Breach notification: Yukon

Privacy breach notification in Yukon.

2 notification duties in Yukon and 2 statutory harm tests, with who to tell, the timing the law sets, the threshold and the primary source for each. Last verified 2026-10-29.

Check your breach Assess the harm

At a glance

What applies in Yukon.

Yukon ATIPP Act In force. public bodies. Threshold: risk of significant harm. Yukon Information and Privacy Commissioner: no statutory timeline.
Yukon HIPMA ss. 30-31 In force. health information custodians. Threshold: likelihood of significant harm. Yukon Information and Privacy Commissioner: within a reasonable timeframe.

The rules

Every notification duty in Yukon.

Each row links the statute or regulator page it comes from and shows when it was last checked. Dataset version 2026-10-29.

Regime Applies to Notify Threshold Verified

Yukon ATIPP Act Access to Information and Protection of Privacy Act, S.Y. 2018, c. 9, Part 3 Division on privacy breaches (ss. 31-34 region) In force since 2021-04-01

Yukon public bodies: departments, Crown corporations, Yukon University, Yukon Hospital Corporation, municipalities and school councils.

Affected individuals: no statutory timeline (Yukon ATIPP Office: timelines are not included in the Act or Regulation) report
Yukon Information and Privacy Commissioner: no statutory timeline report

Records: Public bodies must keep a written record of each privacy breach (government information note on s. 32(7)(b)).

Penalties: Offence provisions apply; amounts are set in the Act.

risk of significant harm

In force April 1, 2021. The Act and Regulation set no fixed timelines for notification; Yukon government procedures describe the expected steps and the s. 32(7)(b) duty to notify individuals.

2026-10-29

Yukon HIPMA ss. 30-31 Health Information Privacy and Management Act, S.Y. 2013, c. 16, ss. 30-31 In force since 2016-08-31

Yukon custodians: Department of Health and Social Services, Yukon Hospital Corporation, physicians, pharmacists and other health care providers.

Affected individuals: as soon as reasonably possible report
Yukon Information and Privacy Commissioner: within a reasonable timeframe report

Records: Not specified.

Penalties: Offence provisions apply; amounts are set in the Act.

likelihood of significant harm

Wording taken from a Yukon government sample protocol, not the Act. In-force date: the Whitehorse Daily Star reported on September 6, 2016 that HIPMA 'came into force last Wednesday', i.e. August 31, 2016.

2026-10-29

Spotted an error or a change in the law? Report a correction with the source. The full dataset is rules.json (CC BY 4.0).

The harm test

When a breach in Yukon has to be reported.

The statutory wording, the factors the law names and the record you have to keep, from the harm thresholds dataset.

Yukon ATIPP Act

Access to Information and Protection of Privacy Act, S.Y. 2018, c. 9, ss. 30 to 32

The Designated Privacy Officer assesses each privacy breach; if there is a risk of significant harm to an individual, all affected individuals must be notified and the Information and Privacy Commissioner and the head informed (s. 32). Significant harm means bodily harm, personal humiliation, reputational or relationship damage, loss of employment, business or professional opportunities, financial loss, negative effects on a credit rating, or damage to or loss of property, or any other similar type of harm (s. 1).

Factors the law names

The sensitivity of the personal information (s. 32(6)(a))
The probability that the personal information is, has been or will be used or disclosed in an unauthorized manner (s. 32(6)(b))
The number of affected individuals
Any relationship between the affected individuals and a recipient
The time elapsed since the breach
Mitigation measures taken
Whether lost or stolen information was recovered
Any other information that is relevant in the circumstances and is reasonably available (s. 32(6)(h))

Records: Keep a written record of each privacy breach; the report to the Commissioner must give the reasons for the risk finding and a copy of the individual notice.

