach creates a real risk of significant harm, from April 1, 2027. Nova Scotia PHIA: Where a custodian believes on a reasonable basis that personal health information has been stolen, lost, or accessed or disclosed without authority, and that this creates potential for harm or embarrassment to the individual, the custodian must notify the individual at the first reasonable opportunity (s. 69). A custodian that decides not to notify because there is no potential for harm or embarrassment must instead notify the Review Officer (s. 70).

This page summarizes the law; it is not legal advice. Confirm the decision with counsel for anything you will act on.

Other jurisdictions