{ "version": "2026-10-29", "regimes": [ { "id": "pipeda", "name": "PIPEDA", "fullName": "Personal Information Protection and Electronic Documents Act, ss. 10.1 to 10.3, and the Breach of Security Safeguards Regulations (SOR/2018-64)", "jurisdiction": "federal", "sector": "private", "status": "in-force", "inForceDate": "2018-11-01", "appliesTo": "Private-sector organizations that collect, use or disclose personal information in the course of commercial activity anywhere in Canada, federal works, undertakings and businesses (banks, telecoms, airlines, inter-provincial transport) and their employee data, and organizations in provinces without substantially similar private-sector law (every province except BC, Alberta and Quebec; health custodians in Ontario, NB, NS and NL are also substantially similar for health information).", "triggerStandard": "real risk of significant harm", "triggerExplainer": "A breach of security safeguards must be reported and individuals notified if it is reasonable in the circumstances to believe the breach creates a real risk of significant harm to an individual. Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property (s. 10.1(7)). Factors: sensitivity of the information, probability of misuse, and any other prescribed factor (s. 10.1(8)).", "notifications": [ { "to": "regulator", "recipientName": "Office of the Privacy Commissioner of Canada (OPC)", "mandatory": true, "deadlineText": "as soon as feasible after the organization determines that the breach has occurred", "deadlineHours": null, "deadlineNotes": "No fixed hour or day count in the statute or regulations. Report contents prescribed by SOR/2018-64 s. 2 (circumstances and cause, date or period, personal information involved, number of individuals, mitigation steps, steps to notify individuals, contact person).", "method": "OPC secure online portal (request an access link at https://services.priv.gc.ca/atteinte-breach-lprpde-pipeda/en/register) or upload the PDF form https://www.priv.gc.ca/media/4844/pipeda_pb_form_e.pdf through the same portal; any format is accepted if it captures the prescribed information.", "url": "https://www.priv.gc.ca/en/report-a-concern/report-a-privacy-breach-at-your-organization/report-a-privacy-breach-at-your-business/" }, { "to": "individuals", "recipientName": "Each affected individual", "mandatory": true, "deadlineText": "as soon as feasible after the organization determines that the breach has occurred", "deadlineHours": null, "deadlineNotes": "Notice must be conspicuous and given directly, except where indirect notice is permitted by regulation. Contents prescribed by SOR/2018-64 s. 3. Not required where prohibited by law.", "method": "Direct notice (email, letter, phone, in person) or indirect (public communication) in prescribed circumstances.", "url": "https://laws-lois.justice.gc.ca/eng/acts/P-8.6/section-10.1.html" }, { "to": "other-organizations", "recipientName": "Other organizations or government institutions that may be able to reduce or mitigate the harm (e.g., banks, credit bureaus, police)", "mandatory": true, "deadlineText": "as soon as feasible after the organization determines that the breach has occurred", "deadlineHours": null, "deadlineNotes": "Duty under s. 10.2 arises whenever individuals must be notified.", "method": "Direct contact.", "url": "https://laws-lois.justice.gc.ca/eng/acts/P-8.6/page-3.html" } ], "recordKeeping": "Keep a record of every breach of security safeguards (whether or not it met the RROSH threshold) for 24 months after the day the organization determines the breach occurred (SOR/2018-64 s. 6); provide records to the OPC on request (s. 10.3(2)).", "penalties": "Knowingly contravening s. 10.1 or s. 10.3(1): fine up to $10,000 on summary conviction or up to $100,000 on indictment (s. 28).", "sources": [ { "title": "PIPEDA s. 10.1 (Justice Laws)", "url": "https://laws-lois.justice.gc.ca/eng/acts/P-8.6/section-10.1.html", "section": "s. 10.1", "accessed": "2026-10-29" }, { "title": "PIPEDA ss. 10.2, 10.3 (Justice Laws, page 3)", "url": "https://laws-lois.justice.gc.ca/eng/acts/P-8.6/page-3.html", "section": "ss. 10.2-10.3", "accessed": "2026-10-29" }, { "title": "PIPEDA full text, s. 28 offence", "url": "https://laws-lois.justice.gc.ca/eng/acts/P-8.6/FullText.html", "section": "s. 28", "accessed": "2026-10-29" }, { "title": "Breach of Security Safeguards Regulations SOR/2018-64", "url": "https://laws-lois.justice.gc.ca/eng/regulations/SOR-2018-64/page-1.html", "section": "ss. 2, 3, 6", "accessed": "2026-10-29" }, { "title": "OPC: Report a privacy breach at your business", "url": "https://www.priv.gc.ca/en/report-a-concern/report-a-privacy-breach-at-your-organization/report-a-privacy-breach-at-your-business/", "accessed": "2026-10-29" }, { "title": "DLA Piper: Canada tables Bill C-36, the Protecting Privacy and Consumer Data Act (June 17, 2026)", "url": "https://www.dlapiper.com/en-us/insights/publications/2026/06/canada-tables-bill-c36-the-protecting-privacy-and-consumer-data-act", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "Bill C-27 (Consumer Privacy Protection Act) died on the Order Paper in January 2025. Bill C-36, the Protecting Privacy and Consumer Data Act, was tabled and received first reading on June 15, 2026; it would replace Part 1 of PIPEDA and carries the breach reporting duties forward, but it is not law. As of October 2026 PIPEDA remains the governing federal private-sector law (Justice Laws consolidation current to 2026-09-30). Organizations in Alberta, BC and Quebec must also apply provincial law; PIPEDA still applies to their federally regulated activities and inter-provincial/international flows." }, { "id": "privacy-act-tbs", "name": "Privacy Act / TBS Directive on Privacy Practices", "fullName": "Privacy Act (R.S.C. 1985, c. P-21) and Treasury Board Directive on Privacy Practices, Appendix B (Mandatory Procedures for Privacy Breaches)", "jurisdiction": "federal", "sector": "federal-government", "status": "in-force", "inForceDate": null, "appliesTo": "Federal government institutions subject to the Privacy Act (departments, agencies, Crown corporations listed in the schedule).", "triggerStandard": "material privacy breach", "triggerExplainer": "The Privacy Act itself contains no breach provision; the duty comes from Treasury Board policy. A material privacy breach is one involving sensitive personal information that could reasonably be expected to cause serious injury or harm to the individual and/or involves a large number of affected individuals. Institutions must contain, assess and mitigate, then report material breaches.", "notifications": [ { "to": "regulator", "recipientName": "Office of the Privacy Commissioner of Canada (OPC) and Treasury Board of Canada Secretariat (TBS)", "mandatory": true, "deadlineText": "no later than seven days after the institution determines that a breach is material", "deadlineHours": 168, "deadlineNotes": "A Treasury Board policy requirement, not a statute. The seven day clock runs from the institution's determination that the breach is material, not from discovery, so a countdown from discovery is the conservative reading. Informal early notice is permitted at any time but does not replace the formal report. The OPC online form submits to both OPC and TBS (Privacy Implementation Notice 2024-02, effective July 8, 2025). Confirmed on canada.ca TBS pages (Breach management Phase 4, updated 2026-03-23); the Directive page itself (tbs-sct.canada.ca) rejects automated requests.", "method": "OPC Privacy Act online breach reporting form https://services.priv.gc.ca/atteinte-breach-lprp-pa/en/register (deemed equivalent to the TBS Privacy Act Material Privacy Breach Report form prescribed in Directive s. B.2.4.5.1).", "url": "https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/access-information-privacy-notices/privacy-implementation-notice-2024-02.html" }, { "to": "individuals", "recipientName": "Affected individuals", "mandatory": true, "deadlineText": "as soon as possible following containment and assessment of the breach (TBS breach management guidance)", "deadlineHours": null, "deadlineNotes": "TBS breach management guidance: for a material privacy breach, senior officials must ensure affected individuals are notified, directly where possible. Notice may be withheld where it would be inappropriate for security, confidentiality, legal or other reasons, and the institution must then justify that decision to the OPC and TBS.", "method": "Direct notice.", "url": "https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/privacy/privacy-policies-guidance/breach-management/phase-3.html" } ], "recordKeeping": "Institutions must document every privacy breach, including non-material ones, as part of breach management, and report breach statistics in their annual reports to Parliament.", "penalties": "No statutory penalty for failure to report; non-compliance is a policy breach subject to TBS consequences under the Policy on Privacy Protection.", "sources": [ { "title": "TBS Breach management Phase 4: Report and prevent another breach", "url": "https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/privacy/privacy-policies-guidance/breach-management/phase-4.html", "accessed": "2026-10-29" }, { "title": "TBS Privacy Implementation Notice 2024-02", "url": "https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/access-information-privacy-notices/privacy-implementation-notice-2024-02.html", "section": "Directive App. B, s. B.2.4.5.1", "accessed": "2026-10-29" }, { "title": "TBS Breach management Phase 3: Notify affected individuals", "url": "https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/privacy/privacy-policies-guidance/breach-management/phase-3.html", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "The seven day timeline for reporting a material privacy breach to the OPC and TBS is set out in the Treasury Board Directive on Privacy Practices (Appendix B) and restated in TBS breach management guidance and Privacy Implementation Notice 2024-02. The Directive is policy, not statute, and is updated by TBS without legislative process, so confirm the current version on the TBS site when reporting." }, { "id": "ccspa", "name": "CCSPA (Bill C-8)", "fullName": "Critical Cyber Systems Protection Act, S.C. 2026, c. 9, s. 11 (enacted by Bill C-8, An Act respecting cyber security)", "jurisdiction": "federal", "sector": "critical-infrastructure", "status": "not-yet-in-force", "inForceDate": null, "appliesTo": "Designated operators in federally regulated vital services and systems (telecommunications, interprovincial/international pipelines and power lines, nuclear, transportation, banking, clearing and settlement) once classes of operators are designated by regulation and listed in Schedule 2.", "triggerStandard": "cyber security incident affecting a critical cyber system", "triggerExplainer": "A designated operator must report any cyber security incident in respect of any of its critical cyber systems. The threshold definition (interference with continuity or security of a vital service/system, or confidentiality, integrity or availability of the critical cyber system) will be refined by regulations.", "notifications": [ { "to": "government-body", "recipientName": "Communications Security Establishment (Canadian Centre for Cyber Security)", "mandatory": true, "deadlineText": "within a period prescribed by the regulations, not to exceed 72 hours", "deadlineHours": 72, "deadlineNotes": "Section 17 reads 'within a period prescribed by the regulations, not to exceed 72 hours'. 72 hours is the statutory ceiling; the actual deadline will be set by regulation. Section 17 is not yet in force. The Act does not say 'immediately' for the CSE report.", "method": "Form and manner to be prescribed by regulation; expected to be via the Cyber Centre's incident reporting channel.", "url": "https://laws-lois.justice.gc.ca/eng/acts/C-47.4/FullText.html" }, { "to": "regulator", "recipientName": "The operator's appropriate regulator (Minister of Industry, Minister of Transport, OSFI, Bank of Canada, Canada Energy Regulator or Canadian Nuclear Safety Commission)", "mandatory": true, "deadlineText": "Immediately after reporting a cyber security incident", "deadlineHours": null, "deadlineNotes": "s. 18: notify the regulator that the report was made and provide a copy.", "method": "Form and manner to be prescribed.", "url": "https://laws-lois.justice.gc.ca/eng/acts/C-47.4/FullText.html" } ], "recordKeeping": "s. 30: keep records of program implementation, every reported incident, supply-chain mitigation and directive compliance; records must be kept in Canada; period and manner set by the regulator unless regulations provide otherwise.", "penalties": "Administrative monetary penalties of up to $500,000 for an individual and $15,000,000 in any other case per violation (s. 91), each day a separate violation (s. 94); directors and officers who directed or acquiesced in a violation are parties to it (s. 93); contravening s. 17 or 18 is an offence (s. 136). Fine amounts for offences are set in ss. 136 and 137.", "sources": [ { "title": "Critical Cyber Systems Protection Act, full text (Justice Laws)", "url": "https://laws-lois.justice.gc.ca/eng/acts/C-47.4/FullText.html", "section": "ss. 9, 17, 18, 30, 91", "accessed": "2026-10-29" }, { "title": "CCSPA page 11 (offences)", "url": "https://laws-lois.justice.gc.ca/eng/acts/C-47.4/page-11.html", "section": "ss. 136-137", "accessed": "2026-10-29" }, { "title": "Bill C-8 Royal Assent text (Parliament of Canada)", "url": "https://www.parl.ca/documentviewer/en/45-1/bill/C-8/royal-assent", "section": "Part 2", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "Royal Assent June 15, 2026 (S.C. 2026, c. 9). The Act comes into force by order in council. As of the Justice Laws consolidation current to September 30, 2026, every provision, including the s. 17 reporting duty, is marked not in force, and no order in council, regulations or designated classes of operators had been published. Prepare for a reporting window of at most 72 hours once regulations set it. Part 1 of Bill C-8 (Telecommunications Act amendments) is a separate regime." }, { "id": "osfi-incident", "name": "OSFI Incident Reporting Advisory", "fullName": "OSFI Technology and Cyber Security Incident Reporting Advisory (August 2021) and OSFI technology and cyber incident report detailed instructions (2025)", "jurisdiction": "federal", "sector": "financial", "status": "in-force", "inForceDate": "2021-08-13", "appliesTo": "Federally regulated financial institutions (banks, foreign bank branches, federal credit unions, life and P&C insurers, trust and loan companies). Administrators of federally regulated private pension plans have a separate OSFI advisory (2023) with the same 24-hour window, reported to pensions@osfi-bsif.gc.ca.", "triggerStandard": "technology