Work through the harm test the way regulators expect it done: how sensitive the information is, how likely it is to be misused, which harms the facts make plausible, and the conclusion in each statute's own words. It writes the reasoning out and gives you a record to keep. Nothing you enter leaves your browser.
Under PIPEDA, an organization must report a breach of security safeguards to the Privacy Commissioner and notify affected individuals if it is reasonable to believe the breach creates a real risk of significant harm. Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property. The factors are the sensitivity of the information and the probability it has been, is being or will be misused. Alberta uses the same test; Quebec asks whether there is a risk of serious injury; the health and public sector acts have their own wording, and some notify regardless of harm. The tool below applies each test that fits your organization and records the reasoning.
Already know the harm is real? Go straight to the breach notification decision tool for who to notify and by when. Finish here first and your answers carry across.
Answer what you know. Pick Not sure where you do not; the result marks the assessment incomplete and names what to confirm first. Re-run it as the investigation firms up and keep each version.
Load one to see the reasoning on a known set of facts, then change the answers to match yours. The same four run as regression tests on every change to the engine.
An HR laptop with employee files, full disk encryption, strong password, no sign the thief was after data.
ExpectedReal risk of significant harm not shown, on the strength of the encryption, with the basis to record.
A clinic emails one patient’s referral to the wrong physician, who confirms deletion the same day.
ExpectedLow probability of misuse; under PHIPA the patient is notified regardless, the IPC report depends on the circumstances.
Systems encrypted, a group claims to have taken customer and payment data and posts a sample.
ExpectedReal risk of significant harm present: high sensitivity, confirmed exfiltration by a malicious actor.
A public body employee looked up a family member’s benefits file over several months; no copies found.
ExpectedModerate to high: the recipient has a relationship with the individual, which regulators weigh heavily.
Every Canadian harm threshold we have verified, with the date: the statutory wording, the factors the regulator lists, the examples of harm and the record each requires. Dataset version 2026-10-29. Also available as JSON.
The test
An organization shall report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual (s. 10.1(1)). Unless otherwise prohibited by law, an organization shall notify an individual of any breach of security safeguards involving the individual's personal information under the organization's control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual (s. 10.1(3)).
Harm defined
Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property (s. 10.1(7)).
If met
Report to the Privacy Commissioner of Canada as soon as feasible, notify affected individuals as soon as feasible, and notify any other organization or government institution that may be able to reduce the risk of harm (ss. 10.1, 10.2).
Factors
Examples of harm
bodily harm; humiliation; damage to reputation or relationships; loss of employment, business or professional opportunities; financial loss; identity theft; negative effects on the credit record; damage to or loss of property
Record
Keep a record of every breach of security safeguards, whether or not it met the real risk of significant harm threshold, for 24 months after the day the organization determines the breach occurred, with enough detail to show the assessment (s. 10.3; SOR/2018-64 s. 6). Provide the records to the Commissioner on request.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
A material privacy breach is a privacy breach that could reasonably be expected to create a real risk of significant harm to an individual (Policy on Privacy Protection, Appendix A, as restated in the TBS Privacy Breach Management Toolkit). A privacy breach is improper or unauthorized access to, creation, collection, use, disclosure, retention or disposal of personal information.
If met
Report material privacy breaches to the Treasury Board Secretariat and the Privacy Commissioner no later than seven days after the institution determines the breach is material, and notify affected individuals unless notification would cause further harm (with the justification sent to the OPC and TBS).
Factors
Examples of harm
physical injury or bodily harm; embarrassment or humiliation; damage to reputation or relationships; loss of job, business or professional opportunities; financial loss; identity theft; negative effects on a credit record; damage to or loss of property
Record
Keep a record of every privacy breach, material or not, for five years after the date the institution discovered the breach; records of material breaches include the report sent to the OPC and TBS.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
PIPA contains no mandatory breach notification provision. The Commissioner recommends, as best practice, notifying affected individuals and reporting to the OIPC where a breach could reasonably be expected to result in significant harm.
