Request a quote
Breach notification: Ontario

Privacy breach notification in Ontario.

3 notification duties in Ontario and 2 statutory harm tests, with who to tell, the timing the law sets, the threshold and the primary source for each. Last verified 2026-10-29.

Check your breach Assess the harm
At a glance

What applies in Ontario.

  • Ontario FIPPA s. 40.1 In force. public bodies. Threshold: real risk that a significant harm to an individual would result. Information and Privacy Commissioner of Ontario (IPC): as soon as feasible after the head determines that the theft, loss or unauthorized use or disclosure occurred.
  • Ontario O. Reg. 51/26 (EDSTA) In force. public bodies. Threshold: critical cyber security incident. Chief Information Security Officer, Ministry of Public and Business Service Delivery and Procurement: within 72 hours after confirmation of the incident.
  • Ontario PHIPA s. 12 In force. health information custodians. Threshold: theft, loss or unauthorized use or disclosure (individuals); prescribed circumstances (IPC). Information and Privacy Commissioner of Ontario: at the first reasonable opportunity.
The rules

Every notification duty in Ontario.

Each row links the statute or regulator page it comes from and shows when it was last checked. Dataset version 2026-10-29.

Regime Applies to Notify Threshold Verified
Ontario FIPPA s. 40.1 Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F.31, ss. 34 and 40.1, as amended by Bill 194 (Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024, Schedule 2) In force since 2025-07-01
Provincial institutions under FIPPA: ministries, agencies, hospitals, universities, colleges, Ontario Power Generation and other listed bodies. MFIPPA municipal institutions (municipalities, school boards, police boards) are NOT covered by the s. 40.1 duty.
  • Information and Privacy Commissioner of Ontario (IPC): as soon as feasible after the head determines that the theft, loss or unauthorized use or disclosure occurred report
  • Affected individuals: as soon as feasible after the head determines that the theft, loss or unauthorized use or disclosure occurred report
  • IPC (annual statistical report): by March 31 of the following year report

Records: s. 40.1(8): keep and maintain a record of every theft, loss or unauthorized use or disclosure reported to the IPC (number, type, individuals affected) for annual reporting.

Penalties: Bill 194 Schedule 2 added no breach-specific fine; the IPC gained binding order powers and a complaint regime .

real risk that a significant harm to an individual would result

Schedule 2 of Bill 194 (ss. 1 to 14) was proclaimed in force July 1, 2025. Subsection numbering within s. 40.1 follows the Bill text; confirm against the consolidated Act on e-Laws. MFIPPA institutions (municipalities, school boards, police boards) have no statutory breach duty; the IPC recommends they report significant breaches voluntarily.

2026-10-29
Ontario O. Reg. 51/26 (EDSTA) Ontario Regulation 51/26: Cyber Security, made under the Enhancing Digital Security and Trust Act, 2024 (Bill 194, Schedule 1) In force since 2026-07-01
Prescribed public sector entities: colleges and universities (as defined in FIPPA), Group A, B and C public hospitals and the University of Ottawa Heart Institute, school boards under the Education Act, and children's aid societies including Indigenous child and family well-being agencies.
  • Chief Information Security Officer, Ministry of Public and Business Service Delivery and Procurement: within 72 hours after confirmation of the incident report

Records: Maintain a cyber security program; complete a cyber security maturity assessment by July 1, 2027 and every two years, with a summary to the CISO within 30 days of completion.

Penalties: No fines in the regulation; compliance is enforced through the Minister's directive powers under EDSTA.

critical cyber security incident

EDSTA was in force January 29, 2025; O. Reg. 51/26 and the companion O. Reg. 52/26 (student digital information notices for school boards) took effect July 1, 2026. Reports go to the Ministry Chief Information Security Officer, not the IPC, and are in addition to any FIPPA s. 40.1 or PHIPA duty. Read the regulation text on e-Laws for the reporting clause and definitions.