or cyber security incident meeting any one of OSFI's reportable-incident criteria", "triggerExplainer": "Reportable if the incident has any one or more listed characteristics, including impact on operations, systems or data (including customer information), business disruption, DR activation, third-party impact, reporting to the Board or senior management, reporting to the Privacy Commissioner or other regulators or law enforcement, a cyber insurance claim, high/critical severity rating, or breach of internal risk appetite. OSFI encourages reporting when unsure.", "notifications": [ { "to": "regulator", "recipientName": "OSFI Technology Risk Division and the institution's Lead Supervisor", "mandatory": true, "deadlineText": "within 24 hours, or sooner if possible", "deadlineHours": 24, "deadlineNotes": "Supervisory expectation under an Advisory (not a statute), effective August 13, 2021; replaced the January 2019 advisory's 72-hour window. The Advisory does not state the event that starts the 24 hours; the incident report form asks for both occurrence and detection times, so treat the clock as running from detection. Situation updates required until resolved. Failure to report may result in increased supervisory oversight, watch-listing or staging.", "method": "Email the completed OSFI technology and cyber incident report to TRD-DRT@osfi-bsif.gc.ca, copying the Lead Supervisor.", "url": "https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/osfi-technology-cyber-incident-report-detailed-instructions" } ], "recordKeeping": "Not specified in the Advisory beyond the incident report and follow-up reporting; general record expectations under Guideline B-13.", "penalties": "No fines; non-compliance can lead to enhanced monitoring, watch-listing or staging under OSFI's supervisory framework.", "sources": [ { "title": "OSFI Technology and Cyber Security Incident Reporting Advisory", "url": "https://osfi-bsif.gc.ca/Eng/fi-if/rg-ro/gdn-ort/adv-prv/Pages/TCSIR.aspx", "section": "Reporting requirements", "accessed": "2026-10-29" }, { "title": "OSFI technology and cyber incident report, detailed instructions", "url": "https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/osfi-technology-cyber-incident-report-detailed-instructions", "accessed": "2026-10-29" }, { "title": "OSFI news release: updated requirements", "url": "https://www.osfi-bsif.gc.ca/en/news/osfi-issues-updated-requirements-technology-cyber-incident-reporting", "accessed": "2026-10-29" }, { "title": "OSFI: Technology and cyber security incident reporting for federally regulated private pension plans", "url": "https://www.osfi-bsif.gc.ca/en/supervision/pensions/administering-pension-plans/guidance-topic/technology-cyber-security-incident-reporting", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "The Advisory has been in effect since August 13, 2021. Pension plan administrators: OSFI advisory 'Technology and cyber security incident reporting' (pensions page issued 2024-02-28) says to send the Incident Report within 24 hours of discovering an incident. Provincially regulated credit unions report to their provincial regulator (e.g., BCFSA, FSRA) under provincial rules, not to OSFI; those are out of scope here." }, { "id": "ciro-incident", "name": "CIRO Rule 3703", "fullName": "CIRO Investment Dealer and Partially Consolidated Rules, s. 3703 (cybersecurity incident reporting; formerly IIROC Dealer Member Rule 3100(1)(B)1.1)", "jurisdiction": "federal", "sector": "securities", "status": "in-force", "inForceDate": "2019-11-14", "appliesTo": "CIRO investment dealer members. Mutual fund dealer members should confirm whether an equivalent reporting rule applies to them.", "triggerStandard": "cybersecurity incident", "triggerExplainer": "Any act to gain unauthorized access to, disrupt or misuse a Dealer's information system or information stored on it that results in, or is reasonably likely to result in, substantial harm to any person, a material impact on normal operations, invocation of the BCP/DR plan, or a notice requirement under other regulatory obligations.", "notifications": [ { "to": "regulator", "recipientName": "CIRO (via the Dealer's FinOps relationship manager)", "mandatory": true, "deadlineText": "within three days of discovery of the cybersecurity incident", "deadlineHours": 72, "deadlineNotes": "Initial report. CIRO FAQ uses 'three calendar days following discovery'. Contents: description, discovery date and occurrence period, preliminary risk assessment, immediate response, contact.", "method": "Contact the FinOps relationship manager; CIRO generally arranges a same-day meeting.", "url": "https://www.ciro.ca/node/10897" }, { "to": "regulator", "recipientName": "CIRO", "mandatory": true, "deadlineText": "an incident investigation report within 30 days of discovery of the cybersecurity incident", "deadlineHours": 720, "deadlineNotes": "Detailed report: cause, scope (systems, client data, costs), mitigation and remediation, preparedness improvements. Extensions on request to the FinOps relationship manager.", "method": "Written report to CIRO.", "url": "https://www.ciro.ca/node/10904" } ], "recordKeeping": "Reporting and recordkeeping requirements in Rule 3700 series; no breach-specific retention period stated.", "penalties": "CIRO disciplinary sanctions (fines, suspension) under the enforcement rules.", "sources": [ { "title": "CIRO/IIROC Notice: Amendments Respecting Mandatory Reporting of Cybersecurity Incidents", "url": "https://www.ciro.ca/node/10904", "section": "s. 3703", "accessed": "2026-10-29" }, { "title": "CIRO FAQ: Mandatory Cybersecurity Incident Reporting", "url": "https://www.ciro.ca/node/10897", "accessed": "2026-10-29" }, { "title": "CIRO Incident Reporting Summary", "url": "https://www.ciro.ca/firms/educational-resources/cybersecurity-technology/incident-reporting-summary", "accessed": "2026-10-29" }, { "title": "IIROC Notice 19-0194 (OSC-hosted PDF, November 14, 2019)", "url": "https://www.osc.ca/sites/default/files/2020-12/iiroc_20191114_iiroc-notice-amendments-respecting-mandatory-reporting_0.pdf", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "IIROC Notice 19-0194 (November 14, 2019) brought the amendments into force immediately. CIRO's FAQ describes the initial deadline as three calendar days following discovery. The rule applies to investment dealer members; mutual fund dealer members should confirm their own reporting obligations with CIRO." }, { "id": "csa-disclosure", "name": "CSA continuous disclosure", "fullName": "CSA Multilateral Staff Notice 51-347 Disclosure of cyber security risks and incidents (Jan 19, 2017) applied under NI 51-102 Continuous Disclosure Obligations and NP 51-201", "jurisdiction": "federal", "sector": "securities", "status": "in-force", "inForceDate": "2017-01-19", "appliesTo": "Reporting issuers (public companies) in Canadian jurisdictions.", "triggerStandard": "material fact or material change", "triggerExplainer": "No bright-line test. An issuer must assess whether a cyber incident (or a series of minor incidents) is a material fact or material change, assessing materiality throughout detection, assessment and remediation. Disclosure controls (NI 52-109) should capture detected incidents so management can decide on timely reporting.", "notifications": [ { "to": "regulator", "recipientName": "Securities regulators and the market (news release and material change report filed on SEDAR+)", "mandatory": true, "deadlineText": "news release immediately on a material change; material change report as soon as practicable and in any event within 10 days (NI 51-102 s. 7.1)", "deadlineHours": null, "deadlineNotes": "NI 51-102 s. 7.1 sets the general material change timing (news release immediately, material change report within 10 days); CSA Staff Notice 51-347 sets no cyber specific deadline. Provincial securities acts use 'forthwith' for the same duty. Whether a cyber incident is a material change is a judgment for the issuer and its counsel.", "method": "News release and Form 51-102F3 material change report via SEDAR+; risk-factor and MD&A disclosure in periodic filings.", "url": "https://www.osc.ca/node/309201" } ], "recordKeeping": "Disclosure controls and procedures records under NI 52-109.", "penalties": "Securities-law enforcement (administrative penalties, cease-trade orders, quasi-criminal prosecution) under provincial securities acts.", "sources": [ { "title": "CSA Multilateral Staff Notice 51-347 (OSC)", "url": "https://www.osc.ca/node/309201", "accessed": "2026-10-29" }, { "title": "MLT Aikins: Cybersecurity guidance for public companies in Canada and the U.S.", "url": "https://www.mltaikins.com/insights/cybersecurity-guidance-for-public-companies-in-canada-and-the-u-s/", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "Searches found no CSA rule proposal for a dedicated cyber-incident disclosure instrument as of October 2026 (the SEC has one; Canada relies on general materiality). CSA Staff Notice 11-332 (2016) covers cyber security generally." }, { "id": "ab-pipa", "name": "Alberta PIPA", "fullName": "Personal Information Protection Act, S.A. 2003, c. P-6.5, ss. 34.1 and 37.1", "jurisdiction": "AB", "sector": "private", "status": "in-force", "inForceDate": "2010-05-01", "appliesTo": "Private-sector organizations in Alberta (businesses, non-profits in commercial activity, professional regulatory organizations) with personal information under their control.", "triggerStandard": "real risk of significant harm", "triggerExplainer": "Where a reasonable person would consider that there exists a real risk of significant harm to an individual as a result of the loss of or unauthorized access to or disclosure of personal information. Assessed on sensitivity, probability of misuse, malicious intent and mitigating measures.", "notifications": [ { "to": "regulator", "recipientName": "Office of the Information and Privacy Commissioner of Alberta", "mandatory": true, "deadlineText": "without unreasonable delay", "deadlineHours": null, "deadlineNotes": "s. 34.1(1). The Commissioner then decides whether individuals must be notified.", "method": "OIPC online PIPA Privacy Breach Notification Form (replaces the former Notice of Loss form)", "url": "https://forms.oipc.ab.ca/pipa-privacy-breach-notification-form/" }, { "to": "individuals", "recipientName": "Affected individuals", "mandatory": false, "deadlineText": "as required by the Commissioner under s. 37.1", "deadlineHours": null, "deadlineNotes": "Individual notification is mandatory only when the Commissioner requires it (s. 37.1); organizations may notify on their own initiative and should follow PIPA Regulation s. 19.1 content requirements.", "method": "Direct notice per PIPA Regulation s. 19.1.", "url": "https://oipc.ab.ca/breach-notification/" } ], "recordKeeping": "No statutory breach register; OIPC expects documentation of the incident and assessment.", "penalties": "Offence fines of up to $10,000 for an individual and up to $100,000 for a person other than an individual (PIPA s. 59).", "sources": [ { "title": "OIPC Alberta: Breach Notification Requirements", "url": "https://oipc.ab.ca/breach-notification/", "section": "PIPA s. 34.1, s. 37.1", "accessed": "2026-10-29" }, { "title": "OIPC Alberta PIPA Privacy Breach Notification Form", "url": "https://forms.oipc.ab.ca/pipa-privacy-breach-notification-form/", "accessed": "2026-10-29" }, { "title": "Government of Alberta: Organization responsibilities for protecting personal information (PIPA fines)", "url": "https://www.alberta.ca/organization-responsibilities-for-protecting-personal-information.aspx", "section": "s. 59", "accessed": "2026-10-29" }, { "title": "OIPC Alberta: Changes to PIPA take effect May 1, 2010 (breach notification)", "url": "https://oipc.ab.ca/pipa-amendments-2/", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "Mandatory breach reporting in force May 1, 2010 (OIPC Alberta). The Alberta legislature's 2025 PIPA review produced recommendations; no amending bill had been introduced as of September 2026 (secondary source) and none was found on October 29, 2026." }, { "id": "qc-law25", "name": "Quebec Law 25 (private sector)", "fullName": "Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, ss. 3.5 to 3.8, and the Regulation respecting confidentiality incidents (CQLR c. A-2.1, r. 3.1)", "jurisdiction": "QC", "sector": "private", "status": "in-force", "inForceDate": "2022-09-22", "appliesTo": "Any enterprise (person carrying on an enterprise) that collects, holds, uses or communicates personal information in Quebec, including out-of-province organizations handling Quebec residents' data.", "triggerStandard": "risk of serious injury", "triggerExplainer": "A confidentiality incident is access, use or communication not authorized by law, or loss or any other breach of protection (s. 3.6). If the incident presents a risk of serious injury, the Commission and affected persons must be notified. Assess sensitivity of the information, anticipated consequences of its use and likelihood of use for injurious purposes, and consult the person in charge of personal information protection (s. 3.7).", "notifications": [ { "to": "regulator", "recipientName": "Commission d'accès à l'information du Québec (CAI)", "mandatory": true, "deadlineText": "promptly (avec diligence)", "deadlineHours": null, "deadlineNotes": "s. 3.5. Notice in writing with the eleven items listed in the Regulation (ss. 3-4); send newly discovered information promptly afterwards.", "method": "Declare the incident to the CAI using its online confidentiality incident declaration form, available from the CAI website (cai.gouv.qc.ca).", "url": "https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1" }, { "to": "individuals", "recipientName": "Persons concerned", "mandatory": true, "deadlineText": "promptly (avec diligence)", "deadlineHours": null, "deadlineNotes": "May be deferred while notice could hamper a criminal investigation. Contents per Regulation ss. 5-6; public notice permitted where direct notice could increase harm, cause undue hardship or contact details are unavailable.", "method": "Direct notice or public notice in permitted cases.", "url": "https://www.legisquebec.gouv.qc.ca/fr/document/rc/A-2.1,%20r.%203.1" } ], "recordKeeping": "Keep a register of every confidentiality incident (including those without serious injury) with the eight prescribed categories; keep each entry up to date and retain it for at least five years after the enterprise became aware of the incident; provide a copy to the CAI on request (s. 3.8; Regulation ss. 7-8).", "penalties": "Monetary administrative penalties of up to $50,000 for a natural person and, in all other cases, $10,000,000 or 2% of worldwide turnover for the preceding fiscal year, whichever is greater (s. 90.12); penal fines of $5,000 to $100,000 for a natural person and $15,000 to $25,000,000 or 4% of worldwide turnover, whichever is greater, in all other cases (s. 91), doubled for a subsequent offence (s. 92.1).", "sources": [ { "title": "Act respecting the protection of personal information in the private sector (Légis Québec, EN)", "url": "https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1", "section": "ss. 3.5-3.8", "accessed": "2026-10-29" }, { "title": "Regulation respecting confidentiality incidents (Légis Québec, FR)", "url": "https://www.legisquebec.gouv.qc.ca/fr/document/rc/A-2.1,%20r.