If met
British Columbia has no health-specific privacy act: private clinics and practices fall under PIPA, health authorities and hospitals under FIPPA. Voluntary as of 2026-10-29: no PIPA amendment has been introduced (Bill 9, 2026 amends FIPPA only). The OIPC strongly recommends notifying individuals and reporting to it where significant harm is reasonably possible. Organizations with customers outside BC, Alberta and Quebec are bound by PIPEDA's mandatory test as well.
Factors
Examples of harm
identity theft; risk of physical harm; humiliation and damage to personal or professional reputations; loss of business or employment opportunities; financial loss
Record
No statutory requirement; the OIPC recommends documenting every breach and the response.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
If a privacy breach involving personal information in the custody or under the control of a public body occurs, the head must, without unreasonable delay, notify an affected individual if the privacy breach could reasonably be expected to result in significant harm to the individual, and notify the commissioner if the privacy breach could reasonably be expected to result in such harm (s. 36.3(2)). A privacy breach is the theft or loss, or the collection, use or disclosure that is not authorized by Part 3, of personal information in the custody or under the control of a public body (s. 36.3(1)).
Harm defined
Significant harm includes identity theft or significant (i) bodily harm, (ii) humiliation, (iii) damage to reputation or relationships, (iv) loss of employment, business or professional opportunities, (v) financial loss, (vi) negative impact on a credit record, or (vii) damage to, or loss of, property (s. 36.3(2)(a)). The FOIPPA Manual says the list is non-exhaustive and each breach needs a harms assessment.
If met
Notify affected individuals and the Information and Privacy Commissioner without unreasonable delay. Health authorities and hospitals in British Columbia are public bodies under FIPPA; private clinics fall under PIPA.
Factors
Examples of harm
identity theft; bodily harm; humiliation; damage to reputation or relationships; loss of employment, business or professional opportunities; financial loss; identity theft; negative effects on the credit record; damage to or loss of property
Record
The privacy management program (s. 36.2) must include documented breach processes; s. 36.3 sets no retention period.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
An organization having personal information under its control must, without unreasonable delay, provide notice to the Commissioner of any incident involving the loss of or unauthorized access to or disclosure of the personal information where a reasonable person would consider that there exists a real risk of significant harm to an individual as a result of the loss or unauthorized access or disclosure (s. 34.1(1)).
Harm defined
PIPA does not define significant harm. The Commissioner: harm is some damage or detriment or injury to the individual; significant means important, meaningful, with non-trivial consequences or effects; a real risk means the likelihood is more than mere speculation or conjecture, with a cause and effect relationship between the incident and the possible harm. Rating the risk only as low, medium or high is not an assessment.
If met
Notify the Commissioner without unreasonable delay; the Commissioner may then require the organization to notify affected individuals (s. 37.1), with an expedited process where the risk is obvious and immediate. Organizations may notify individuals on their own initiative.
Factors
Examples of harm
bodily harm; embarrassment, hurt or humiliation; damage to reputation or relationships; loss of employment, business or professional opportunities; financial loss; identity theft; fraud; negative effects on a credit record; damage to or loss of property; blackmail or extortion; email phishing or spear phishing attacks
Record
No statutory breach register. The notice to the Commissioner must be in writing and include the circumstances, the date or period, the information involved, an assessment of the risk of harm to individuals, the estimated number of individuals at real risk of significant harm, the steps taken to reduce harm and to notify individuals, and a contact person (PIPA Regulation s. 19).
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
Where a reasonable person would consider that there exists a real risk of significant harm to an individual as a result of the loss of, or unauthorized access to or disclosure of, personal information or data derived from it, the public body must notify the Commissioner, the Minister and the affected individuals.
If met
Notify the Commissioner, the Minister and affected individuals as soon as reasonably practicable (s. 10(2)-(3)).