2026-10-29
Ontario PHIPA s. 12 Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A, s. 12, and O. Reg. 329/04 ss. 6.3-6.4 In force since 2017-10-01
Health information custodians in Ontario (hospitals, physicians, clinics, pharmacies, long-term care homes, laboratories, Ontario Health) and their agents.
  • Affected individuals: at the first reasonable opportunity (no harm threshold) report
  • Information and Privacy Commissioner of Ontario: at the first reasonable opportunity report
  • IPC (annual statistics): annually by March 1 for the previous calendar year (no harm threshold) report
  • Regulatory College of the agent (s. 17.1): within 30 days after the disciplinary action or termination (conditional or voluntary) report

Records: Keep records sufficient to produce the annual statistical report; retain breach documentation.

Penalties: PHIPA s. 72, as amended in 2020: fines of up to $200,000 and up to one year of imprisonment for individuals, and up to $1,000,000 for organizations.

theft, loss or unauthorized use or disclosure (individuals); prescribed circumstances (IPC)

Hospitals are also prescribed entities under O. Reg. 51/26 (72-hour report to the Ministry CISO) and FIPPA institutions (s. 40.1), so a single incident can trigger three Ontario reports.

2026-10-29

Spotted an error or a change in the law? Report a correction with the source. The full dataset is rules.json (CC BY 4.0).

The harm test

When a breach in Ontario has to be reported.

The statutory wording, the factors the law names and the record you have to keep, from the harm thresholds dataset.

Ontario FIPPA

Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F.31, s. 40.1 (Bill 194, Schedule 2, in force July 1, 2025)

Where personal information is stolen, lost or used or disclosed without authority and it is reasonable in the circumstances to believe that there is a real risk that a significant harm to an individual would result, or in other prescribed circumstances, the institution must notify the Commissioner and the affected individuals.

Factors the law names

  • The sensitivity of the personal information
  • The likelihood that the information has been or will be misused
  • Steps taken to mitigate the breach
  • Any guidance issued by the Commissioner

Records: Keep and maintain a record of every theft, loss or unauthorized use or disclosure reported to the Commissioner, for the annual statistical report (s. 40.1(8)).

Verified 2026-10-29: Bill 194 as passed (Legislative Assembly of Ontario) ; IPC FAQ: Schedule 2 of Bill 194 / FIPPA amendments

Ontario PHIPA

Personal Health Information Protection Act, 2004, s. 12, and O. Reg. 329/04 ss. 6.3 to 6.4

A health information custodian that has custody or control of personal health information about an individual shall notify the individual at the first reasonable opportunity if the information is stolen or lost or if it is used or disclosed without authority (s. 12(2)). The Commissioner must be notified where a prescribed circumstance exists (s. 12(3)).

Factors the law names

  • Prescribed circumstances for notifying the Commissioner (O. Reg. 329/04 s. 6.3): use or disclosure without authority by a person who knew or ought to have known it was unauthorized
  • The information was stolen
  • Further use or disclosure without authority after an initial loss or unauthorized use or disclosure
  • The incident is part of a pattern of similar incidents
  • The custodian is required to give notice to a College of a disciplinary matter
  • The custodian would have been required to give notice to a College had the agent been a member
  • The incident is significant having regard to the sensitivity of the information, the number of individuals and custodians or agents involved, and the circumstances

Records: Keep records sufficient to produce the annual statistical report to the Commissioner (O. Reg. 329/04 s. 6.4) and retain the breach documentation.

Verified 2026-10-29: IPC Ontario: Reporting a Privacy Breach to the Commissioner, Guidelines for the Health Sector (March 2021, reproduces O. Reg. 329/04 s. 6.3) ; IPC: Regulations, prescribed circumstances for notifying the Commissioner (O. Reg. 329/04 s. 6.3) ; IPC breach report form

Work through the test for your breach

Federal law

Federal rules that can apply in Ontario too.

Federal duties follow the organization, not the province: a bank, a telecom or a private company in a province without its own private sector law reports under these as well.