%203.1", "section": "ss. 1-8", "accessed": "2026-10-29" }, { "title": "Act respecting the protection of personal information in the private sector (Legis Quebec PDF)", "url": "https://www.legisquebec.gouv.qc.ca/en/pdf/cs/P-39.1.pdf", "section": "ss. 90.12, 91, 92.1, 93", "accessed": "2026-10-29" }, { "title": "AMF: Information security incident management (regulation in force April 23, 2025)", "url": "https://lautorite.qc.ca/en/professionals/insurers/information-security-incident-management", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "Confidentiality-incident duties in force since September 22, 2022; the Regulation (O.C. 1761-2022) applied from late December 2022. Statutory wording is 'promptly' (EN) / 'avec diligence' (FR). Quebec financial institutions and credit assessment agents regulated by the AMF have a separate duty: the Regulation respecting the management and reporting of information security incidents by certain financial institutions and by credit assessment agents has been in force since April 23, 2025 and requires a report to the AMF via E-Services no later than 24 hours from the time an officer (or manager) is informed, with updates every three days." }, { "id": "bc-pipa", "name": "BC PIPA", "fullName": "Personal Information Protection Act, S.B.C. 2003, c. 63", "jurisdiction": "BC", "sector": "private", "status": "voluntary", "inForceDate": "2004-01-01", "appliesTo": "Private-sector organizations in British Columbia (businesses, non-profits, private clinics and other health practitioners not covered by FIPPA).", "triggerStandard": "none in statute; OIPC recommends reporting where significant harm is reasonably possible", "triggerExplainer": "PIPA contains no mandatory breach notification or reporting provision. The OIPC strongly recommends, as best practice, notifying affected individuals and reporting to the OIPC where a breach could reasonably be expected to result in significant harm; it has publicly called for the law to be amended.", "notifications": [ { "to": "regulator", "recipientName": "Office of the Information and Privacy Commissioner for BC (voluntary)", "mandatory": false, "deadlineText": "as soon as possible (OIPC guidance)", "deadlineHours": null, "deadlineNotes": "Voluntary. Organizations may use the same online breach report form as public bodies, or email info@oipc.bc.ca.", "method": "OIPC online privacy breach report form", "url": "https://oipc.bc.ca/forms/public-bodies/online-privacy-breach-report-form/" }, { "to": "individuals", "recipientName": "Affected individuals (voluntary)", "mandatory": false, "deadlineText": "OIPC best practice: notify without delay where significant harm is possible", "deadlineHours": null, "deadlineNotes": "Not a statutory duty; PIPEDA may apply instead for federal works or inter-provincial/international data flows.", "method": "Direct notice.", "url": "https://oipc.bc.ca/resources/breach-notification-representatives-of-organizations-and-public-bodies/" } ], "recordKeeping": "No statutory requirement; OIPC recommends documenting breaches.", "penalties": "PIPA s. 56 creates offences punishable by fine; there is no offence for failing to notify because there is no statutory duty to notify. Fine amounts are set in s. 56 of the Act.", "sources": [ { "title": "OIPC BC: Breach notification for representatives of organizations and public bodies", "url": "https://oipc.bc.ca/resources/breach-notification-representatives-of-organizations-and-public-bodies/", "accessed": "2026-10-29" }, { "title": "OIPC BC online privacy breach report form", "url": "https://oipc.bc.ca/forms/public-bodies/online-privacy-breach-report-form/", "accessed": "2026-10-29" }, { "title": "McCarthy Tetrault: 2026 Data Breach Insights Part 3 (May 7, 2026)", "url": "https://www.mccarthy.ca/en/insights/publications/navigating-the-legislative-landscape-on-data-breaches-2026-data-breach-insights-part-3", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "No PIPA reform bill had been introduced as of October 2026 (McCarthy Tetrault, May 2026, confirms private-sector organizations in BC are not subject to mandatory breach reporting or notification; a September 2026 secondary review found no bill). Beware secondary sites that claim individual notification is mandatory under BC PIPA; the statute contains no such duty. BC Bill 9 (2026) amends FIPPA (public sector) and contains no private-sector breach duty; the 2021 Special Committee recommended mandatory PIPA breach notification but it has not been legislated." }, { "id": "bc-fippa", "name": "BC FIPPA s. 36.3", "fullName": "Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165, s. 36.3", "jurisdiction": "BC", "sector": "public", "status": "in-force", "inForceDate": "2023-02-01", "appliesTo": "BC public bodies: ministries, Crown corporations, health authorities, universities, colleges, school boards, municipalities, police boards and other bodies listed in the Act.", "triggerStandard": "could reasonably be expected to result in significant harm", "triggerExplainer": "A privacy breach (theft or loss, or unauthorized collection, use or disclosure of personal information in the public body's custody or control) that could reasonably be expected to result in significant harm, including identity theft, significant bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, negative impact on a credit record, or damage to or loss of property.", "notifications": [ { "to": "individuals", "recipientName": "Affected individuals", "mandatory": true, "deadlineText": "without unreasonable delay", "deadlineHours": null, "deadlineNotes": "s. 36.3(2)(a). Exception where notice could cause immediate and grave harm to the individual's safety or health, or threaten another individual's safety or health (s. 36.3(3)).", "method": "Direct notice in the prescribed manner (FIPPA Regulation).", "url": "https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/96165_03" }, { "to": "regulator", "recipientName": "Office of the Information and Privacy Commissioner for BC", "mandatory": true, "deadlineText": "without unreasonable delay", "deadlineHours": null, "deadlineNotes": "s. 36.3(2)(b). The OIPC form asks for submission as soon as possible; a file is opened with contact details and a summary, with 'tbd' fields allowed.", "method": "OIPC online privacy breach report form, or email the privacy breach checklist to info@oipc.bc.ca", "url": "https://oipc.bc.ca/forms/public-bodies/online-privacy-breach-report-form/" } ], "recordKeeping": "Privacy management program requirements (s. 36.2) require documented breach processes; no fixed retention period in s. 36.3.", "penalties": "FIPPA ss. 65.2 to 65.6 (added by Bill 22, 2021; the former ss. 74 and 74.1 are repealed): wilful unauthorized collection, use or disclosure and related offences carry fines of up to $50,000 for an individual or service provider and up to $500,000 for a corporation (s. 65.6). No specific offence for failing to notify under s. 36.3.", "sources": [ { "title": "FIPPA s. 36.3 (BC Laws)", "url": "https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/96165_03", "section": "s. 36.3", "accessed": "2026-10-29" }, { "title": "OIPC BC online privacy breach report form", "url": "https://oipc.bc.ca/forms/public-bodies/online-privacy-breach-report-form/", "accessed": "2026-10-29" }, { "title": "FIPPA Part 5 Division 3, offences and penalties (BC Laws)", "url": "https://www.bclaws.gov.bc.ca/civix/document/id/lc/statreg/96165_05a", "section": "ss. 65.2-65.6", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "Section 36.3 was added by Bill 22 (2021) and the duty has applied since February 1, 2023. Bill 9 (2026) proposes further FIPPA amendments but does not change s. 36.3; check its status before relying on any new provision." }, { "id": "ab-popa", "name": "Alberta POPA", "fullName": "Protection of Privacy Act, S.A. 2024, c. P-30.5, s. 10(2)-(3), and the Protection of Privacy (Ministerial) Regulation s. 4", "jurisdiction": "AB", "sector": "public", "status": "in-force", "inForceDate": "2025-06-11", "appliesTo": "Alberta public bodies formerly under FOIP: ministries, agencies, boards, health authorities as public bodies, universities, colleges, school boards, municipalities, police services.", "triggerStandard": "real risk of significant harm", "triggerExplainer": "Where a reasonable person would consider that there exists a real risk of significant harm to an individual from loss of, or unauthorized access to or disclosure of, personal information (or data derived from it). Regulation s. 4(1) factors: reasonable basis to believe the information has been misused, malicious intent, sensitivity, and mitigating measures.", "notifications": [ { "to": "individuals", "recipientName": "Each individual to whom there exists a real risk of significant harm", "mandatory": true, "deadlineText": "without unreasonable delay", "deadlineHours": null, "deadlineNotes": "s. 10(2); notice contents per Regulation s. 4(3).", "method": "Written notice.", "url": "https://www.alberta.ca/system/files/ti-popa-fact-sheet-privacy-incident-motification.pdf" }, { "to": "regulator", "recipientName": "Information and Privacy Commissioner of Alberta", "mandatory": true, "deadlineText": "without unreasonable delay", "deadlineHours": null, "deadlineNotes": "s. 10(2); notice contents per Regulation s. 4(4); must not include affected individuals' personal information.", "method": "OIPC POPA Breach Notification Form (Word)", "url": "https://oipc.ab.ca/wp-content/uploads/2025/06/Form_POPA-Breach_Notification_202509.docx" }, { "to": "government-body", "recipientName": "Minister of Technology and Innovation", "mandatory": true, "deadlineText": "without any unreasonable delay", "deadlineHours": null, "deadlineNotes": "s. 10(2); contents per Regulation s. 4(5).", "method": "Alberta.ca online form 'Report a privacy incident (public bodies)'", "url": "https://www.alberta.ca/index%2Ephp/report-a-privacy-incident-public-bodies" } ], "recordKeeping": "Privacy management program (mandatory from June 11, 2026) must include breach handling and documentation; no fixed statutory retention period identified.", "penalties": "Knowingly contravening Part 1 (personal information): fines of up to $125,000 for an individual and up to $750,000 for an organization (Government of Alberta Bill 33 information sheet, November 2024). The King's Printer text was not opened; confirm the section number in the Act.", "sources": [ { "title": "Government of Alberta fact sheet: POPA Privacy Incident Notifications (June 9, 2025)", "url": "https://www.alberta.ca/system/files/ti-popa-fact-sheet-privacy-incident-motification.pdf", "section": "POPA s. 10(2)-(3); Reg s. 4", "accessed": "2026-10-29" }, { "title": "Alberta.ca: Report a privacy incident (public bodies)", "url": "https://www.alberta.ca/index%2Ephp/report-a-privacy-incident-public-bodies", "accessed": "2026-10-29" }, { "title": "OIPC Alberta: POPA overview (in force June 11, 2025)", "url": "https://oipc.ab.ca/legislation/popa/", "accessed": "2026-10-29" }, { "title": "OIPC Alberta POPA Breach Notification Assessment Tool (June 2025)", "url": "https://oipc.ab.ca/wp-content/uploads/2025/06/POPA_Breach_Notification_Assessment_Tool_202506.pdf", "section": "Reg s. 4(1)", "accessed": "2026-10-29" }, { "title": "Government of Alberta: Protection of Privacy Act fact sheet (penalties and breach notification)", "url": "https://www.alberta.ca/system/files/popa-fact-sheet-protection-of-privacy-act-for-albertans.pdf", "section": "Penalties", "accessed": "2026-10-29" }, { "title": "BLG: Alberta overhauls its public sector access and privacy regime (January 2025)", "url": "https://www.blg.com/en/insights/2025/01/alberta-overhauls-its-public-sector-access-and-privacy-regime", "section": "Penalties and breach reporting", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "POPA replaced FOIP on June 11, 2025 (FOIP had no mandatory breach duty). Privacy management program obligations apply from June 11, 2026. Breaches that began under FOIP should still be reported on the POPA form with a note (OIPC)." }, { "id": "on-fippa", "name": "Ontario FIPPA s. 40.1", "fullName": "Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F.31, ss. 34 and 40.1, as amended by Bill 194 (Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024, Schedule 2)", "jurisdiction": "ON", "sector": "public", "status": "in-force", "inForceDate": "2025-07-01", "appliesTo": "Provincial institutions under FIPPA: ministries, agencies, hospitals, universities, colleges, Ontario Power Generation and other listed bodies. MFIPPA municipal institutions (municipalities, school boards, police boards) are NOT covered by the s. 40.1 duty.", "triggerStandard": "real risk that a significant harm to an individual would result", "triggerExplainer": "Theft, loss or unauthorized use or disclosure of personal information where it is reasonable in the circumstances to believe there is a real risk of significant harm, or other prescribed circumstances. Significant harm includes financial loss, identity theft and damage to reputation; factors include sensitivity, likelihood of misuse, mitigation steps and IPC guidance. In some prescribed cases the institution must report to the IPC but is prohibited from notifying individuals.", "notifications": [ { "to": "regulator", "recipientName": "Information and Privacy Commissioner of Ontario (IPC)", "mandatory": true, "deadlineText": "as soon as feasible after the head determines that the theft, loss or unauthorized use or disclosure occurred", "deadlineHours": null, "deadlineNotes": "s. 40.1 (report in prescribed form and manner).", "method": "IPC 'Report a privacy breach at your organization' form (online submit, or print and send to the Registrar, 1400-2 Bloor Street East, Toronto M4W 1A8)", "url": "https://www.ipc.on.ca/en/resources/forms/report-privacy-breach-your-organization" }, { "to": "individuals", "recipientName": "Affected individuals", "mandatory": true, "deadlineText": "as soon as feasible after the head determines that the theft, loss or unauthorized use or disclosure occurred", "deadlineHours": null, "deadlineNotes": "Unless another law prohibits notification; contents prescribed by regulation.", "method": "Direct notice.", "url": "https://ola.org/en/legislative-business/bills/parliament-43/session-1/bill-194" }, { "to": "regulator", "recipientName": "IPC (annual statistical