Factors
Examples of harm
bodily harm; humiliation; damage to reputation or relationships; loss of employment, business or professional opportunities; financial loss; identity theft; negative effects on the credit record; damage to or loss of property
Record
The privacy management program (mandatory from June 11, 2026) must include breach handling and documentation.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
A custodian must, as soon as practicable, give notice of any loss of, or unauthorized access to or disclosure of, individually identifying health information in its custody or control where the custodian determines there is a risk of harm to an individual as a result (s. 60.1(2)).
Harm defined
Harm is some damage or detriment or injury that could be caused to affected individuals because of the incident (OIPC). The custodian must consider all relevant factors, including those in the Health Information Regulation s. 8.1.
If met
Notify the Commissioner, the Minister of Health and the affected individuals as soon as practicable.
Factors
Examples of harm
identity theft; fraud; embarrassment; mental harm; physical harm; financial harm; damage to reputation; adverse effect on the provision of a health service
Record
No general breach record duty in s. 60.1; a decision not to notify an individual because notice could harm their mental or physical health must be reported to the Commissioner immediately with the breach report (Regulation s. 8.3). Affiliates must notify the custodian as soon as practicable (s. 60.1(1)).
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
A government institution shall take all reasonable steps to notify an individual of an unauthorized use or disclosure of that individual's personal information by the government institution if it is reasonable in the circumstances to believe that the incident creates a real risk of significant harm to the individual (FOIP s. 29.1; LA FOIP s. 28.1 for local authorities). Neither Act defines significant harm or lists factors.
If met
Take all reasonable steps to notify the affected individual. Reporting to the Commissioner is recommended, not required by statute.
Factors
Examples of harm
bodily harm; humiliation; damage to reputation or relationships; loss of employment, business or professional opportunities; financial loss; identity theft; negative effects on the credit record; damage to or loss of property
Record
No statutory register; the Commissioner's guidelines recommend documenting every breach and the response.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
HIPA contains no breach notification provision and no significant harm test (consolidation with amendments to 2024, c. 4). The Commissioner directs trustees to follow the LA FOIP s. 28.1 practice: notify individuals where a real risk of significant harm exists, and report to the Commissioner within ten calendar days of initiating containment.
If met
Notify individuals where a real risk of significant harm exists (mandatory for trustees that are local authorities under LA FOIP s. 28.1); report to the Commissioner as recommended.
Factors
Examples of harm
bodily harm; humiliation; damage to reputation or relationships; loss of employment, business or professional opportunities; financial loss; identity theft; negative effects on the credit record; damage to or loss of property
Record
Not specified; document the assessment.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
A public body must notify an individual of a privacy breach that, after considering the factors prescribed by regulation, could reasonably be expected to create a real risk of significant harm to the individual (s. 41.1(2)).
If met
Notify the affected individual as soon as reasonably practicable; report to the Ombudsman as the Regulation requires.
Factors
Examples of harm
bodily harm; humiliation; damage to reputation or relationships; loss of employment, business or professional opportunities; financial loss; identity theft; negative effects on the credit record; damage to or loss of property
Record
Not specified in the sources reviewed; document the assessment.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
A trustee must notify the individual if a privacy breach could reasonably be expected to create a real risk of significant harm to the individual, having regard to the prescribed factors (s. 19.0.1(2)), as soon as practicable after the breach becomes known, directly and in the prescribed form (s. 19.0.1(3)), and must also notify the Ombudsman (s. 19.0.1(4)).
Harm defined
Significant harm includes bodily harm, humiliation, damage to the individual's reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record, and damage to or loss of property (s. 19.0.1(1)).
If met
Notify the affected individual directly and in the prescribed form as soon as practicable, and notify the Ombudsman.
Factors
Examples of harm
bodily harm; humiliation; damage to reputation or relationships; loss of employment, business or professional opportunities; financial loss; identity theft; negative effects on the credit record; damage to or loss of property
Record
Not specified in s. 19.0.1; the notice must contain the nine prescribed elements (Regulation s. 8.8), so keep the assessment that supports them.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
Where personal information is stolen, lost or used or disclosed without authority and it is reasonable in the circumstances to believe that there is a real risk that a significant harm to an individual would result, or in other prescribed circumstances, the institution must notify the Commissioner and the affected individuals.
