Breach notification: Prince Edward Island

Privacy breach notification in Prince Edward Island.

2 notification duties in Prince Edward Island and 2 statutory harm tests, with who to tell, the timing the law sets, the threshold and the primary source for each. Last verified 2026-10-29.

Check your breach Assess the harm

At a glance

What applies in Prince Edward Island.

PEI FOIPP Voluntary. public bodies. Threshold: none in statute. PEI Information and Privacy Commissioner (voluntary) (conditional or voluntary): no statutory deadline.
PEI Health Information Act In force. health information custodians. Threshold: theft, loss, or unauthorized access or disclosure, unless no adverse impact. PEI Information and Privacy Commissioner: at the first reasonable opportunity.

The rules

Every notification duty in Prince Edward Island.

Each row links the statute or regulator page it comes from and shows when it was last checked. Dataset version 2026-10-29.

Regime Applies to Notify Threshold Verified

PEI FOIPP Freedom of Information and Protection of Privacy Act, R.S.P.E.I. 1988, c. F-15.01 Voluntary

PEI public bodies: departments, agencies, municipalities, Health PEI, UPEI, Holland College, school authorities.

PEI Information and Privacy Commissioner (voluntary): no statutory deadline (conditional or voluntary) report

Records: None required.

Penalties: FOIPP s. 75 offence provisions apply; amounts are set in the Act.

none in statute

No amending bill introducing mandatory FOIPP breach notification was found.

2026-10-29

PEI Health Information Act Health Information Act, R.S.P.E.I. 1988, c. H-1.41 In force since 2017-07-01

PEI custodians: Health PEI, physicians, pharmacists, other health professionals and facilities.

Affected individuals: at the first reasonable opportunity report
PEI Information and Privacy Commissioner: at the first reasonable opportunity report

Records: Not specified.

Penalties: Offence provisions apply; amounts are set in the Act.

theft, loss, or unauthorized access or disclosure, unless no adverse impact

In force July 1, 2017. The custodian's duty and the Commissioner's expectations are described in the PEI OIPC breach guidelines (April 2024); confirm the section reference against the Act.

2026-10-29

Spotted an error or a change in the law? Report a correction with the source. The full dataset is rules.json (CC BY 4.0).

The harm test

When a breach in Prince Edward Island has to be reported.

The statutory wording, the factors the law names and the record you have to keep, from the harm thresholds dataset.

PEI FOIPP (voluntary)

Freedom of Information and Protection of Privacy Act, R.S.P.E.I. 1988, c. F-15.01

The FOIPP Act contains no breach notification duty. The Commissioner encourages voluntary reporting using the same process as the Health Information Act, assessing the risk of harm to individuals.

Factors the law names

Sensitivity of the personal information
Probability of misuse
Whether the breach will adversely affect the individual

Records: None required; document the assessment.

Verified 2026-10-29: PEI OIPC Privacy Breach Reporting Guidelines

PEI Health Information Act

Health Information Act, R.S.P.E.I. 1988, c. H-1.41

A custodian must notify the individual of theft, loss, or unauthorized access or disclosure of personal health information, unless the custodian reasonably believes the breach will not have an adverse impact on the provision of health care or other benefits, or on the individual's mental, physical, economic or social well-being.

Factors the law names

Whether the breach could adversely impact health care or other benefits
Whether it could adversely affect the individual's mental, physical, economic or social well-being

Records: Not specified; the Commissioner's guidelines expect documentation.

Verified 2026-10-29: PEI OIPC Privacy Breach Reporting Guidelines

Work through the test for your breach

Federal law

Federal rules that can apply in Prince Edward Island too.

Federal duties follow the organization, not the province: a bank, a telecom or a private company in a province without its own private sector law reports under these as well.

PIPEDA Private-sector organizations that collect, use or disclose personal information in the course of commercial activity anywhere in Canada, federal works, undertakings and businesses (banks, telecoms, airlines, inter-provincial transport) and their employee data, and organizations in provinces without substantially similar private-sector law (every province except BC, Alberta and Quebec; health custodians in Ontario, NB, NS and NL are also substantially similar for health information).
Privacy Act / TBS Directive on Privacy Practices Federal government institutions subject to the Privacy Act (departments, agencies, Crown corporations listed in the schedule).
CCSPA (Bill C-8) Designated operators in federally regulated vital services and systems (telecommunications, interprovincial/international pipelines and power lines, nuclear, transportation, banking, clearing and settlement) once classes of operators are designated by regulation and listed in Schedule 2.
OSFI Incident Reporting Advisory Federally regulated financial institutions (banks, foreign bank branches, federal credit unions, life and P&C insurers, trust and loan companies). Administrators of federally regulated private pension plans have a separate OSFI advisory (2023) with the same 24-hour window, reported to pensions@osfi-bsif.gc.ca.
CIRO Rule 3703 CIRO investment dealer members. Mutual fund dealer members should confirm whether an equivalent reporting rule applies to them.
CSA continuous disclosure Reporting issuers (public companies) in Canadian jurisdictions.

Questions

Breach reporting in Prince Edward Island, answered from the rules.

Do I have to report a privacy breach in Prince Edward Island?

It depends on the kind of organization and the information involved. PEI FOIPP (voluntary, public bodies): the threshold is none in statute. PEI Health Information Act (in force, health information custodians): the threshold is theft, loss, or unauthorized access or disclosure, unless no adverse impact. Federal rules such as PIPEDA can apply as well, depending on the organization.

How long do I have to report a breach in Prince Edward Island?

PEI FOIPP: PEI Information and Privacy Commissioner (voluntary) (conditional or voluntary), no statutory deadline. PEI Health Information Act: PEI Information and Privacy Commissioner, at the first reasonable opportunity. Where a law sets a fixed number of hours or days, the breach notification tool shows a countdown.

Who has to be notified about a breach in Prince Edward Island?

PEI FOIPP: PEI Information and Privacy Commissioner (voluntary) (conditional or voluntary). PEI Health Information Act: Affected individuals; PEI Information and Privacy Commissioner. Conditional recipients apply only in the circumstances the law sets out; the rules table above gives the detail for each.

What harm test applies in Prince Edward Island?

PEI FOIPP (voluntary): The FOIPP Act contains no breach notification duty. The Commissioner encourages voluntary reporting using the same process as the Health Information Act, assessing the risk of harm to individuals. PEI Health Information Act: A custodian must notify the individual of theft, loss, or unauthorized access or disclosure of personal health information, unless the custodian reasonably believes the breach will not have an adverse impact on the provision of health care or other benefits, or on the individual's mental, physical, economic or social well-being.

This page summarizes the law; it is not legal advice. Confirm the decision with counsel for anything you will act on.

Other jurisdictions