report)", "mandatory": true, "deadlineText": "by March 31 of the following year", "deadlineHours": null, "deadlineNotes": "s. 34(2)(c.1): annual report must include the number of thefts, losses or unauthorized uses or disclosures recorded under s. 40.1(8). First report (covering July 1 to December 31, 2025) due March 31, 2026; submitted through the IPC statistical reporting portal.", "method": "IPC statistical reporting portal", "url": "https://www.ipc.on.ca/en/node/5047" } ], "recordKeeping": "s. 40.1(8): keep and maintain a record of every theft, loss or unauthorized use or disclosure reported to the IPC (number, type, individuals affected) for annual reporting.", "penalties": "Bill 194 Schedule 2 added no breach-specific fine; the IPC gained binding order powers and a complaint regime .", "sources": [ { "title": "Bill 194 as passed (Legislative Assembly of Ontario)", "url": "https://ola.org/en/legislative-business/bills/parliament-43/session-1/bill-194", "section": "Sch. 2 s. 6 (FIPPA s. 40.1), s. 16 (commencement)", "accessed": "2026-10-29" }, { "title": "IPC FAQ: Schedule 2 of Bill 194 / FIPPA amendments", "url": "https://www.ipc.on.ca/en/node/5061", "accessed": "2026-10-29" }, { "title": "IPC: Annual reporting of privacy breach statistics, provincial institutions", "url": "https://www.ipc.on.ca/en/node/5047", "section": "FIPPA ss. 34, 40.1(8)", "accessed": "2026-10-29" }, { "title": "Lexpert: FIPPA changes have taken effect", "url": "https://www.lexpert.ca/news/technology-law/ontario-freedom-of-information-and-protection-of-privacy-act-changes-have-taken-effect/392932", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "Schedule 2 of Bill 194 (ss. 1 to 14) was proclaimed in force July 1, 2025. Subsection numbering within s. 40.1 follows the Bill text; confirm against the consolidated Act on e-Laws. MFIPPA institutions (municipalities, school boards, police boards) have no statutory breach duty; the IPC recommends they report significant breaches voluntarily." }, { "id": "on-edsta", "name": "Ontario O. Reg. 51/26 (EDSTA)", "fullName": "Ontario Regulation 51/26: Cyber Security, made under the Enhancing Digital Security and Trust Act, 2024 (Bill 194, Schedule 1)", "jurisdiction": "ON", "sector": "public", "status": "in-force", "inForceDate": "2026-07-01", "appliesTo": "Prescribed public sector entities: colleges and universities (as defined in FIPPA), Group A, B and C public hospitals and the University of Ottawa Heart Institute, school boards under the Education Act, and children's aid societies including Indigenous child and family well-being agencies.", "triggerStandard": "critical cyber security incident", "triggerExplainer": "An incident compromising the security, continuity, confidentiality, integrity or availability of digital information the entity collects, uses, retains or discloses, or the infrastructure housing or transmitting it, AND meeting at least one threshold: significant adverse impact on public service delivery, risk to public safety, significant recovery effort or activation of incident response plans, or significant risk of reputational harm/loss of public confidence. Not limited to personal information.", "notifications": [ { "to": "government-body", "recipientName": "Chief Information Security Officer, Ministry of Public and Business Service Delivery and Procurement", "mandatory": true, "deadlineText": "within 72 hours after confirmation of the incident", "deadlineHours": 72, "deadlineNotes": "Clock runs from confirmation that a critical incident occurred, so document the confirmation decision. This is separate from, and in addition to, any FIPPA s. 40.1 or PHIPA report to the IPC.", "method": "Report to the Ministry CISO through the ministry's implementation supports (forms.mgcs.gov.on.ca dataset on00934); entities must also pre-register a primary and alternate cyber security contact with the CISO.", "url": "https://www.ontario.ca/page/enhancing-digital-security-and-trust-act" } ], "recordKeeping": "Maintain a cyber security program; complete a cyber security maturity assessment by July 1, 2027 and every two years, with a summary to the CISO within 30 days of completion.", "penalties": "No fines in the regulation; compliance is enforced through the Minister's directive powers under EDSTA.", "sources": [ { "title": "Ontario.ca: Enhancing Digital Security and Trust Act (regulation summary)", "url": "https://www.ontario.ca/page/enhancing-digital-security-and-trust-act", "section": "O. Reg. 51/26", "accessed": "2026-10-29" }, { "title": "BLG: Ontario introduces cyber and educational technology regulations (April 2026)", "url": "https://www.blg.com/en/insights/2026/04/ontario-introduces-cyber-and-educational-technology-regulations", "accessed": "2026-10-29" }, { "title": "Hicks Morley: obligations in force July 1, 2026", "url": "https://hicksmorley.com/2026/03/25/new-public-sector-cybersecurity-governance-student-digital-information-transparency-obligations-in-force-july-1/", "accessed": "2026-10-29" }, { "title": "Bill 194 (EDSTA regulation-making power s. 2(1)(c)-(d))", "url": "https://ola.org/en/legislative-business/bills/parliament-43/session-1/bill-194", "section": "Sch. 1 s. 2", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "EDSTA was in force January 29, 2025; O. Reg. 51/26 and the companion O. Reg. 52/26 (student digital information notices for school boards) took effect July 1, 2026. Reports go to the Ministry Chief Information Security Officer, not the IPC, and are in addition to any FIPPA s. 40.1 or PHIPA duty. Read the regulation text on e-Laws for the reporting clause and definitions." }, { "id": "qc-access-act", "name": "Quebec Access Act (public sector)", "fullName": "Act respecting Access to documents held by public bodies and the Protection of personal information, CQLR c. A-2.1, ss. 63.8 to 63.11, and the Regulation respecting confidentiality incidents", "jurisdiction": "QC", "sector": "public", "status": "in-force", "inForceDate": "2022-09-22", "appliesTo": "Quebec public bodies: government departments, agencies, municipalities, school service centres, health and social services institutions, universities and colleges.", "triggerStandard": "risk of serious injury", "triggerExplainer": "A confidentiality incident (unauthorized access, use or communication, or loss or other breach, s. 63.9) presenting a risk of serious injury, assessed on sensitivity, anticipated consequences and likelihood of injurious use, after consulting the person in charge of personal information protection (s. 63.10).", "notifications": [ { "to": "regulator", "recipientName": "Commission d'accès à l'information du Québec", "mandatory": true, "deadlineText": "promptly (avec diligence)", "deadlineHours": null, "deadlineNotes": "s. 63.8. Quebec government guidance says notify the CAI as soon as possible even before all facts are gathered and complete the declaration afterwards.", "method": "Declare the incident to the CAI using its online declaration form, available from the CAI website (cai.gouv.qc.ca).", "url": "https://www.legisquebec.gouv.qc.ca/fr/document/lc/A-2.1" }, { "to": "individuals", "recipientName": "Persons concerned", "mandatory": true, "deadlineText": "promptly (avec diligence)", "deadlineHours": null, "deadlineNotes": "May be deferred while notice could hamper a police investigation. The CAI may order notification.", "method": "Direct notice or public notice in permitted cases (Regulation ss. 5-6).", "url": "https://www.quebec.ca/gouvernement/travailler-gouvernement/normes-gouvernance-pratiques-internes/protection-des-renseignements-personnels/incident-de-confidentialite" } ], "recordKeeping": "Register of all confidentiality incidents (s. 63.11), retained at least five years after awareness (Regulation s. 8); copy to the CAI on request.", "penalties": "Public bodies are subject to the Access Act's penal provisions. The monetary administrative penalties in s. 90.12 of the private sector Act apply to enterprises, not public bodies. Amounts are set in the Access Act.", "sources": [ { "title": "Loi sur l'accès (Légis Québec, FR)", "url": "https://www.legisquebec.gouv.qc.ca/fr/document/lc/A-2.1", "section": "ss. 63.8-63.11", "accessed": "2026-10-29" }, { "title": "Québec.ca: Incident de confidentialité (public bodies)", "url": "https://www.quebec.ca/gouvernement/travailler-gouvernement/normes-gouvernance-pratiques-internes/protection-des-renseignements-personnels/incident-de-confidentialite", "accessed": "2026-10-29" }, { "title": "Règlement sur les incidents de confidentialité", "url": "https://www.legisquebec.gouv.qc.ca/fr/document/rc/A-2.1,%20r.%203.1", "section": "ss. 1-8", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "Section numbering: the incident duties are ss. 63.8-63.11 (s. 63.7 is default confidentiality settings), not 63.7-63.10." }, { "id": "sk-foip", "name": "Saskatchewan FOIP / LA FOIP", "fullName": "The Freedom of Information and Protection of Privacy Act, s. 29.1, and The Local Authority Freedom of Information and Protection of Privacy Act, s. 28.1", "jurisdiction": "SK", "sector": "public", "status": "in-force", "inForceDate": "2018-01-01", "appliesTo": "Saskatchewan government institutions (FOIP) and local authorities such as municipalities, school divisions, universities and the Saskatchewan Health Authority (LA FOIP).", "triggerStandard": "real risk of significant harm", "triggerExplainer": "Where it is reasonable in the circumstances to believe that an unauthorized use or disclosure of personal information creates a real risk of significant harm to the individual, the public body must take all reasonable steps to notify that individual (FOIP s. 29.1; LA FOIP s. 28.1). Reporting to the Commissioner is not required by statute.", "notifications": [ { "to": "individuals", "recipientName": "Affected individuals", "mandatory": true, "deadlineText": "take all reasonable steps to notify (no statutory deadline)", "deadlineHours": null, "deadlineNotes": "OIPC guidance: notify as soon as possible after key facts are established.", "method": "Direct notice.", "url": "https://publications.saskatchewan.ca/api/v1/products/527/formats/694/download" }, { "to": "regulator", "recipientName": "Saskatchewan Information and Privacy Commissioner (voluntary)", "mandatory": false, "deadlineText": "proactive reporting encouraged; OIPC asks for its questionnaire within 30 days of a proactive report", "deadlineHours": null, "deadlineNotes": "Not mandatory under FOIP, LA FOIP or HIPA; the OIPC 'always' encourages it and in 2025 recommended trustees adopt policies to notify within ten calendar days of initiating containment.", "method": "OIPC proactive breach report (email/portal) and Privacy Breach Investigation Questionnaire", "url": "https://oipc.sk.ca/assets/privacy-breach-guidelines-for-government-institutions-and-local-authorities.pdf" } ], "recordKeeping": "No statutory register; OIPC guidelines recommend documenting every breach and the response.", "penalties": "FOIP s. 68: fines up to $50,000 and/or one year imprisonment for knowingly collecting, using or disclosing personal information in contravention of the Act; no offence for failing to notify.", "sources": [ { "title": "FOIP (Saskatchewan) consolidated PDF", "url": "https://publications.saskatchewan.ca/api/v1/products/527/formats/694/download", "section": "ss. 29.1, 68", "accessed": "2026-10-29" }, { "title": "OIPC SK Privacy Breach Guidelines for Government Institutions and Local Authorities (May 2023)", "url": "https://oipc.sk.ca/assets/privacy-breach-guidelines-for-government-institutions-and-local-authorities.pdf", "accessed": "2026-10-29" }, { "title": "Government of Saskatchewan news release, December 14, 2017: amendments in force January 1, 2018", "url": "https://www.saskatchewan.ca/government/news-and-media/2017/december/14/access-and-privacy-legislation", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "Section 29.1 was added by S.S. 2017, c. 12 and the FOIP and LA FOIP amendments came into force January 1, 2018. LA FOIP s. 28.1 is the equivalent duty for local authorities (municipalities, school divisions, health authorities); the Commissioner's guidance explains how both are applied." }, { "id": "mb-fippa", "name": "Manitoba FIPPA s. 41.1", "fullName": "The Freedom of Information and Protection of Privacy Act, C.C.S.M. c. F175, s. 41.1 (added by S.M. 2021, c. 43)", "jurisdiction": "MB", "sector": "public", "status": "in-force", "inForceDate": "2022-01-01", "appliesTo": "Manitoba public bodies: departments, Crown agencies, municipalities, school divisions, universities, regional health authorities and other local public bodies.", "triggerStandard": "real risk of significant harm", "triggerExplainer": "A privacy breach (theft or loss, or access, use, disclosure, destruction or alteration in contravention of the Act) that, after considering the factors prescribed by regulation, could reasonably be expected to create a real risk of significant harm to the individual (s. 41.1(2)). The FIPPA Regulation ss. 3.1-3.3 set the risk-assessment factors and notice contents, and permit indirect notice in some cases.", "notifications": [ { "to": "regulator", "recipientName": "Manitoba Ombudsman", "mandatory": true, "deadlineText": "at the time and in the form and manner that the Ombudsman requires (s. 41.1(4))", "deadlineHours": null, "deadlineNotes": "s. 41.1(4): required whenever notice to the individual is required under s. 41.1(2). The Ombudsman's reporting form fulfils the requirement.", "method": "Ombudsman FIPPA and PHIA Privacy Breach Reporting Form (Word) submitted to the Ombudsman; completing it fulfils the reporting requirement.", "url": "https://www.ombudsman.mb.ca/for-public-bodies/report-a-privacy-breach/" }, { "to": "individuals", "recipientName": "Affected individuals", "mandatory": true, "deadlineText": "as soon as practicable after the privacy breach becomes known to the head of the public body (s. 41.1(3)(a))", "deadlineHours": null, "deadlineNotes": "Direct notice unless the regulation permits indirect notice (s. 41.1(3)(c)).", "method": "Direct notice.", "url": "https://gov.mb.ca/fippa/print,amend_detail.html" } ], "recordKeeping": "Not specified in sources reviewed.", "penalties": "FIPPA s. 85 offence provisions apply; amounts are set in the Act.", "sources": [ { "title": "Government of Manitoba: FIPPA Amendments (s. 41.1 breach notification, in force Jan 1, 2022)", "url": "https://gov.mb.ca/fippa/print,amend_detail.html", "section": "s. 41.1; Reg ss. 3.1-3.3", "accessed": "2026-10-29" }, { "title": "Manitoba Ombudsman: Report a Privacy Breach", "url": "https://www.ombudsman.mb.ca/for-public-bodies/report-a-privacy-breach/", "accessed": "2026-10-29" }, { "title": "S.M. 2021, c. 43 (FIPPA amendments, s. 41.1 text)", "url": "https://web2.gov.mb.ca/laws/statutes/2021/c04321e.php", "section": "s. 41.1", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "Section 