Harm defined
Significant harm includes financial loss, identity theft and damage to reputation.
If met
Notify the Information and Privacy Commissioner and affected individuals as soon as feasible. Municipal institutions under MFIPPA have no statutory duty; the Commissioner recommends the same practice.
Factors
Examples of harm
financial loss; identity theft; damage to reputation
Record
Keep and maintain a record of every theft, loss or unauthorized use or disclosure reported to the Commissioner, for the annual statistical report (s. 40.1(8)).
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
A health information custodian that has custody or control of personal health information about an individual shall notify the individual at the first reasonable opportunity if the information is stolen or lost or if it is used or disclosed without authority (s. 12(2)). The Commissioner must be notified where a prescribed circumstance exists (s. 12(3)).
If met
Notify the individual at the first reasonable opportunity in every case; notify the Commissioner where a prescribed circumstance exists; report annual statistics by March 1.
Factors
Record
Keep records sufficient to produce the annual statistical report to the Commissioner (O. Reg. 329/04 s. 6.4) and retain the breach documentation.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
If the incident presents a risk of serious injury, the person carrying on an enterprise must promptly notify the Commission d'acces a l'information and any person whose personal information is concerned by the incident (s. 3.5).
Harm defined
In assessing the risk of injury to a person whose personal information is concerned by a confidentiality incident, the enterprise must consider, in particular, the sensitivity of the information concerned, the anticipated consequences of its use and the likelihood that such information will be used for injurious purposes, and must consult the person in charge of the protection of personal information (s. 3.7).
If met
Notify the Commission d'acces a l'information and the persons concerned promptly, and take reasonable measures to reduce the risk of injury and prevent new incidents of the same nature (s. 3.5). Quebec has no separate health privacy act: private clinics and practices fall under this Act, public health institutions under the Access Act.
Factors
Examples of harm
identity theft; fraud; discrimination; severe psychological distress; threat to physical safety; unwanted solicitation; harassment; manipulation; damage to reputation (CAI guide, January 2026; the Act gives no list)
Record
Keep a register of every confidentiality incident, whether or not the risk of injury is serious, recording the information involved, the circumstances, the date or period, the date the enterprise became aware, the number of persons concerned, the elements leading it to conclude whether there is a risk of serious injury, the dates of any notices and the measures taken after the incident; keep each entry up to date for at least five years after awareness and provide a copy to the Commission on request (s. 3.8; Regulation respecting confidentiality incidents, CQLR c. A-2.1, r. 3.1, ss. 7 and 8).
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
A public body that has cause to believe a confidentiality incident has occurred must take reasonable measures to reduce the risk of injury; if the incident presents a risk of serious injury, it must promptly notify the Commission d'acces a l'information and the persons concerned (s. 63.8).
If met
Notify the Commission d'acces a l'information and the persons concerned promptly. Public health institutions in Quebec are public bodies under this Act; private clinics fall under the private sector Act.
Factors
Examples of harm
identity theft; fraud; financial loss; humiliation; damage to reputation; discrimination
Record
Register of all confidentiality incidents (s. 63.11), retained at least five years after awareness (Regulation s. 8); copy to the Commission on request.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
Where it is reasonable to believe that a privacy breach creates a risk of significant harm to an individual, considering the sensitivity of the information and the probability of misuse, the public body must notify the individual and the Ombud.
Harm defined
Significant harm includes humiliation, damage to reputation or relationships, financial loss, identity theft and damage to property.
If met
Notify the affected individual and the Ombud.
Factors
Examples of harm
humiliation; damage to reputation or relationships; financial loss; identity theft; damage to property
Record
Investigate every actual or suspected breach and maintain a registry of every actual privacy breach and the corrective measures taken (Reg s. 4.2(4)(b)).
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
A custodian must notify the individual of any theft, loss, improper disposal, or unauthorized disclosure of or access to personal health information, unless the custodian reasonably believes the incident will not adversely impact the provision of health care or other benefits, will not adversely affect the individual's mental, physical, economic or social well-being, and will not lead to the identification of the individual (s. 49(2)).