  • PIPEDA Private-sector organizations that collect, use or disclose personal information in the course of commercial activity anywhere in Canada, federal works, undertakings and businesses (banks, telecoms, airlines, inter-provincial transport) and their employee data, and organizations in provinces without substantially similar private-sector law (every province except BC, Alberta and Quebec; health custodians in Ontario, NB, NS and NL are also substantially similar for health information).
  • Privacy Act / TBS Directive on Privacy Practices Federal government institutions subject to the Privacy Act (departments, agencies, Crown corporations listed in the schedule).
  • CCSPA (Bill C-8) Designated operators in federally regulated vital services and systems (telecommunications, interprovincial/international pipelines and power lines, nuclear, transportation, banking, clearing and settlement) once classes of operators are designated by regulation and listed in Schedule 2.
  • OSFI Incident Reporting Advisory Federally regulated financial institutions (banks, foreign bank branches, federal credit unions, life and P&C insurers, trust and loan companies). Administrators of federally regulated private pension plans have a separate OSFI advisory (2023) with the same 24-hour window, reported to pensions@osfi-bsif.gc.ca.
  • CIRO Rule 3703 CIRO investment dealer members. Mutual fund dealer members should confirm whether an equivalent reporting rule applies to them.
  • CSA continuous disclosure Reporting issuers (public companies) in Canadian jurisdictions.
Questions

Breach reporting in Ontario, answered from the rules.

Do I have to report a privacy breach in Ontario?

It depends on the kind of organization and the information involved. Ontario FIPPA s. 40.1 (in force, public bodies): the threshold is real risk that a significant harm to an individual would result. Ontario O. Reg. 51/26 (EDSTA) (in force, public bodies): the threshold is critical cyber security incident. Ontario PHIPA s. 12 (in force, health information custodians): the threshold is theft, loss or unauthorized use or disclosure (individuals); prescribed circumstances (IPC). Federal rules such as PIPEDA can apply as well, depending on the organization.

How long do I have to report a breach in Ontario?

Ontario FIPPA s. 40.1: Information and Privacy Commissioner of Ontario (IPC), as soon as feasible after the head determines that the theft, loss or unauthorized use or disclosure occurred. Ontario FIPPA s. 40.1: IPC (annual statistical report), by March 31 of the following year. Ontario O. Reg. 51/26 (EDSTA): Chief Information Security Officer, Ministry of Public and Business Service Delivery and Procurement, within 72 hours after confirmation of the incident. Ontario PHIPA s. 12: Information and Privacy Commissioner of Ontario, at the first reasonable opportunity. Ontario PHIPA s. 12: IPC (annual statistics), annually by March 1 for the previous calendar year. Where a law sets a fixed number of hours or days, the breach notification tool shows a countdown.

Who has to be notified about a breach in Ontario?

Ontario FIPPA s. 40.1: Information and Privacy Commissioner of Ontario (IPC); Affected individuals; IPC (annual statistical report). Ontario O. Reg. 51/26 (EDSTA): Chief Information Security Officer, Ministry of Public and Business Service Delivery and Procurement. Ontario PHIPA s. 12: Affected individuals; Information and Privacy Commissioner of Ontario; IPC (annual statistics); Regulatory College of the agent (s. 17.1) (conditional or voluntary). Conditional recipients apply only in the circumstances the law sets out; the rules table above gives the detail for each.

What harm test applies in Ontario?

Ontario FIPPA: Where personal information is stolen, lost or used or disclosed without authority and it is reasonable in the circumstances to believe that there is a real risk that a significant harm to an individual would result, or in other prescribed circumstances, the institution must notify the Commissioner and the affected individuals. Ontario PHIPA: A health information custodian that has custody or control of personal health information about an individual shall notify the individual at the first reasonable opportunity if the information is stolen or lost or if it is used or disclosed without authority (s. 12(2)). The Commissioner must be notified where a prescribed circumstance exists (s. 12(3)).

This page summarizes the law; it is not legal advice. Confirm the decision with counsel for anything you will act on.

Other jurisdictions

Breach notification across Canada.