41.1 was added by S.M. 2021, c. 43 and has been in force since January 1, 2022. Before 2022 reporting to the Ombudsman was voluntary, and some older Ombudsman pages still describe the voluntary regime." }, { "id": "ns-foipop", "name": "Nova Scotia FOIPOP / PIIDPA", "fullName": "Freedom of Information and Protection of Privacy Act, S.N.S. 1993, c. 5 (current), Personal Information International Disclosure Protection Act, S.N.S. 2006, c. 3, and the new Freedom of Information and Protection of Privacy Act (Bill 150, 2025)", "jurisdiction": "NS", "sector": "public", "status": "voluntary", "inForceDate": null, "appliesTo": "Nova Scotia public bodies (departments, agencies, municipalities under Part XX of the MGA, school boards, universities, health authorities) and, for PIIDPA, their service providers.", "triggerStandard": "none under current FOIPOP; PIIDPA: foreign demand for disclosure (or unauthorized disclosure in response to one); new Act (April 1, 2027): real risk of significant harm", "triggerExplainer": "The current FOIPOP Act has no breach notification duty; reporting to the Information and Privacy Commissioner is voluntary. PIIDPA s. 6(1) requires a public body, its employees and service providers to immediately notify the Minister of Justice when they receive a foreign demand for disclosure, receive a request they know or suspect is made to answer one, or have reason to suspect an unauthorized disclosure has occurred in response to a foreign demand; it does not cover unauthorized disclosures generally. The new Freedom of Information and Protection of Privacy Act (Bill 150, S.N.S. 2025, c. 13, Royal Assent October 3, 2025, in force April 1, 2027) will require notifying affected individuals and the Commissioner where a breach poses a real risk of significant harm; details depend on regulations.", "notifications": [ { "to": "government-body", "recipientName": "Minister of Justice (PIIDPA)", "mandatory": true, "deadlineText": "immediately notify the Minister", "deadlineHours": null, "deadlineNotes": "PIIDPA s. 6(1) applies only to foreign demands for disclosure, requests suspected to be made to answer one, and suspected unauthorized disclosures made in response to a foreign demand.", "method": "Written notice to the Minister (Information Access and Privacy Services).", "url": "https://nslegislature.ca/sites/default/files/legc/PDFs/annual%20statutes/2006/c003.pdf" }, { "to": "regulator", "recipientName": "Nova Scotia Information and Privacy Commissioner (voluntary until the new Act is in force)", "mandatory": false, "deadlineText": "no statutory deadline; voluntary", "deadlineHours": null, "deadlineNotes": "Becomes mandatory (real risk of significant harm) when the new Act takes effect on April 1, 2027 (Government of Nova Scotia release, September 26, 2025; nslegislature.ca bill page).", "method": "OIPC NS breach report (contact the OIPC).", "url": "https://nslegislature.ca/node/131065" } ], "recordKeeping": "None under current FOIPOP.", "penalties": "PIIDPA s. 13(3): fines up to $2,000 (individuals), $25,000 (individual service providers) and $500,000 (corporations).", "sources": [ { "title": "PIIDPA, S.N.S. 2006, c. 3", "url": "https://nslegislature.ca/sites/default/files/legc/PDFs/annual%20statutes/2006/c003.pdf", "section": "ss. 6(1), 13(3)", "accessed": "2026-10-29" }, { "title": "PEI/NS context: Canadian Privacy Law Blog on NS Bill 150", "url": "https://blog.privacylawyer.ca/2025/11/nova-scotias-new-freedom-of-information.html", "accessed": "2026-10-29" }, { "title": "Nova Scotia Legislature: Bill 150, Freedom of Information and Protection of Privacy Act (Royal Assent October 3, 2025; 2025 c. 13)", "url": "https://nslegislature.ca/node/131065", "accessed": "2026-10-29" }, { "title": "Government of Nova Scotia news release, September 26, 2025: new Act in effect April 1, 2027", "url": "https://news.novascotia.ca/en/2025/09/26/province-introduces-modernized-access-privacy-legislation", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "A new Freedom of Information and Protection of Privacy Act (Bill 150, S.N.S. 2025, c. 13, Royal Assent October 3, 2025) comes into force April 1, 2027 and introduces mandatory notification based on a real risk of significant harm. Until then public bodies in Nova Scotia have no statutory duty to notify; the Commissioner encourages voluntary reporting. PIIDPA applies only where personal information is disclosed in response to a foreign demand." }, { "id": "nb-rtippa", "name": "New Brunswick RTIPPA", "fullName": "Right to Information and Protection of Privacy Act, S.N.B. 2009, c. R-10.6, and General Regulation 2010-111, s. 4.2 (added by N.B. Reg. 2018-24)", "jurisdiction": "NB", "sector": "public", "status": "in-force", "inForceDate": "2018-04-01", "appliesTo": "New Brunswick public bodies: departments, Crown corporations, municipalities, universities, school districts, regional health authorities.", "triggerStandard": "risk of significant harm", "triggerExplainer": "Where it is reasonable to believe a privacy breach creates a risk of significant harm to an individual, considering the sensitivity of the information and the probability of misuse. Significant harm includes humiliation, damage to reputation or relationships, financial loss, identity theft and damage to property.", "notifications": [ { "to": "individuals", "recipientName": "Affected individuals", "mandatory": true, "deadlineText": "as soon as possible", "deadlineHours": null, "deadlineNotes": "Regulation 2010-111 s. 4.2(4)-(5). The duty is in the regulation, not in a s. 49.1 of the Act.", "method": "Direct notice.", "url": "https://laws.gnb.ca/en/document/ar/2018-24" }, { "to": "regulator", "recipientName": "New Brunswick Ombud (formerly Access to Information and Privacy Commissioner)", "mandatory": true, "deadlineText": "as soon as possible", "deadlineHours": null, "deadlineNotes": "Reg s. 4.2(4)(d): 'notify the Commissioner as soon as possible of any privacy breach under paragraph (c)'; the Commissioner's functions passed to the Ombud in 2016. The regulation has been in force since April 1, 2018.", "method": "Ombud NB Privacy Breach Notification Form (RTIPPA)", "url": "https://ombudnb.ca/wp-content/uploads/2024/11/FORM-Privacy-Breach-Notification-RTIPPA-2024-E.pdf" } ], "recordKeeping": "Investigate every actual or suspected breach and maintain a registry of every actual privacy breach and corrective measures (Reg s. 4.2(4)(b)).", "penalties": "RTIPPA s. 87 offence provisions apply; amounts are set in the Act.", "sources": [ { "title": "N.B. Regulation 2018-24 (laws.gnb.ca)", "url": "https://laws.gnb.ca/en/document/ar/2018-24", "section": "Reg 2010-111 s. 4.2", "accessed": "2026-10-29" }, { "title": "GNB: Handling privacy breaches", "url": "https://www.gnb.ca/en/gov/information-access-privacy/resources-gov-public-bodies/handling-privacy-breaches.html", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "The Ombud's January 2026 submission to the RTIPPA legislative review asks for the duty to be moved into the Act; no amending bill in force." }, { "id": "nl-atippa", "name": "NL ATIPPA, 2015 s. 64", "fullName": "Access to Information and Protection of Privacy Act, 2015, S.N.L. 2015, c. A-1.2, s. 64", "jurisdiction": "NL", "sector": "public", "status": "in-force", "inForceDate": "2015-06-01", "appliesTo": "Newfoundland and Labrador public bodies: departments, agencies, municipalities, school boards, universities, regional health authorities.", "triggerStandard": "risk of significant harm (individuals); any unauthorized collection, use or disclosure (commissioner)", "triggerExplainer": "Individuals must be notified at the first reasonable opportunity when personal information is stolen, lost, improperly disposed of, or accessed or disclosed without authority, unless the head reasonably believes the breach creates no risk of significant harm (s. 64(3), (7)); factors are sensitivity and probability of misuse (s. 64(9)). Separately, the head must inform the commissioner whenever it reasonably believes a breach involving unauthorized collection, use or disclosure has occurred (s. 64(4)).", "notifications": [ { "to": "individuals", "recipientName": "Affected individuals", "mandatory": true, "deadlineText": "at the first reasonable opportunity", "deadlineHours": null, "deadlineNotes": "s. 64(3); exception s. 64(7) (no risk of significant harm); commissioner may recommend notice anyway (s. 64(5)).", "method": "Direct notice.", "url": "https://www.assembly.nl.ca/Legislation/sr/statutes/a01-2.htm" }, { "to": "regulator", "recipientName": "Office of the Information and Privacy Commissioner of NL", "mandatory": true, "deadlineText": "no deadline in s. 64(4); OIPC practice: report promptly", "deadlineHours": null, "deadlineNotes": "Duty applies to all unauthorized collection, use or disclosure breaches, not only material ones.", "method": "OIPC NL privacy breach report form (Government Privacy Breach Reporting Form used by core government).", "url": "https://www.assembly.nl.ca/Legislation/sr/statutes/a01-2.htm", "threshold": "none" } ], "recordKeeping": "Not specified in s. 64.", "penalties": "ATIPPA, 2015 s. 115 offence provisions apply; amounts are set in the Act.", "sources": [ { "title": "ATIPPA, 2015 (House of Assembly consolidated statutes)", "url": "https://www.assembly.nl.ca/Legislation/sr/statutes/a01-2.htm", "section": "s. 64", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "Section 64(4) contains no 'material' threshold, so the commissioner must be told of every breach involving unauthorized collection, use or disclosure regardless of harm." }, { "id": "pe-foipp", "name": "PEI FOIPP", "fullName": "Freedom of Information and Protection of Privacy Act, R.S.P.E.I. 1988, c. F-15.01", "jurisdiction": "PE", "sector": "public", "status": "voluntary", "inForceDate": null, "appliesTo": "PEI public bodies: departments, agencies, municipalities, Health PEI, UPEI, Holland College, school authorities.", "triggerStandard": "none in statute", "triggerExplainer": "The FOIPP Act requires reasonable security arrangements (s. 35) but contains no breach notification duty; the PEI OIPC states that the FOIPP Act has no mandatory reporting and encourages voluntary reporting using the same process as the Health Information Act.", "notifications": [ { "to": "regulator", "recipientName": "PEI Information and Privacy Commissioner (voluntary)", "mandatory": false, "deadlineText": "no statutory deadline", "deadlineHours": null, "deadlineNotes": "Voluntary, encouraged for transparency.", "method": "OIPC FOIPP Breach Notification Form (PDF, Oct 2022)", "url": "https://www.assembly.pe.ca/sites/www.assembly.pe.ca/files/OIPC%20FOIPP%20Breach%20Notification%20Form%20October%206%202022.pdf" } ], "recordKeeping": "None required.", "penalties": "FOIPP s. 75 offence provisions apply; amounts are set in the Act.", "sources": [ { "title": "PEI OIPC Privacy Breach Reporting Guidelines", "url": "https://www.assembly.pe.ca/sites/www.assembly.pe.ca/files/oipc-privacy-breach-reporting-guidelines.pdf", "accessed": "2026-10-29" }, { "title": "PEI FOIPP Act (consolidated PDF)", "url": "https://www.princeedwardisland.ca/sites/default/files/legislation/f-15-01-freedom_of_information_and_protection_of_privacy_act.pdf", "section": "s. 35", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "No amending bill introducing mandatory FOIPP breach notification was found." }, { "id": "yt-atipp", "name": "Yukon ATIPP Act", "fullName": "Access to Information and Protection of Privacy Act, S.Y. 2018, c. 9, Part 3 Division on privacy breaches (ss. 31-34 region)", "jurisdiction": "YT", "sector": "public", "status": "in-force", "inForceDate": "2021-04-01", "appliesTo": "Yukon public bodies: departments, Crown corporations, Yukon University, Yukon Hospital Corporation, municipalities and school councils.", "triggerStandard": "risk of significant harm", "triggerExplainer": "The Designated Privacy Officer assesses each breach; if there is a risk of significant harm to an individual, all affected individuals must be notified and the Information and Privacy Commissioner and the head must be informed. Factors include sensitivity and probability of misuse.", "notifications": [ { "to": "individuals", "recipientName": "Affected individuals", "mandatory": true, "deadlineText": "no statutory timeline (Yukon ATIPP Office: timelines are not included in the Act or Regulation)", "deadlineHours": null, "deadlineNotes": "Direct notice unless a Regulation s. 10 circumstance permits public notice; the OIPC must receive at least one day's notice before a public notice.", "method": "Direct notice; Privacy Breach Report by the DPO.", "url": "https://open.yukon.ca/fr/information/da85dad0-08a1-48c8-8c39-f187771def1e/resource/5c2c400b-7c92-3e40-8385-960b53068855/download/privacy-breach-procedures-may-2021.pdf" }, { "to": "regulator", "recipientName": "Yukon Information and Privacy Commissioner", "mandatory": true, "deadlineText": "no statutory timeline", "deadlineHours": null, "deadlineNotes": "Government procedures recommend 5 working days for assessment and 2-3 weeks for the risk determination (not statutory).", "method": "DPO Privacy Breach Report submitted to the ATIPP Office and the OIPC.", "url": "https://open.yukon.ca/fr/information/60a2d4cc-2741-47b7-83bf-9cd524fda142/resource/9eb8b28e-ab89-37dd-b384-13db52325223/download/information-note-327b-notification-of-privacy-breach_2.pdf" } ], "recordKeeping": "Public bodies must keep a written record of each privacy breach (government information note on s. 32(7)(b)).", "penalties": "Offence provisions apply; amounts are set in the Act.", "sources": [ { "title": "Yukon Government Privacy Breach Procedures (May 2021)", "url": "https://open.yukon.ca/fr/information/da85dad0-08a1-48c8-8c39-f187771def1e/resource/5c2c400b-7c92-3e40-8385-960b53068855/download/privacy-breach-procedures-may-2021.pdf", "section": "ATIPP ss. 30, 32; Reg ss. 9, 10", "accessed": "2026-10-29" }, { "title": "Yukon Information Note 32(7)(b) Notification of Privacy Breach", "url": "https://open.yukon.ca/fr/information/60a2d4cc-2741-47b7-83bf-9cd524fda142/resource/9eb8b28e-ab89-37dd-b384-13db52325223/download/information-note-327b-notification-of-privacy-breach_2.pdf", "section": "s. 32(7)(b)", "accessed": "2026-10-29" }, { "title": "Government of Yukon news release: new ATIPP Act in force April 1, 2021", "url": "https://yukon.ca/en/news/new-access-information-and-protection-privacy-act-coming-force-april-1-2021", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "In force April 1, 2021. The Act and Regulation set no fixed timelines for notification; Yukon government procedures describe the expected steps and the s. 32(7)(b) duty to notify individuals." }, { "id": "nt-atipp", "name": "NWT ATIPP Act", "fullName": "Access to Information and Protection of Privacy Act (NWT), Part 2 Division E Data Breach