If met
Notify the individual and the Ombud at the first reasonable opportunity, in the prescribed manner, unless all three exceptions are reasonably believed to apply (s. 49(1)(c), (2)).
Factors
Examples of harm
adverse impact on health care or benefits; harm to mental, physical, economic or social well-being; identification of the individual
Record
Not specified in s. 49; document the assessment.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
The current Act has no breach notification duty; reporting to the Information and Privacy Commissioner is voluntary. The new Act introduces mandatory notification where a breach creates a real risk of significant harm, from April 1, 2027.
If met
Voluntary until April 1, 2027; thereafter notify the Commissioner and affected individuals where a real risk of significant harm exists.
Factors
Examples of harm
bodily harm; humiliation; damage to reputation or relationships; loss of employment, business or professional opportunities; financial loss; identity theft; negative effects on the credit record; damage to or loss of property
Record
None under the current Act.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
Where a custodian believes on a reasonable basis that personal health information has been stolen, lost, or accessed or disclosed without authority, and that this creates potential for harm or embarrassment to the individual, the custodian must notify the individual at the first reasonable opportunity (s. 69). A custodian that decides not to notify because there is no potential for harm or embarrassment must instead notify the Review Officer (s. 70).
If met
Notify the individual, or, where you conclude there is no potential for harm or embarrassment, notify the Review Officer of that decision.
Factors
Examples of harm
harm; embarrassment
Record
Not specified; document the assessment and any decision not to notify.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
The FOIPP Act contains no breach notification duty. The Commissioner encourages voluntary reporting using the same process as the Health Information Act, assessing the risk of harm to individuals.
If met
Voluntary: report to the Commissioner and notify individuals where harm is reasonably possible.
Factors
Examples of harm
bodily harm; humiliation; damage to reputation or relationships; loss of employment, business or professional opportunities; financial loss; identity theft; negative effects on the credit record; damage to or loss of property
Record
None required; document the assessment.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
A custodian must notify the individual of theft, loss, or unauthorized access or disclosure of personal health information, unless the custodian reasonably believes the breach will not have an adverse impact on the provision of health care or other benefits, or on the individual's mental, physical, economic or social well-being.
If met
Notify the individual, and the Commissioner, as the Act and the Commissioner's guidelines require.
Factors
Examples of harm
adverse impact on health care or benefits; harm to mental, physical, economic or social well-being
Record
Not specified; the Commissioner's guidelines expect documentation.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
Individuals must be notified at the first reasonable opportunity when personal information is stolen, lost, improperly disposed of, or accessed or disclosed without authority, unless the head reasonably believes the breach creates no risk of significant harm (s. 64(3), (7)). The commissioner must be informed of every breach involving unauthorized collection, use or disclosure, regardless of harm (s. 64(4)).
Harm defined
Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record, and damage to or loss of property (s. 64(8)).
If met
Notify individuals at the first reasonable opportunity unless the head reasonably believes there is no risk of significant harm (the commissioner may still recommend notification); inform the commissioner of every reasonably believed breach involving unauthorized collection, use or disclosure.
Factors
Examples of harm
bodily harm; humiliation; damage to reputation or relationships; loss of employment, business or professional opportunities; financial loss; identity theft; negative effects on the credit record; damage to or loss of property
Record
Not specified in s. 64; document the assessment.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
A custodian must notify the individual of any theft, loss, improper disposal, or unauthorized disclosure or access, unless the custodian reasonably believes it will not adversely affect the provision of health care or other benefits to the individual, or the individual's mental, physical, economic or social well-being (s. 15(3), (7)). The commissioner must be informed of a material breach involving unauthorized collection, use or disclosure.
If met
Notify the individual at the first reasonable opportunity unless the exception is reasonably believed to apply; inform the commissioner of material breaches.