Verified 2026-10-29: Yukon Government Privacy Breach Procedures (May 2021) ; Yukon University Privacy Breach Procedures IT 11.1 (March 2025), reproducing ATIPP s. 1 and s. 32(6)

Yukon HIPMA

Health Information Privacy and Management Act, S.Y. 2013, c. 16, ss. 30 and 31

Where there is a likelihood of significant harm to an individual from a security breach, the custodian must notify the individual and the Commissioner; where there is no such likelihood no notice is required.

Factors the law names

Sensitivity of the personal health information
Probability of misuse
Whether the information was recovered or protected

Records: Not specified; document the assessment.

Verified 2026-10-29: Yukon HSS Sample Breach Protocol (cites HIPMA ss. 30-31)

Work through the test for your breach

Federal law

Federal rules that can apply in Yukon too.

Federal duties follow the organization, not the province: a bank, a telecom or a private company in a province without its own private sector law reports under these as well.

PIPEDA Private-sector organizations that collect, use or disclose personal information in the course of commercial activity anywhere in Canada, federal works, undertakings and businesses (banks, telecoms, airlines, inter-provincial transport) and their employee data, and organizations in provinces without substantially similar private-sector law (every province except BC, Alberta and Quebec; health custodians in Ontario, NB, NS and NL are also substantially similar for health information).
Privacy Act / TBS Directive on Privacy Practices Federal government institutions subject to the Privacy Act (departments, agencies, Crown corporations listed in the schedule).
CCSPA (Bill C-8) Designated operators in federally regulated vital services and systems (telecommunications, interprovincial/international pipelines and power lines, nuclear, transportation, banking, clearing and settlement) once classes of operators are designated by regulation and listed in Schedule 2.
OSFI Incident Reporting Advisory Federally regulated financial institutions (banks, foreign bank branches, federal credit unions, life and P&C insurers, trust and loan companies). Administrators of federally regulated private pension plans have a separate OSFI advisory (2023) with the same 24-hour window, reported to pensions@osfi-bsif.gc.ca.
CIRO Rule 3703 CIRO investment dealer members. Mutual fund dealer members should confirm whether an equivalent reporting rule applies to them.
CSA continuous disclosure Reporting issuers (public companies) in Canadian jurisdictions.

Questions

Breach reporting in Yukon, answered from the rules.

Do I have to report a privacy breach in Yukon?

It depends on the kind of organization and the information involved. Yukon ATIPP Act (in force, public bodies): the threshold is risk of significant harm. Yukon HIPMA ss. 30-31 (in force, health information custodians): the threshold is likelihood of significant harm. Federal rules such as PIPEDA can apply as well, depending on the organization.

How long do I have to report a breach in Yukon?

Yukon ATIPP Act: Yukon Information and Privacy Commissioner, no statutory timeline. Yukon HIPMA ss. 30-31: Yukon Information and Privacy Commissioner, within a reasonable timeframe. Where a law sets a fixed number of hours or days, the breach notification tool shows a countdown.

Who has to be notified about a breach in Yukon?

Yukon ATIPP Act: Affected individuals; Yukon Information and Privacy Commissioner. Yukon HIPMA ss. 30-31: Affected individuals; Yukon Information and Privacy Commissioner. Conditional recipients apply only in the circumstances the law sets out; the rules table above gives the detail for each.

What harm test applies in Yukon?

Yukon ATIPP Act: The Designated Privacy Officer assesses each privacy breach; if there is a risk of significant harm to an individual, all affected individuals must be notified and the Information and Privacy Commissioner and the head informed (s. 32). Significant harm means bodily harm, personal humiliation, reputational or relationship damage, loss of employment, business or professional opportunities, financial loss, negative effects on a credit rating, or damage to or loss of property, or any other similar type of harm (s. 1). Yukon HIPMA: Where there is a likelihood of significant harm to an individual from a security breach, the custodian must notify the individual and the Commissioner; where there is no such likelihood no notice is required.

This page summarizes the law; it is not legal advice. Confirm the decision with counsel for anything you will act on.

Other jurisdictions