Breach notification: Nunavut

Privacy breach notification in Nunavut.

1 notification duty in Nunavut and 1 statutory harm test, with who to tell, the timing the law sets, the threshold and the primary source for each. Last verified 2026-10-29.

Check your breach Assess the harm

At a glance

What applies in Nunavut.

Nunavut ATIPP Act In force. public bodies. Threshold: material breach (Commissioner); real risk of significant harm (individuals). Nunavut Information and Privacy Commissioner: as soon as reasonably possible after the public body knows or has reason to believe a breach occurred and determines it is material.

The rules

Every notification duty in Nunavut.

Each row links the statute or regulator page it comes from and shows when it was last checked. Dataset version 2026-10-29.

Regime Applies to Notify Threshold Verified

Nunavut ATIPP Act Access to Information and Protection of Privacy Act (Nunavut), Part 2 Division E Data Breach Notification, ss. 49.7-49.14 (S.Nu. 2012, c. 13; amended S.Nu. 2017, c. 26) In force since 2013-05-11

Nunavut public bodies: departments, boards and agencies of the Government of Nunavut and designated bodies.

Nunavut Information and Privacy Commissioner: as soon as reasonably possible after the public body knows or has reason to believe a breach occurred and determines it is material report
Affected individuals: as soon as reasonably possible after the public body knows or has reason to believe a breach occurred and determines it creates a real risk of significant harm report

Records: GN Privacy Breach Policy requires documentation; no retention period identified.

Penalties: ATIPP s. 59 offence provisions apply; amounts are set in the Act.

material breach (Commissioner); real risk of significant harm (individuals)

Division E was added by S.Nu. 2012, c. 13 (in force May 11, 2013) and amended by S.Nu. 2017, c. 26. Nunavut had mandatory breach notification earlier than most provinces. Bill 59 (2024) was withdrawn; no newer amendments found.

2026-10-29

Spotted an error or a change in the law? Report a correction with the source. The full dataset is rules.json (CC BY 4.0).

The harm test

When a breach in Nunavut has to be reported.

The statutory wording, the factors the law names and the record you have to keep, from the harm thresholds dataset.

Nunavut ATIPP Act

Access to Information and Protection of Privacy Act (Nunavut), Division E, ss. 49.7 to 49.14 (added by S.Nu. 2012, c. 13)

Notify affected individuals if it is reasonable to believe the breach creates a real risk of significant harm, considering the sensitivity of the information and the probability of misuse (s. 49.10). Report to the Commissioner only if the breach is material, considering sensitivity, the number of individuals, the likelihood of harm and whether the cause is systemic (s. 49.9).

Factors the law names

The sensitivity of the personal information
The probability that the information has been, is being or will be misused
For the report to the Commissioner: the number of individuals affected, the likelihood of harm and whether the cause of the breach is systemic

Records: Document the assessment; no retention period identified in the sources reviewed.

Verified 2026-10-29: An Act to Amend the Access to Information and Protection of Privacy Act, S.Nu. 2012, c. 13

Work through the test for your breach

Federal law

Federal rules that can apply in Nunavut too.

Federal duties follow the organization, not the province: a bank, a telecom or a private company in a province without its own private sector law reports under these as well.

PIPEDA Private-sector organizations that collect, use or disclose personal information in the course of commercial activity anywhere in Canada, federal works, undertakings and businesses (banks, telecoms, airlines, inter-provincial transport) and their employee data, and organizations in provinces without substantially similar private-sector law (every province except BC, Alberta and Quebec; health custodians in Ontario, NB, NS and NL are also substantially similar for health information).
Privacy Act / TBS Directive on Privacy Practices Federal government institutions subject to the Privacy Act (departments, agencies, Crown corporations listed in the schedule).
CCSPA (Bill C-8) Designated operators in federally regulated vital services and systems (telecommunications, interprovincial/international pipelines and power lines, nuclear, transportation, banking, clearing and settlement) once classes of operators are designated by regulation and listed in Schedule 2.
OSFI Incident Reporting Advisory Federally regulated financial institutions (banks, foreign bank branches, federal credit unions, life and P&C insurers, trust and loan companies). Administrators of federally regulated private pension plans have a separate OSFI advisory (2023) with the same 24-hour window, reported to pensions@osfi-bsif.gc.ca.
CIRO Rule 3703 CIRO investment dealer members. Mutual fund dealer members should confirm whether an equivalent reporting rule applies to them.
CSA continuous disclosure Reporting issuers (public companies) in Canadian jurisdictions.

Questions

Breach reporting in Nunavut, answered from the rules.

Do I have to report a privacy breach in Nunavut?

It depends on the kind of organization and the information involved. Nunavut ATIPP Act (in force, public bodies): the threshold is material breach (Commissioner); real risk of significant harm (individuals). Federal rules such as PIPEDA can apply as well, depending on the organization.

How long do I have to report a breach in Nunavut?

Nunavut ATIPP Act: Nunavut Information and Privacy Commissioner, as soon as reasonably possible after the public body knows or has reason to believe a breach occurred and determines it is material. Where a law sets a fixed number of hours or days, the breach notification tool shows a countdown.

Who has to be notified about a breach in Nunavut?

Nunavut ATIPP Act: Nunavut Information and Privacy Commissioner; Affected individuals. Conditional recipients apply only in the circumstances the law sets out; the rules table above gives the detail for each.

What harm test applies in Nunavut?

Nunavut ATIPP Act: Notify affected individuals if it is reasonable to believe the breach creates a real risk of significant harm, considering the sensitivity of the information and the probability of misuse (s. 49.10). Report to the Commissioner only if the breach is material, considering sensitivity, the number of individuals, the likelihood of harm and whether the cause is systemic (s. 49.9).

This page summarizes the law; it is not legal advice. Confirm the decision with counsel for anything you will act on.

Other jurisdictions