Notification, ss. 49.7-49.15 (added by S.N.W.T. 2019, c. 8)", "jurisdiction": "NT", "sector": "public", "status": "in-force", "inForceDate": "2021-07-30", "appliesTo": "NWT public bodies: departments, boards, agencies, Aurora College, health and social services authorities, and municipalities once designated.", "triggerStandard": "material breach (Commissioner); real risk of significant harm (individuals)", "triggerExplainer": "Report to the Commissioner only if the breach is material, considering sensitivity, number of individuals, likelihood of harm and whether the cause is systemic (s. 49.9(2)). Notify individuals if it is reasonable to believe the breach creates a real risk of significant harm, considering sensitivity and probability of misuse (s. 49.10).", "notifications": [ { "to": "regulator", "recipientName": "NWT Information and Privacy Commissioner", "mandatory": true, "deadlineText": "as soon as reasonably possible after the head knows or has reason to believe a breach occurred and determines it is material", "deadlineHours": null, "deadlineNotes": "s. 49.9(1), (3).", "method": "Written report to the Commissioner.", "url": "https://laws.opennwt.ca/bills/snwt-2019-c08/?lang=en" }, { "to": "individuals", "recipientName": "Affected individuals", "mandatory": true, "deadlineText": "as soon as reasonably possible after the head knows or has reason to believe a breach occurred and determines it creates a real risk of significant harm", "deadlineHours": null, "deadlineNotes": "s. 49.10(1), (3).", "method": "Direct notice.", "url": "https://laws.opennwt.ca/bills/snwt-2019-c08/?lang=en" } ], "recordKeeping": "Not specified in the sources reviewed.", "penalties": "Offence provisions apply; amounts are set in the Act.", "sources": [ { "title": "An Act to Amend the ATIPP Act, S.N.W.T. 2019, c. 8 (OpenNWT reading copy)", "url": "https://laws.opennwt.ca/bills/snwt-2019-c08/?lang=en", "section": "ss. 49.9-49.10", "accessed": "2026-10-29" }, { "title": "NWT IPC Annual Report 2021-22 (in force July 30, 2021)", "url": "https://ntlegislativeassembly.ca/sites/default/files/legacy/td_711-192.pdf", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "Breach notification duties were added by S.N.W.T. 2019, c. 8 and came into force in July 2021. There is no s. 87.1; the duties are in ss. 49.9 and 49.10." }, { "id": "nu-atipp", "name": "Nunavut ATIPP Act", "fullName": "Access to Information and Protection of Privacy Act (Nunavut), Part 2 Division E Data Breach Notification, ss. 49.7-49.14 (S.Nu. 2012, c. 13; amended S.Nu. 2017, c. 26)", "jurisdiction": "NU", "sector": "public", "status": "in-force", "inForceDate": "2013-05-11", "appliesTo": "Nunavut public bodies: departments, boards and agencies of the Government of Nunavut and designated bodies.", "triggerStandard": "material breach (Commissioner); real risk of significant harm (individuals)", "triggerExplainer": "Same structure as NWT: report material breaches (sensitivity, number of individuals, likelihood of harm, systemic cause) to the Commissioner; notify individuals where a real risk of significant harm exists (sensitivity and probability of misuse).", "notifications": [ { "to": "regulator", "recipientName": "Nunavut Information and Privacy Commissioner", "mandatory": true, "deadlineText": "as soon as reasonably possible after the public body knows or has reason to believe a breach occurred and determines it is material", "deadlineHours": null, "deadlineNotes": "s. 49.9(3).", "method": "Written report; GN Privacy Breach Policy (2025) assigns this to the ATIPP Coordinator or Deputy Head.", "url": "https://www.gov.nu.ca/sites/default/files/documents/2021-11/atipp_act_2018.pdf" }, { "to": "individuals", "recipientName": "Affected individuals", "mandatory": true, "deadlineText": "as soon as reasonably possible after the public body knows or has reason to believe a breach occurred and determines it creates a real risk of significant harm", "deadlineHours": null, "deadlineNotes": "s. 49.10(3).", "method": "Direct notice.", "url": "https://www.gov.nu.ca/sites/default/files/documents/2021-11/atipp_act_2018.pdf" } ], "recordKeeping": "GN Privacy Breach Policy requires documentation; no retention period identified.", "penalties": "ATIPP s. 59 offence provisions apply; amounts are set in the Act.", "sources": [ { "title": "Nunavut ATIPP Act consolidation (GN, 2018)", "url": "https://www.gov.nu.ca/sites/default/files/documents/2021-11/atipp_act_2018.pdf", "section": "ss. 49.9-49.10", "accessed": "2026-10-29" }, { "title": "GN Privacy Breach Policy (2025)", "url": "https://www.gov.nu.ca/sites/default/files/policies-legislations/2025-08/Privacy_Breach_Policy_06__25.pdf", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "Division E was added by S.Nu. 2012, c. 13 (in force May 11, 2013) and amended by S.Nu. 2017, c. 26. Nunavut had mandatory breach notification earlier than most provinces. Bill 59 (2024) was withdrawn; no newer amendments found." }, { "id": "on-phipa", "name": "Ontario PHIPA s. 12", "fullName": "Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A, s. 12, and O. Reg. 329/04 ss. 6.3-6.4", "jurisdiction": "ON", "sector": "health", "status": "in-force", "inForceDate": "2017-10-01", "appliesTo": "Health information custodians in Ontario (hospitals, physicians, clinics, pharmacies, long-term care homes, laboratories, Ontario Health) and their agents.", "triggerStandard": "theft, loss or unauthorized use or disclosure (individuals); prescribed circumstances (IPC)", "triggerExplainer": "Individuals must be notified of any theft, loss or unauthorized use or disclosure of their personal health information. The IPC must be notified where a prescribed circumstance exists: use or disclosure by a person who knew or ought to have known it was unauthorized; theft; further unauthorized use or disclosure after an initial incident; a pattern of similar incidents; a College notice under s. 17.1 (or would be if the agent were a College member); or the custodian determines the incident is significant having regard to sensitivity, volume, number of individuals and number of custodians or agents involved.", "notifications": [ { "to": "individuals", "recipientName": "Affected individuals", "mandatory": true, "deadlineText": "at the first reasonable opportunity", "deadlineHours": null, "deadlineNotes": "s. 12(2); the notice must state the individual's right to complain to the IPC.", "method": "Direct notice.", "url": "https://www.ipc.on.ca/en/media/3363/download", "threshold": "none" }, { "to": "regulator", "recipientName": "Information and Privacy Commissioner of Ontario", "mandatory": true, "deadlineText": "at the first reasonable opportunity", "deadlineHours": null, "deadlineNotes": "s. 12(3) with O. Reg. 329/04 s. 6.3(3); in force October 1, 2017.", "method": "IPC 'Report a privacy breach at your organization' form (online or to the Registrar)", "url": "https://www.ipc.on.ca/en/resources/forms/report-privacy-breach-your-organization", "threshold": "low" }, { "to": "regulator", "recipientName": "IPC (annual statistics)", "mandatory": true, "deadlineText": "annually by March 1 for the previous calendar year", "deadlineHours": null, "deadlineNotes": "O. Reg. 329/04 s. 6.4: the annual report covers the number of thefts, losses and unauthorized uses or disclosures in the previous calendar year, due to the IPC by March 1 (first report March 1, 2019). Add this incident to the count.", "method": "IPC online statistical reporting portal", "url": "https://www.ipc.on.ca/en/node/2484", "threshold": "none" }, { "to": "other", "recipientName": "Regulatory College of the agent (s. 17.1)", "mandatory": false, "deadlineText": "within 30 days after the disciplinary action or termination", "deadlineHours": null, "deadlineNotes": "s. 17.1: applies only where the custodian takes disciplinary action against an agent who is a member of a regulated health profession (or the agent resigns in response), for unauthorized collection, use, disclosure or disposal of personal health information. Written notice to the College within 30 days.", "method": "Written notice to the College.", "url": "https://www.ipc.on.ca/en/node/2484" } ], "recordKeeping": "Keep records sufficient to produce the annual statistical report; retain breach documentation.", "penalties": "PHIPA s. 72, as amended in 2020: fines of up to $200,000 and up to one year of imprisonment for individuals, and up to $1,000,000 for organizations.", "sources": [ { "title": "IPC: Regulations - prescribed circumstances for notifying the Commissioner (O. Reg. 329/04 s. 6.3)", "url": "https://www.ipc.on.ca/en/node/2484", "section": "s. 6.3", "accessed": "2026-10-29" }, { "title": "IPC presentation: Mandatory Reporting Obligations (PHIPA s. 12(2), prescribed circumstances in force Oct 1, 2017)", "url": "https://www.ipc.on.ca/en/media/3363/download", "section": "s. 12", "accessed": "2026-10-29" }, { "title": "IPC breach report form", "url": "https://www.ipc.on.ca/en/resources/forms/report-privacy-breach-your-organization", "accessed": "2026-10-29" }, { "title": "CMPA: The new reality of reporting a privacy breach (annual report by March 1)", "url": "https://www.cmpa-acpm.ca/en/advice-publications/browse-articles/2018/the-new-reality-of-reporting-a-privacy-breach", "accessed": "2026-10-29" }, { "title": "College of Respiratory Therapists of Ontario: Changes to PHIPA (s. 17.1 College notice within 30 days)", "url": "https://www.crto.on.ca/?p=4724", "section": "Reporting to the College", "accessed": "2026-10-29" }, { "title": "McCarthy Tetrault: Amendments to Ontario's health information legislation bring new obligations and penalties (June 22, 2020)", "url": "https://www.mccarthy.ca/en/insights/blogs/techlex/amendments-to-ontario-s-health-information-legislation-bring-new-obligations-and-penalties", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "Hospitals are also prescribed entities under O. Reg. 51/26 (72-hour report to the Ministry CISO) and FIPPA institutions (s. 40.1), so a single incident can trigger three Ontario reports." }, { "id": "ab-hia", "name": "Alberta HIA s. 60.1", "fullName": "Health Information Act, R.S.A. 2000, c. H-5, s. 60.1", "jurisdiction": "AB", "sector": "health", "status": "in-force", "inForceDate": "2018-08-31", "appliesTo": "Alberta custodians (Alberta Health Services, physicians, pharmacists, dentists, nursing homes, Alberta Health) and their affiliates.", "triggerStandard": "risk of harm to an individual", "triggerExplainer": "Where a custodian determines there is a risk of harm to an individual as a result of the loss of, or unauthorized access to or disclosure of, individually identifying health information (s. 60.1(2)); harm factors are in the HIA Regulation s. 8.1.", "notifications": [ { "to": "regulator", "recipientName": "Information and Privacy Commissioner of Alberta", "mandatory": true, "deadlineText": "as soon as practicable", "deadlineHours": null, "deadlineNotes": "s. 60.1(2).", "method": "OIPC HIA Breach Notification Form (Word)", "url": "https://oipc.ab.ca/wp-content/uploads/2025/06/Form_HIA-Breach_Notification_202509.docx", "threshold": "low" }, { "to": "government-body", "recipientName": "Minister of Health", "mandatory": true, "deadlineText": "as soon as practicable", "deadlineHours": null, "deadlineNotes": "s. 60.1(3).", "method": "Written notice to Alberta Health.", "url": "https://oipc.ab.ca/breach-notification/", "threshold": "low" }, { "to": "individuals", "recipientName": "Affected individuals", "mandatory": true, "deadlineText": "as soon as practicable", "deadlineHours": null, "deadlineNotes": "s. 60.1(3).", "method": "Direct notice.", "url": "https://oipc.ab.ca/breach-notification/", "threshold": "low" } ], "recordKeeping": "Affiliates must notify the custodian; custodians should document breaches (OIPC assessment tool).", "penalties": "Failing to notify is an offence under HIA s. 107 punishable by fine; amounts are set in the Act.", "sources": [ { "title": "OIPC Alberta: Breach Notification Requirements (HIA s. 60.1)", "url": "https://oipc.ab.ca/breach-notification/", "section": "s. 60.1", "accessed": "2026-10-29" }, { "title": "OIPC Alberta: Mandatory privacy breach reporting coming to Alberta's health sector (in force August 31, 2018)", "url": "https://oipc.ab.ca/hia-breach-reporting/", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "Section 60.1 has been in force since August 31, 2018." }, { "id": "mb-phia", "name": "Manitoba PHIA s. 19.0.1", "fullName": "The Personal Health Information Act, C.C.S.M. c. P33.5, s. 19.0.1 (added by S.M. 2021, c. 47)", "jurisdiction": "MB", "sector": "health", "status": "in-force", "inForceDate": "2022-01-01", "appliesTo": "Manitoba trustees: health professionals, health care facilities, regional health authorities, Shared Health, public bodies holding personal health information.", "triggerStandard": "real risk of significant harm", "triggerExplainer": "After considering the factors set by regulation, a privacy breach that could reasonably be expected to create a real risk of significant harm to the individual.", "notifications": [ { "to": "individuals", "recipientName": "Affected individuals", "mandatory": true, "deadlineText": "as soon as practicable after the privacy breach becomes known to the trustee", "deadlineHours": null, "deadlineNotes": "s. 19.0.1(2)-(3).", "method": "Direct notice.", "url": "https://web2.gov.mb.ca/laws/statutes/ccsm/_pdf(toc).php?cap=p33.5" }, { "to": "regulator", "recipientName": "Manitoba Ombudsman", "mandatory": true, "deadlineText": "at the time and in the form and manner that the Ombudsman requires", "deadlineHours": null, "deadlineNotes": "s. 19.0.1(4); required whenever individual notice is required.", "method": "Ombudsman FIPPA and PHIA Privacy Breach Reporting Form", "url": "https://www.ombudsman.mb.ca/for-public-bodies/report-a-privacy-breach/" } ], "recordKeeping": "Not specified.", "penalties": "PHIA s. 63 offences include failing to comply with s. 19.0.1 (added by S.M. 2021, c. 47); amounts are set in the Act.", "sources": [ { "title": "Manitoba PHIA (C.C.S.M. c. P33.5) consolidated", "url": "https://web2.gov.mb.ca/laws/statutes/ccsm/_pdf(toc).php?cap=p33.5", "section": "s. 19.0.1", "accessed": "2026-10-29" }, { "title": "S.M. 2021, c. 47 (PHIA amendments)", "url": "https://web2.gov.mb.ca/laws/statutes/2021/c04721e.php", "section": "s. 11", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "In-force date January 1, 2022 per the consolidated Act's legislative history." }, { "id": "sk-hipa", "name": "Saskatchewan HIPA", "fullName": "The Health Information Protection Act, S.S. 1999, c. H-0.021, s. 16 and The Health Information Protection Regulations, 2023", "jurisdiction": "SK", "sector": "health", "status": "voluntary", "inForceDate": null, "appliesTo": "Saskatchewan trustees: Saskatchewan Health Authority, eHealth, physicians, pharmacists, other health professionals and