Breach notification: Saskatchewan

Privacy breach notification in Saskatchewan.

2 notification duties in Saskatchewan and 2 statutory harm tests, with who to tell, the timing the law sets, the threshold and the primary source for each. Last verified 2026-10-29.

Check your breach Assess the harm

At a glance

What applies in Saskatchewan.

Saskatchewan FOIP / LA FOIP In force. public bodies. Threshold: real risk of significant harm. Saskatchewan Information and Privacy Commissioner (voluntary) (conditional or voluntary): proactive reporting encouraged; OIPC asks for its questionnaire within 30 days of a proactive report.
Saskatchewan HIPA Voluntary. health information custodians. Threshold: none in statute; OIPC applies the LA FOIP real-risk-of-significant-harm practice. Saskatchewan Information and Privacy Commissioner (voluntary) (conditional or voluntary): OIPC recommendation: within ten calendar days of initiating containment.

The rules

Every notification duty in Saskatchewan.

Each row links the statute or regulator page it comes from and shows when it was last checked. Dataset version 2026-10-29.

Regime Applies to Notify Threshold Verified

Saskatchewan FOIP / LA FOIP The Freedom of Information and Protection of Privacy Act, s. 29.1, and The Local Authority Freedom of Information and Protection of Privacy Act, s. 28.1 In force since 2018-01-01

Saskatchewan government institutions (FOIP) and local authorities such as municipalities, school divisions, universities and the Saskatchewan Health Authority (LA FOIP).

Affected individuals: take all reasonable steps to notify (no statutory deadline) report
Saskatchewan Information and Privacy Commissioner (voluntary): proactive reporting encouraged; OIPC asks for its questionnaire within 30 days of a proactive report (conditional or voluntary) report

Records: No statutory register; OIPC guidelines recommend documenting every breach and the response.

Penalties: FOIP s. 68: fines up to $50,000 and/or one year imprisonment for knowingly collecting, using or disclosing personal information in contravention of the Act; no offence for failing to notify.

real risk of significant harm

Section 29.1 was added by S.S. 2017, c. 12 and the FOIP and LA FOIP amendments came into force January 1, 2018. LA FOIP s. 28.1 is the equivalent duty for local authorities (municipalities, school divisions, health authorities); the Commissioner's guidance explains how both are applied.

2026-10-29

Saskatchewan HIPA The Health Information Protection Act, S.S. 1999, c. H-0.021, s. 16 and The Health Information Protection Regulations, 2023 Voluntary

Saskatchewan trustees: Saskatchewan Health Authority, eHealth, physicians, pharmacists, other health professionals and facilities.

Affected individuals (OIPC expectation): at the earliest opportunity (OIPC) (conditional or voluntary) report
Saskatchewan Information and Privacy Commissioner (voluntary): OIPC recommendation: within ten calendar days of initiating containment (conditional or voluntary) report

Records: Not specified.

Penalties: HIPA s. 64 offence provisions apply; amounts are set in the Act.

none in statute; OIPC applies the LA FOIP real-risk-of-significant-harm practice

Private clinics also fall under PIPEDA for commercial activity. Trustees that are also local authorities (the Saskatchewan Health Authority and others listed under LA FOIP) are bound by the mandatory LA FOIP s. 28.1 duty to notify individuals; see the Saskatchewan FOIP / LA FOIP regime. The August 1, 2023 HIPA changes (MLT Aikins) did not add a breach notification duty.

2026-10-29

Spotted an error or a change in the law? Report a correction with the source. The full dataset is rules.json (CC BY 4.0).

The harm test

When a breach in Saskatchewan has to be reported.

The statutory wording, the factors the law names and the record you have to keep, from the harm thresholds dataset.

Saskatchewan FOIP and LA FOIP

The Freedom of Information and Protection of Privacy Act, s. 29.1; The Local Authority Freedom of Information and Protection of Privacy Act, s. 28.1

A government institution shall take all reasonable steps to notify an individual of an unauthorized use or disclosure of that individual's personal information by the government institution if it is reasonable in the circumstances to believe that the incident creates a real risk of significant harm to the individual (FOIP s. 29.1; LA FOIP s. 28.1 for local authorities). Neither Act defines significant harm or lists factors.

Factors the law names

The Commissioner's privacy breach guidelines: sensitivity of the personal information, probability of misuse, whether the information was recovered or protected, and the harm the individual could suffer

Records: No statutory register; the Commissioner's guidelines recommend documenting every breach and the response.