Factors
Examples of harm
adverse effect on health care or benefits; harm to mental, physical, economic or social well-being
Record
Not specified; document the assessment.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
The Designated Privacy Officer assesses each privacy breach; if there is a risk of significant harm to an individual, all affected individuals must be notified and the Information and Privacy Commissioner and the head informed (s. 32). Significant harm means bodily harm, personal humiliation, reputational or relationship damage, loss of employment, business or professional opportunities, financial loss, negative effects on a credit rating, or damage to or loss of property, or any other similar type of harm (s. 1).
If met
Notify affected individuals and inform the Commissioner and the head of the public body.
Factors
Examples of harm
bodily harm; humiliation; damage to reputation or relationships; loss of employment, business or professional opportunities; financial loss; identity theft; negative effects on the credit record; damage to or loss of property; any other similar type of harm
Record
Keep a written record of each privacy breach; the report to the Commissioner must give the reasons for the risk finding and a copy of the individual notice.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
Where there is a likelihood of significant harm to an individual from a security breach, the custodian must notify the individual and the Commissioner; where there is no such likelihood no notice is required.
If met
Notify the individual and the Commissioner where significant harm is likely.
Factors
Examples of harm
bodily harm; humiliation; damage to reputation or relationships; loss of employment, business or professional opportunities; financial loss; identity theft; negative effects on the credit record; damage to or loss of property
Record
Not specified; document the assessment.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
Notify affected individuals if it is reasonable to believe the breach creates a real risk of significant harm, considering the sensitivity of the information and the probability of misuse (s. 49.10). Report to the Commissioner only if the breach is material, considering sensitivity, the number of individuals, the likelihood of harm and whether the cause is systemic (s. 49.9).
Harm defined
Harm includes bodily harm, humiliation, damage to reputation, damage to a relationship, loss of employment, business or professional opportunity, negative effects on credit records, damage to or loss of property, financial loss and identity theft (s. 49.7).
If met
Notify affected individuals as soon as reasonably possible where a real risk of significant harm exists, with enough information to understand the significance and take protective steps; report material breaches to the Commissioner as soon as reasonably possible after determining materiality; notify other bodies that can mitigate the harm (s. 49.11).
Factors
Examples of harm
bodily harm; humiliation; damage to reputation or relationships; loss of employment, business or professional opportunities; financial loss; identity theft; negative effects on the credit record; damage to or loss of property
Record
Document the assessment; no retention period identified in the sources reviewed.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
Notify affected individuals of any inappropriate access, loss or theft of personal health information (s. 87). Notify the Commissioner and law enforcement where information is lost or stolen, or where fraud or identity theft leads to disclosure, alteration, destruction or disposal, unless the incident does not present a reasonable risk of harm (Regulation s. 15).
If met
Notify affected individuals; notify the Commissioner and law enforcement where a reasonable risk of harm exists.
Factors
Examples of harm
identity theft; fraud; harm to the individual
Record
Investigate, and keep a record of the breach and the corrective measures taken (Regulation s. 14).
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
The test
Notify affected individuals if it is reasonable to believe the breach creates a real risk of significant harm, considering the sensitivity of the information and the probability of misuse (s. 49.10). Report to the Commissioner only if the breach is material, considering sensitivity, the number of individuals, the likelihood of harm and whether the cause is systemic (s. 49.9).
Harm defined
Harm includes bodily harm, humiliation, damage to reputation, damage to a relationship, loss of employment, business or professional opportunity, negative effects on credit records, damage to or loss of property, financial loss and identity theft (s. 49.7).
If met
Notify affected individuals as soon as reasonably possible where a real risk of significant harm exists, with enough information to understand the significance and take protective steps; report material breaches to the Commissioner as soon as reasonably possible after determining materiality; notify other bodies that can mitigate the harm (s. 49.11).
Factors
Examples of harm
bodily harm; humiliation; damage to reputation or relationships; loss of employment, business or professional opportunities; financial loss; identity theft; negative effects on the credit record; damage to or loss of property
Record
Document the assessment; no retention period identified in the sources reviewed.
Sources, verified 2026-10-29
Who to notify and by when: see this regime in the notification tool.