facilities.", "triggerStandard": "none in statute; OIPC applies the LA FOIP real-risk-of-significant-harm practice", "triggerExplainer": "HIPA s. 16 requires policies and safeguards but no breach notification provision was located; the OIPC's 2025 investigation report states trustees should follow the LA FOIP s. 28.1 practice (notify individuals where a real risk of significant harm) and recommends notifying the OIPC within ten calendar days of initiating containment.", "notifications": [ { "to": "individuals", "recipientName": "Affected individuals (OIPC expectation)", "mandatory": false, "deadlineText": "at the earliest opportunity (OIPC)", "deadlineHours": null, "deadlineNotes": "Recommendation of the Saskatchewan Information and Privacy Commissioner, not a statutory duty. HIPA itself contains no breach notification section; the Commissioner applies the public sector practice to trustees.", "method": "Direct notice.", "url": "https://oipc.sk.ca/assets/hipa-investigation_193-2024-043-2025.pdf" }, { "to": "regulator", "recipientName": "Saskatchewan Information and Privacy Commissioner (voluntary)", "mandatory": false, "deadlineText": "OIPC recommendation: within ten calendar days of initiating containment", "deadlineHours": null, "deadlineNotes": "Recommendation of the Saskatchewan Information and Privacy Commissioner, not a statutory duty. HIPA itself contains no breach notification section; the Commissioner applies the public sector practice to trustees.", "method": "Proactive report to the OIPC.", "url": "https://oipc.sk.ca/assets/hipa-investigation_193-2024-043-2025.pdf" } ], "recordKeeping": "Not specified.", "penalties": "HIPA s. 64 offence provisions apply; amounts are set in the Act.", "sources": [ { "title": "OIPC SK Investigation Report 193-2024, 043-2025 (SHA)", "url": "https://oipc.sk.ca/assets/hipa-investigation_193-2024-043-2025.pdf", "accessed": "2026-10-29" }, { "title": "MLT Aikins: New privacy requirements for Saskatchewan health system (Aug 1, 2023 amendments)", "url": "https://www.mltaikins.com/health-care/new-privacy-requirements-for-saskatchewan-health-system", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "Private clinics also fall under PIPEDA for commercial activity. Trustees that are also local authorities (the Saskatchewan Health Authority and others listed under LA FOIP) are bound by the mandatory LA FOIP s. 28.1 duty to notify individuals; see the Saskatchewan FOIP / LA FOIP regime. The August 1, 2023 HIPA changes (MLT Aikins) did not add a breach notification duty." }, { "id": "nb-phipaa", "name": "New Brunswick PHIPAA s. 49", "fullName": "Personal Health Information Privacy and Access Act, S.N.B. 2009, c. P-7.05, s. 49", "jurisdiction": "NB", "sector": "health", "status": "in-force", "inForceDate": "2010-09-01", "appliesTo": "New Brunswick custodians: regional health authorities, physicians, pharmacists, nursing homes, Medavie, Department of Health.", "triggerStandard": "theft, loss, improper disposal, or unauthorized disclosure or access, unless no adverse impact", "triggerExplainer": "Notify unless the custodian reasonably believes the incident will not adversely impact health care or other benefits, will not adversely affect the individual's mental, physical, economic or social well-being, and will not lead to identification of the individual (s. 49(2)).", "notifications": [ { "to": "individuals", "recipientName": "Affected individuals", "mandatory": true, "deadlineText": "at the first reasonable opportunity", "deadlineHours": null, "deadlineNotes": "s. 49(1)(c), in the manner prescribed by regulation.", "method": "Direct notice.", "url": "https://laws.gnb.ca/en/document/cs/P-7.05", "threshold": "low" }, { "to": "regulator", "recipientName": "New Brunswick Ombud", "mandatory": true, "deadlineText": "at the first reasonable opportunity", "deadlineHours": null, "deadlineNotes": "s. 49(1)(c).", "method": "Ombud NB privacy breach notification form (PHIPAA)", "url": "https://laws.gnb.ca/en/document/cs/P-7.05", "threshold": "low" } ], "recordKeeping": "Not specified in s. 49.", "penalties": "PHIPAA s. 76 offences apply; the fine category and amounts are set in the Act and the Provincial Offences Procedure Act.", "sources": [ { "title": "PHIPAA (laws.gnb.ca)", "url": "https://laws.gnb.ca/en/document/cs/P-7.05", "section": "ss. 49, 76", "accessed": "2026-10-29" }, { "title": "GNB: Privacy notice (PHIPAA in force September 1, 2010)", "url": "https://gnb.ca/en/topic/health-wellness/patient-engagement-privacy/privacy-notice.html", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "In force September 1, 2010. The duty is in s. 49." }, { "id": "ns-phia", "name": "Nova Scotia PHIA ss. 69-70", "fullName": "Personal Health Information Act, S.N.S. 2010, c. 41, ss. 69-70", "jurisdiction": "NS", "sector": "health", "status": "in-force", "inForceDate": "2013-06-01", "appliesTo": "Nova Scotia custodians: Nova Scotia Health, IWK, physicians, pharmacists, long-term care, Department of Health and Wellness.", "triggerStandard": "potential for harm or embarrassment", "triggerExplainer": "Notify the individual where the custodian believes on a reasonable basis that personal health information was stolen, lost, or accessed or disclosed without authority and that this creates potential for harm or embarrassment (s. 69). If the custodian decides not to notify (breach unlikely or no potential for harm or embarrassment, s. 70(1)), it must instead notify the Review Officer (Commissioner).", "notifications": [ { "to": "individuals", "recipientName": "Affected individuals", "mandatory": true, "deadlineText": "at the first reasonable opportunity", "deadlineHours": null, "deadlineNotes": "s. 69.", "method": "Direct notice.", "url": "https://nslegislature.ca/sites/default/files/legc/statutes/personal%20health%20information.pdf", "threshold": "low" }, { "to": "regulator", "recipientName": "Nova Scotia Information and Privacy Commissioner (Review Officer)", "mandatory": true, "deadlineText": "as soon as possible (where the custodian decides not to notify the individual)", "deadlineHours": null, "deadlineNotes": "s. 70(2). Reporting to the Commissioner is otherwise voluntary; the 2025 PHIA s. 70 guidelines describe practice.", "method": "Written notice to the OIPC NS.", "url": "https://nslegislature.ca/sites/default/files/legc/statutes/personal%20health%20information.pdf" } ], "recordKeeping": "Not specified.", "penalties": "s. 107: fines up to $10,000 and/or six months imprisonment (individuals) and $50,000 (corporations).", "sources": [ { "title": "Nova Scotia PHIA (consolidated PDF)", "url": "https://nslegislature.ca/sites/default/files/legc/statutes/personal%20health%20information.pdf", "section": "ss. 69, 70, 107", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "The duties are in ss. 69 and 70(2), with offences in s. 107. The Act has been in force since June 1, 2013." }, { "id": "nl-phia", "name": "NL PHIA s. 15", "fullName": "Personal Health Information Act, S.N.L. 2008, c. P-7.01, s. 15", "jurisdiction": "NL", "sector": "health", "status": "in-force", "inForceDate": "2011-04-01", "appliesTo": "NL custodians: NL Health Services, physicians, pharmacists, other health professionals, Department of Health and Community Services.", "triggerStandard": "theft, loss, improper disposal or unauthorized access/disclosure (individuals); material breach (commissioner)", "triggerExplainer": "Notify individuals of any theft, loss, improper disposal, or unauthorized disclosure or access, unless the custodian reasonably believes it will not adversely affect their health care or benefits or their well-being (s. 15(3), (7)). Inform the commissioner where the custodian reasonably believes there has been a material breach involving unauthorized collection, use or disclosure, as defined in the regulations (s. 15(4)).", "notifications": [ { "to": "individuals", "recipientName": "Affected individuals", "mandatory": true, "deadlineText": "at the first reasonable opportunity", "deadlineHours": null, "deadlineNotes": "s. 15(3).", "method": "Direct notice.", "url": "https://www.assembly.nl.ca/Legislation/sr/statutes/p07-01.htm", "threshold": "low" }, { "to": "regulator", "recipientName": "Office of the Information and Privacy Commissioner of NL", "mandatory": true, "deadlineText": "no deadline in s. 15(4); OIPC expects prompt reporting", "deadlineHours": null, "deadlineNotes": "Whether a breach is material turns on the factors in the PHIA Regulations: sensitivity of the information, number of individuals affected and whether the cause is systemic.", "method": "OIPC NL breach report.", "url": "https://www.assembly.nl.ca/Legislation/sr/statutes/p07-01.htm" } ], "recordKeeping": "Not specified.", "penalties": "PHIA s. 88 offence provisions apply; amounts are set in the Act.", "sources": [ { "title": "NL PHIA (House of Assembly consolidated statutes)", "url": "https://www.assembly.nl.ca/Legislation/sr/statutes/p07-01.htm", "section": "s. 15", "accessed": "2026-10-29" }, { "title": "Government of NL news release, May 25, 2011 (PHIA in force April 1, 2011)", "url": "https://www.releases.gov.nl.ca/releases/2011/health/0525n04.htm", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "The duty is in s. 15. The Act has been in force since April 1, 2011." }, { "id": "pe-hia", "name": "PEI Health Information Act", "fullName": "Health Information Act, R.S.P.E.I. 1988, c. H-1.41", "jurisdiction": "PE", "sector": "health", "status": "in-force", "inForceDate": "2017-07-01", "appliesTo": "PEI custodians: Health PEI, physicians, pharmacists, other health professionals and facilities.", "triggerStandard": "theft, loss, or unauthorized access or disclosure, unless no adverse impact", "triggerExplainer": "Notify unless the custodian reasonably believes the breach will not have an adverse impact on health care or other benefits or on the individual's mental, physical, economic or social well-being (PEI OIPC guidelines).", "notifications": [ { "to": "individuals", "recipientName": "Affected individuals", "mandatory": true, "deadlineText": "at the first reasonable opportunity", "deadlineHours": null, "deadlineNotes": "Confirm the section reference against the Health Information Act; the duty is described in the PEI OIPC guidelines.", "method": "Direct notice.", "url": "https://www.assembly.pe.ca/sites/www.assembly.pe.ca/files/oipc-privacy-breach-reporting-guidelines.pdf", "threshold": "low" }, { "to": "regulator", "recipientName": "PEI Information and Privacy Commissioner", "mandatory": true, "deadlineText": "at the first reasonable opportunity", "deadlineHours": null, "deadlineNotes": "Same exception as above.", "method": "OIPC PHI Breach Notification Form (PDF)", "url": "https://www.assembly.pe.ca/sites/www.assembly.pe.ca/files/OIPC%20PHI%20Breach%20Notification%20Form%20Oct%206%202022.pdf", "threshold": "low" } ], "recordKeeping": "Not specified.", "penalties": "Offence provisions apply; amounts are set in the Act.", "sources": [ { "title": "PEI OIPC Privacy Breach Reporting Guidelines", "url": "https://www.assembly.pe.ca/sites/www.assembly.pe.ca/files/oipc-privacy-breach-reporting-guidelines.pdf", "accessed": "2026-10-29" }, { "title": "CBC: PEI Health Information Act takes effect July 1, 2017", "url": "https://www.cbc.ca/lite/story/1.4184704", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "In force July 1, 2017. The custodian's duty and the Commissioner's expectations are described in the PEI OIPC breach guidelines (April 2024); confirm the section reference against the Act." }, { "id": "yt-hipma", "name": "Yukon HIPMA ss. 30-31", "fullName": "Health Information Privacy and Management Act, S.Y. 2013, c. 16, ss. 30-31", "jurisdiction": "YT", "sector": "health", "status": "in-force", "inForceDate": "2016-08-31", "appliesTo": "Yukon custodians: Department of Health and Social Services, Yukon Hospital Corporation, physicians, pharmacists and other health care providers.", "triggerStandard": "likelihood of significant harm", "triggerExplainer": "Where there is a likelihood of significant harm to an individual from a security breach, the custodian must notify the individual and the Commissioner; where there is no such likelihood no notice is required.", "notifications": [ { "to": "individuals", "recipientName": "Affected individuals", "mandatory": true, "deadlineText": "as soon as reasonably possible", "deadlineHours": null, "deadlineNotes": "s. 30(1).", "method": "Direct notice.", "url": "https://yukon.ca/sites/yukon.ca/files/hss/hss-sample-breach-protocol.pdf" }, { "to": "regulator", "recipientName": "Yukon Information and Privacy Commissioner", "mandatory": true, "deadlineText": "within a reasonable timeframe", "deadlineHours": null, "deadlineNotes": "s. 30(2)(b) and s. 31: written report on risk of harm, estimated number affected and mitigation.", "method": "Written report to the OIPC.", "url": "https://yukon.ca/sites/yukon.ca/files/hss/hss-sample-breach-protocol.pdf" } ], "recordKeeping": "Not specified.", "penalties": "Offence provisions apply; amounts are set in the Act.", "sources": [ { "title": "Yukon HSS Sample Breach Protocol (cites HIPMA ss. 30-31)", "url": "https://yukon.ca/sites/yukon.ca/files/hss/hss-sample-breach-protocol.pdf", "section": "ss. 30-31", "accessed": "2026-10-29" }, { "title": "Whitehorse Daily Star: Health Information Privacy and Management Act now in force (September 6, 2016)", "url": "https://www.whitehorsestar.com/News/health-information-privacy-and-management-act-now-in-force", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "Wording taken from a Yukon government sample protocol, not the Act. In-force date: the Whitehorse Daily Star reported on September 6, 2016 that HIPMA 'came into force last Wednesday', i.e. August 31, 2016." }, { "id": "nt-hia", "name": "NWT Health Information Act", "fullName": "Health Information Act, S.N.W.T. 2014, c. 2, s. 87, and Health Information Regulations ss. 14-15", "jurisdiction": "NT", "sector": "health", "status": "in-force", "inForceDate": "2015-10-01", "appliesTo": "NWT custodians: Department of Health and Social Services, health and social services authorities, physicians, pharmacists and other providers.", "triggerStandard": "reasonable risk of harm (commissioner); any inappropriate access, loss or theft (individuals)", "triggerExplainer": "Regulation s. 15(1): notify the Commissioner and law enforcement where personal health information is lost or stolen, or where fraud or identity theft leads to disclosure, alteration, destruction or disposal; exempt where the incident does not present a reasonable risk of harm (s. 15(2)). The Act (s. 87) requires notifying the individuals affected.", "notifications": [ { "to": "individuals", "recipientName": "Affected individuals", "mandatory": true, "deadlineText": "as soon as reasonably possible (HIA s. 87)", "deadlineHours": null, "deadlineNotes": "Confirm the current wording