Verified 2026-10-29: FOIP (Saskatchewan) consolidated PDF ; OIPC SK Privacy Breach Guidelines for Government Institutions and Local Authorities (May 2023)

Saskatchewan HIPA (Commissioner's practice)

The Health Information Protection Act, S.S. 1999, c. H-0.021, s. 16; LA FOIP s. 28.1 for trustees that are local authorities

HIPA contains no breach notification provision and no significant harm test (consolidation with amendments to 2024, c. 4). The Commissioner directs trustees to follow the LA FOIP s. 28.1 practice: notify individuals where a real risk of significant harm exists, and report to the Commissioner within ten calendar days of initiating containment.

Factors the law names

Sensitivity of the personal health information
Probability of misuse
Whether the information was recovered or protected

Records: Not specified; document the assessment.

Verified 2026-10-29: OIPC SK Investigation Report 193-2024, 043-2025 (SHA)

Work through the test for your breach

Federal law

Federal rules that can apply in Saskatchewan too.

Federal duties follow the organization, not the province: a bank, a telecom or a private company in a province without its own private sector law reports under these as well.

PIPEDA Private-sector organizations that collect, use or disclose personal information in the course of commercial activity anywhere in Canada, federal works, undertakings and businesses (banks, telecoms, airlines, inter-provincial transport) and their employee data, and organizations in provinces without substantially similar private-sector law (every province except BC, Alberta and Quebec; health custodians in Ontario, NB, NS and NL are also substantially similar for health information).
Privacy Act / TBS Directive on Privacy Practices Federal government institutions subject to the Privacy Act (departments, agencies, Crown corporations listed in the schedule).
CCSPA (Bill C-8) Designated operators in federally regulated vital services and systems (telecommunications, interprovincial/international pipelines and power lines, nuclear, transportation, banking, clearing and settlement) once classes of operators are designated by regulation and listed in Schedule 2.
OSFI Incident Reporting Advisory Federally regulated financial institutions (banks, foreign bank branches, federal credit unions, life and P&C insurers, trust and loan companies). Administrators of federally regulated private pension plans have a separate OSFI advisory (2023) with the same 24-hour window, reported to pensions@osfi-bsif.gc.ca.
CIRO Rule 3703 CIRO investment dealer members. Mutual fund dealer members should confirm whether an equivalent reporting rule applies to them.
CSA continuous disclosure Reporting issuers (public companies) in Canadian jurisdictions.

Questions

Breach reporting in Saskatchewan, answered from the rules.

Do I have to report a privacy breach in Saskatchewan?

It depends on the kind of organization and the information involved. Saskatchewan FOIP / LA FOIP (in force, public bodies): the threshold is real risk of significant harm. Saskatchewan HIPA (voluntary, health information custodians): the threshold is none in statute; OIPC applies the LA FOIP real-risk-of-significant-harm practice. Federal rules such as PIPEDA can apply as well, depending on the organization.

How long do I have to report a breach in Saskatchewan?

Saskatchewan FOIP / LA FOIP: Saskatchewan Information and Privacy Commissioner (voluntary) (conditional or voluntary), proactive reporting encouraged; OIPC asks for its questionnaire within 30 days of a proactive report. Saskatchewan HIPA: Saskatchewan Information and Privacy Commissioner (voluntary) (conditional or voluntary), OIPC recommendation: within ten calendar days of initiating containment. Where a law sets a fixed number of hours or days, the breach notification tool shows a countdown.

Who has to be notified about a breach in Saskatchewan?

Saskatchewan FOIP / LA FOIP: Affected individuals; Saskatchewan Information and Privacy Commissioner (voluntary) (conditional or voluntary). Saskatchewan HIPA: Affected individuals (OIPC expectation) (conditional or voluntary); Saskatchewan Information and Privacy Commissioner (voluntary) (conditional or voluntary). Conditional recipients apply only in the circumstances the law sets out; the rules table above gives the detail for each.

What harm test applies in Saskatchewan?

Saskatchewan FOIP and LA FOIP: A government institution shall take all reasonable steps to notify an individual of an unauthorized use or disclosure of that individual's personal information by the government institution if it is reasonable in the circumstances to believe that the incident creates a real risk of significant harm to the individual (FOIP s. 29.1; LA FOIP s. 28.1 for local authorities). Neither Act defines significant harm or lists factors. Saskatchewan HIPA (Commissioner's practice): HIPA contains no breach notification provision and no significant harm test (consolidation with amendments to 2024, c. 4). The Commissioner directs trustees to follow the LA FOIP s. 28.1 practice: notify individuals where a real risk of significant harm exists, and report to the Commissioner within ten calendar days of initiating containment.

This page summarizes the law; it is not legal advice. Confirm the decision with counsel for anything you will act on.

Other jurisdictions