Open items: 11 entries are marked above because the legislation site blocked a verbatim read at the last review; they cite the regulator's own reproduction and are first on the list for the quarterly re-verification. The full research record is in the site repository under docs.
Spotted an error or a change in the law? Report a correction with the source and we will fix the dataset in a pull request. Corrections ship with a new version date.
The engine is a short set of rules you can read. It never decides for you; it shows every step so counsel can agree or disagree with a specific line.
Each category of information carries a weight regulators have treated as sensitive on its own: health, financial, government identifiers, credentials and biometrics highest; identity details, employment records and information about minors next; contact details alone lowest. Combinations add to the score, because together they let someone impersonate or profile a person. Data that cannot readily be tied to a named person scores lower. Children, patients and people at risk raise it. Scale adds one step above a thousand people. Five or more is high, three or four moderate.
What happened sets a base: a misdirected message low, a lost device or insider access middle, an intrusion or public exposure high. Who has the information, whether it was recovered, whether it was encrypted with the key secure, how long it was exposed and whether misuse has been seen move the score. Two facts override the arithmetic: confirmed or attempted misuse makes probability high whatever else is true, and strong encryption plus confirmed recovery makes it low.
High sensitivity with any probability above low, or moderate sensitivity with high probability, means the risk is present. High sensitivity with low probability, moderate with moderate, or low sensitivity with high probability means it is likely: treat the test as met unless the open facts resolve the other way. The rest is not shown on the facts entered. One mitigation is decisive: strong encryption with the key secure and no sign of misuse takes a high sensitivity, low probability case to not shown, as regulators treat an encrypted lost device. Three or more unknowns make the assessment incomplete unless misuse has actually been seen, and the result names the facts to confirm first. The same conclusion is then phrased in each applicable statute's words; statutes with no harm threshold are marked notify regardless.
The engine runs in your browser and is covered by automated tests; how we built it explains the design. Weights are documented choices, not law; the statutes say what the factors are, not how to add them.
It is the test PIPEDA and Alberta PIPA use to decide whether a breach must be reported and individuals notified. Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment or business opportunities, financial loss, identity theft, negative effects on a credit record and damage to or loss of property. A real risk means more than a speculative one, judged mainly on how sensitive the information is and how likely it is to be misused.
No. It structures the assessment the way regulators expect it done, applies the statutory factors to your answers, shows its reasoning and produces a record. The conclusion is a reasoned indicator for your incident lead and counsel. The organization remains responsible for the decision, and the tool says what facts would change it.
Answer Not sure. The tool marks the assessment incomplete, names the facts that matter most and still gives a provisional view. Regulators expect you to assume exposure until you can show otherwise, so unknowns weigh toward notifying. Re-run it as the investigation firms up and keep each version in the record.
Ontario PHIPA and some public sector acts require notification whatever the harm. The assessment still matters: it decides what you tell individuals, which steps you offer them, whether a report to the regulator is required under the prescribed categories, and how you document the decision. The result marks these regimes as notify regardless.
PIPEDA requires a record of every breach of security safeguards, including the assessment, kept for 24 months. Quebec requires a register of confidentiality incidents. Print the record or copy it as text into your incident file. The tool itself stores nothing.
This tool answers whether the harm threshold is met. The breach notification decision tool answers who you must notify and by when. Finish here, then carry your answers across with one click; the notification tool reads them and pre-fills its questions. Nothing is sent to a server in either step.
Tell us which entry and what the source says. We read every report, correct the dataset in a pull request with the source quoted, and ship the fix with a new version date. Expect a reply within five business days.
Pulled from the privacy commissioners, the Cyber Centre and Canadian law firm bulletins, refreshed hourly. Read these when a rule in the tool looks out of date; the law moves faster than any dataset.
Loading the latest items.
Frontier Cyber runs the harm assessment with you, drafts the regulator report and the notices, and handles the regulator conversation. Request help and a consultant replies the same business day.
Start on Frontier VerifyYou will get a written scope and a fixed price, not a call booking link.