of s. 87 of the Act and ss. 14 and 15 of the Regulations before relying on a specific timeline.", "method": "Direct notice.", "url": "https://www.justice.gov.nt.ca/en/files/legislation/health-information/health-information.r1.pdf", "threshold": "none" }, { "to": "regulator", "recipientName": "NWT Information and Privacy Commissioner and law enforcement", "mandatory": true, "deadlineText": "no deadline in Regulation s. 15", "deadlineHours": null, "deadlineNotes": "Confirm the current wording of s. 87 of the Act and ss. 14 and 15 of the Regulations before relying on a specific timeline.", "method": "Written notice.", "url": "https://www.justice.gov.nt.ca/en/files/legislation/health-information/health-information.r1.pdf", "threshold": "low" } ], "recordKeeping": "Regulation s. 14: investigate, keep a record of the breach and corrective measures.", "penalties": "HIA offence provisions apply; amounts are set in the Act.", "sources": [ { "title": "NWT Health Information Regulations", "url": "https://www.justice.gov.nt.ca/en/files/legislation/health-information/health-information.r1.pdf", "section": "ss. 14-15", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "Nunavut has no health-specific privacy act; its ATIPP Act and PIPEDA apply." }, { "id": "cyber-insurance", "name": "Cyber insurance policy conditions", "fullName": "Contractual notice conditions in cyber liability / cyber first-party insurance policies", "jurisdiction": "federal", "sector": "contractual", "status": "in-force", "inForceDate": null, "appliesTo": "Any organization holding a cyber insurance policy (typically claims-made-and-reported).", "triggerStandard": "discovery of a security or privacy incident, or receipt of a claim or circumstance", "triggerExplainer": "Most policies make timely notice a condition of coverage; the clock is tied to discovery or awareness of an incident (sometimes by a defined control group). Many policies also require insurer consent before incurring costs or retaining vendors, and steer insureds to panel breach coaches and forensic firms.", "notifications": [ { "to": "insurer", "recipientName": "Insurer (and broker, but notice to the broker alone may not satisfy the policy)", "mandatory": true, "deadlineText": "as soon as practicable (policy-specific; some set fixed days)", "deadlineHours": null, "deadlineNotes": "Late or defective notice can forfeit coverage; pre-notice legal fees may not be covered. Check the policy's notice clause, hotline and consent-to-incur-costs condition.", "method": "Policy's 24/7 incident hotline and written notice per the policy's notice clause.", "url": "https://www.reedsmith.com/en/perspectives/cyber-insurance-claims/2023/06/best-practices-avoiding-notification-disputes-cyber-liability-insurance" } ], "recordKeeping": "Preserve evidence and document the timeline for the claim.", "penalties": "Denial of coverage or reduced recovery for late notice.", "sources": [ { "title": "Reed Smith: Best practices for avoiding notification disputes in cyber liability insurance (June 2023)", "url": "https://www.reedsmith.com/en/perspectives/cyber-insurance-claims/2023/06/best-practices-avoiding-notification-disputes-cyber-liability-insurance", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "A contract condition, not a law. Notify the insurer before engaging outside counsel or forensic responders: most policies require the use of panel firms and treat late notice as grounds to deny the claim." }, { "id": "pci-dss", "name": "PCI DSS / card brand rules", "fullName": "PCI DSS incident response requirements and card brand compromise rules (Visa What To Do If Compromised v5.0; Mastercard Account Data Compromise rules)", "jurisdiction": "federal", "sector": "contractual", "status": "in-force", "inForceDate": null, "appliesTo": "Merchants, service providers and acquirers that store, process or transmit payment card data, by contract with their acquirer and the card brands.", "triggerStandard": "suspected or confirmed unauthorized access to cardholder data", "triggerExplainer": "Compromised entities must immediately notify their acquirer and the card brands (via the acquirer), preserve evidence, and may be required to engage a PCI Forensic Investigator (PFI).", "notifications": [ { "to": "other-organizations", "recipientName": "Acquiring bank (merchant bank) and Visa Risk Management / other card brands", "mandatory": true, "deadlineText": "Immediately notify all relevant parties; Visa Initial Investigation Report within three (3) business days", "deadlineHours": null, "deadlineNotes": "Visa What To Do If Compromised v5.0 (August 2016) and the Visa bulletin on data compromise reporting (July 2017): notify the acquirer and Visa immediately on discovery; share preliminary investigation findings within three business days; engage a PCI Forensic Investigator and report exposed accounts on Visa's timelines. Mastercard's Account Data Compromise rules are similar; confirm with your acquirer. Contractual, not statutory.", "method": "Contact the acquirer; Visa Initial Investigation Report; PFI engagement.", "url": "https://www.visa.ca/content/dam/VCOM/regional/na/canada/security/security-documents/what-to-do-if-compromised-english.pdf" } ], "recordKeeping": "Preserve logs and forensic evidence; PCI DSS Requirement 12.10 incident response plan.", "penalties": "Card brand non-compliance assessments, fraud recovery and possible loss of card acceptance.", "sources": [ { "title": "Visa Canada: What To Do If Compromised (v5.0)", "url": "https://www.visa.ca/content/dam/VCOM/regional/na/canada/security/security-documents/what-to-do-if-compromised-english.pdf", "section": "Notification requirements", "accessed": "2026-10-29" }, { "title": "PCI SSC blog: Updated guidance, Responding to a Data Breach (April 2020)", "url": "https://blog.pcisecuritystandards.org/updated-guidance-responding-to-a-data-breach", "accessed": "2026-10-29" }, { "title": "Visa bulletin: Data compromise reporting requirements (July 2017)", "url": "https://usa.visa.com/dam/VCOM/global/support-legal/documents/visa-bulletin-data-compromise-reporting-requirements.pdf", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "Visa may have issued a later WTDIC version; v5.0 is the version on visa.ca." }, { "id": "gdpr", "name": "GDPR Art. 33-34", "fullName": "EU General Data Protection Regulation (EU) 2016/679, Articles 33 and 34", "jurisdiction": "EU", "sector": "private", "status": "in-force", "inForceDate": "2018-05-25", "appliesTo": "Canadian organizations that are controllers or processors subject to the GDPR (Art. 3: establishment in the EU, or offering goods/services to, or monitoring, individuals in the EU/EEA; UK GDPR mirrors this for the UK).", "triggerStandard": "personal data breach, unless unlikely to result in a risk to rights and freedoms (authority); high risk (individuals)", "triggerExplainer": "Notify the competent supervisory authority of a personal data breach unless it is unlikely to result in a risk to individuals' rights and freedoms; communicate to data subjects where the breach is likely to result in a high risk. Processors must notify the controller without undue delay.", "notifications": [ { "to": "regulator", "recipientName": "Competent EU/EEA supervisory authority (lead authority or authority of the affected member state)", "mandatory": true, "deadlineText": "without undue delay and, where feasible, not later than 72 hours after having become aware of it", "deadlineHours": 72, "deadlineNotes": "Art. 33(1); reasons for any delay must accompany a late notification; information may be provided in phases.", "method": "Supervisory authority's online breach form (varies by country).", "url": "https://gdpr-info.eu/art-33-gdpr/", "threshold": "low" }, { "to": "individuals", "recipientName": "Data subjects", "mandatory": true, "deadlineText": "without undue delay", "deadlineHours": null, "deadlineNotes": "Art. 34(1), only where likely to result in a high risk.", "method": "Direct communication or public communication where disproportionate effort.", "url": "https://gdpr-info.eu/art-34-gdpr/" } ], "recordKeeping": "Art. 33(5): document every personal data breach (facts, effects, remedial action).", "penalties": "Art. 83: up to EUR 10,000,000 or 2% of worldwide annual turnover for breach of Arts. 33-34.", "sources": [ { "title": "GDPR Article 33 (gdpr-info.eu)", "url": "https://gdpr-info.eu/art-33-gdpr/", "section": "Art. 33", "accessed": "2026-10-29" }, { "title": "GDPR Article 34 (gdpr-info.eu)", "url": "https://gdpr-info.eu/art-34-gdpr/", "section": "Art. 34", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "gdpr-info.eu reproduces the official text; EUR-Lex is the primary source." }, { "id": "us-state-laws", "name": "US state breach laws (prompt only)", "fullName": "All 50 US states, DC and territories have breach notification statutes with differing triggers, deadlines (often 30-60 days) and attorney-general reporting thresholds", "jurisdiction": "US", "sector": "private", "status": "in-force", "inForceDate": null, "appliesTo": "Any organization holding personal information of US residents.", "triggerStandard": "varies by state", "triggerExplainer": "If residents of the United States are affected, obtain US counsel. Each state law has its own definition of personal information, its own harm threshold and its own notice content and deadline, and several require notice to the state attorney general.", "notifications": [ { "to": "individuals", "recipientName": "Affected United States residents, and in many states the state attorney general", "mandatory": true, "deadlineText": "set by each state's law; several states require notice within 30, 45 or 60 days of discovery", "deadlineHours": null, "deadlineNotes": "All 50 states, the District of Columbia, Puerto Rico and the US Virgin Islands have breach notification laws with their own triggers, deadlines and regulator notices. Obtain US counsel for the states involved.", "method": "Confirm the states involved and consult the current state law summaries.", "url": "https://www.ncsl.org/technology-and-communication/security-breach-notification-laws" } ], "recordKeeping": "n/a", "penalties": "varies", "sources": [ { "title": "NCSL, Security Breach Notification Laws", "url": "https://www.ncsl.org/technology-and-communication/security-breach-notification-laws", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "Every US state has its own breach notification law. This entry is a prompt to obtain US counsel; state rules are not applied here." }, { "id": "processor-duty", "name": "Service provider duty to the organizations whose data you hold", "fullName": "PIPEDA s. 10.2 and the accountability principle (Schedule 1, 4.1.3), Quebec Private Sector Act s. 3.5, Alberta PIPA s. 34.1 and OIPC guidance, plus your contracts", "jurisdiction": "federal", "sector": "contractual", "status": "in-force", "inForceDate": null, "appliesTo": "Organizations that hold or process personal information on behalf of other organizations: managed service providers, SaaS and cloud hosts, payroll and benefits providers, call centres, marketing agencies, law and accounting firms holding client data.", "triggerStandard": "any breach of security safeguards affecting information held for another organization", "triggerExplainer": "Under PIPEDA the organization in control of the information remains responsible for reporting and notification even when a processor suffers the breach; the OPC says the principal organization needs contractual arrangements with the processor to address breach obligations, and that a processor still has its own obligations under the Act. In practice the processor must tell the principal organization promptly and with enough detail to assess harm. Quebec's s. 3.5 duty applies to any enterprise holding the information, and Alberta OIPC guidance places the reporting duty on the organization with control. Most data processing agreements set a notice window of 24 to 72 hours. Separately, PIPEDA s. 10.2 requires an organization notifying individuals to also notify any other organization or government institution that may be able to reduce the risk of harm.", "notifications": [ { "to": "other-organizations", "recipientName": "The organizations whose personal information you hold (the controllers or principal organizations)", "mandatory": true, "deadlineText": "as required by your contract; in the absence of a contractual term, promptly enough that the controller can meet its own duties", "deadlineHours": null, "deadlineNotes": "Read the data processing agreement or master services agreement for the notice period, the recipient and the required content. Many set 24, 48 or 72 hours.", "method": "Written notice to the contact named in the contract, with the facts known so far, the data sets and individuals affected, containment steps and a point of contact.", "url": "https://www.priv.gc.ca/en/privacy-topics/privacy-breaches/respond-to-a-privacy-breach-at-your-business/gd_pb_201810/" }, { "to": "other-organizations", "recipientName": "Other organizations or government institutions that can reduce the risk of harm (PIPEDA s. 10.2)", "mandatory": true, "deadlineText": "as soon as feasible after determining the breach has occurred", "deadlineHours": null, "deadlineNotes": "Applies to any organization that must notify individuals under PIPEDA: for example notifying a bank, a credit bureau or a payment processor so it can watch for fraud.", "url": "https://laws-lois.justice.gc.ca/eng/acts/P-8.6/page-2.html#h-416888" } ], "recordKeeping": "Keep the notice you gave and when you gave it; the controller's PIPEDA breach record will rely on it.", "penalties": "Contractual remedies under the agreement; for PIPEDA duties, see the PIPEDA regime.", "sources": [ { "title": "PIPEDA, s. 10.2, Notification to organizations", "url": "https://laws-lois.justice.gc.ca/eng/acts/P-8.6/page-2.html#h-416888", "section": "s. 10.2", "accessed": "2026-10-29" }, { "title": "OPC, What you need to know about mandatory reporting of breaches of security safeguards", "url": "https://www.priv.gc.ca/en/privacy-topics/privacy-breaches/respond-to-a-privacy-breach-at-your-business/gd_pb_201810/", "section": "Who is responsible when a third party processor is breached", "accessed": "2026-10-29" } ], "lastVerified": "2026-10-29", "notes": "Compiled from the sources above; the contract term governs the deadline to the controller. The OPC guidance addresses who is responsible for reporting when a processor is breached, not a processor to controller deadline." } ], "_meta": { "title": "Canadian breach notification rules", "publisher": "Frontier Cyber", "homepage": "https://frontiercyber.app/tools/breach-notification/", "license": "CC BY 4.0", "disclaimer": "General information, not legal advice. Each regime carries a lastVerified date and primary sources; confirm against the source before relying on it." } }