PIPEDA breach notification: when you must report, and who decides
Canada's private-sector privacy law makes you report some breaches to the Privacy Commissioner, tell the people affected, and keep a record of every breach. Here is the test, the timing and the paperwork.
Under PIPEDA, a breach of security safeguards involving personal information under your control has to be reported to the Privacy Commissioner of Canada when it is reasonable to believe it creates a real risk of significant harm to an individual. The same test decides whether you must notify the people affected. Both go out as soon as feasible after the organization determines that the breach has occurred. Every breach, reportable or not, goes into a record you keep for 24 months.
The form is the easy part. The hard part is the judgment call in the first days, made with incomplete facts, and the question of who in the building is allowed to make it.
This is a plain-language summary, not legal advice. Your counsel and your breach coach are the authority on your facts.
What does PIPEDA actually require?
Three duties, set by sections 10.1 and 10.3 of the Act and the Breach of Security Safeguards Regulations, in force since 1 November 2018.
| Duty | When it applies | When | Where it comes from |
|---|---|---|---|
| Report to the Privacy Commissioner | Real risk of significant harm | As soon as feasible after you determine the breach occurred | Subsections 10.1(1) and (2) |
| Notify affected individuals | Same test | As soon as feasible, same trigger | Subsections 10.1(3) and (6) |
| Keep a record | Every breach of safeguards, no threshold | Kept 24 months | Subsection 10.3(1), and Regulations, section 6 |
The text of section 10.1 is on Justice Laws, and the record rules are in the Regulations.
Two things in that table catch people out. The notice to individuals uses the same threshold as the report, so you rarely get one without the other. And the record has no threshold at all. A lost unencrypted USB key that you decide carries no real risk still goes in the log, with your reasoning.
What counts as a real risk of significant harm?
The phrase is usually shortened to RROSH. The Act defines the harm broadly. Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property (Personal Information Protection and Electronic Documents Act, subsection 10.1(7), 2018). “Includes” means the list is not closed.
Whether the risk is real turns on two factors the Act names: the sensitivity of the personal information involved in the breach; the probability that the personal information has been, is being or will be misused (Personal Information Protection and Electronic Documents Act, subsection 10.1(8), 2018).
The Privacy Commissioner’s guidance turns the second factor into questions you can actually answer in a meeting. Was there malicious intent, such as theft or hacking? Were several pieces of information taken together, which raises the risk of misuse? Has misuse already happened? And: Is the personal information adequately encrypted, anonymized or otherwise not easily accessible? (Office of the Privacy Commissioner of Canada, What you need to know about mandatory reporting of breaches of security safeguards, 2025).
On sensitivity, health and financial information are the obvious cases. The same guidance adds that any information can be sensitive, depending on the context. A client list is ordinary data in one firm and a disclosure of who is getting divorced in another.
How does the test play out on a real incident?
Take a professional services firm on a Tuesday morning. IT finds that a partner’s mailbox was accessed from overseas for more than a week. Inside it sit email threads with client tax documents attached.
Decision 1: Is this a breach of security safeguards? Yes. Personal information under the firm’s control was accessed without authorization. It goes in the record today, whatever happens next.
Decision 2: How sensitive is the information? Tax documents carry income, social insurance numbers and family details. High.
Decision 3: How probable is misuse? Someone logged in deliberately from an unfamiliar location, which is evidence of malicious intent. The attachments were readable. Nobody can yet say which ones were opened. High enough.
Decision 4: When did the firm “determine” the breach occurred? This is the one that matters for timing. A firm that waits for a forensic report to tell it which attachments were opened before it calls the breach a breach has not delayed the clock. It has started arguing about when the clock started.
Decision 5: Who signs off on reporting? If nobody can answer this in the room, the first four decisions sit in an inbox.
Now change one fact. The laptop that went missing was fully encrypted and the key was never on it. The breach still goes in the record. But the answer to the Commissioner’s question about encryption moves the probability of misuse, and with it, possibly the whole result. Write down why.
How fast is “as soon as feasible”?
PIPEDA sets no day count, which is unusual. The European rule many people quote is a fixed number of hours, and PIPEDA has nothing like it. The words are as soon as feasible after the organization determines that the breach has occurred, and they apply to the report and to the notices alike.
Two consequences follow. The clock starts at your determination, not at the first alert, so the record should show when you decided and on what facts. And “feasible” is read against what you could reasonably have done, which is why a firm with a rehearsed decision process tends to look better on the same facts than one that had to invent the process during the incident.
Other regimes run alongside. Quebec’s Law 25 has its own confidentiality incident rules. A federally regulated bank or insurer reporting to OSFI has a 24-hour window for that separate report (OSFI, Technology and Cyber Security Incident Reporting, 2021). Map which ones apply to you before you need to know.
Who reports when the breach happens at your vendor?
Usually you do. The Commissioner’s guidance says the duty rests with the organization in control of the information, and where you handed data to a processor, it finds it reasonable to interpret the principal organization as having control of the personal information and therefore responsibility for breach reporting (Office of the Privacy Commissioner of Canada, What you need to know about mandatory reporting of breaches of security safeguards, 2025).
That lines up with the accountability principle in the Act itself: an organization is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing (Personal Information Protection and Electronic Documents Act, Schedule 1, clause 4.1.3, 2000).
In practice that means your vendor contracts decide how fast you learn the facts you are legally on the hook to assess. Check them for a notice period, a named contact, and a duty to share what their forensics find.
What goes in the report and the notices?
The Regulations list it. The report to the Commissioner opens with a description of the circumstances of the breach and, if known, the cause and continues through the dates, the information involved, the number of people affected, what you have done to reduce harm, how you will notify, and a contact person (Breach of Security Safeguards Regulations, SOR/2018-64, section 2, 2018). The Commissioner takes reports through an online form on its website.
The notice to individuals has to let them understand what it means for them and what they can do about it, including a description of the steps that affected individuals could take to reduce the risk of harm (Breach of Security Safeguards Regulations, SOR/2018-64, section 3, 2018).
The volume is not small. In its 2025-2026 year the Commissioner received 696 breach reports from businesses, affecting 20,328,495 Canadians (Office of the Privacy Commissioner of Canada, 2025-2026 Annual Report to Parliament, 2026).
What happens if you get it wrong?
An organization that knowingly fails to report, notify or keep the record commits an offence, with a fine of up to $100,000 on indictment or $10,000 on summary conviction (Personal Information Protection and Electronic Documents Act, section 28, 2018). “Knowingly” carries weight there. Most organizations that end up in trouble did not decide to hide a breach. They never decided anything, and the record shows it.
The Commissioner can also ask to see your breach records, and they have to contain enough to show how you assessed the risk.
Who should make the call, and when do you practise it?
Name the decision owner in the incident response plan: usually the privacy officer or general counsel, with the authority to report without waiting for a committee. Name a deputy. Write down which facts they need, so the technical team knows what to bring them first.
Then run the decision once in a tabletop exercise, with the people who would really be in the room. The four-minute tabletop is a quick way to see where your own team stands. The test is not whether they pick the right answer. It is whether they know who decides, what they need to know, and how long the firm would take to get there.
How do you use this in your own tabletop?
Every section above can become a question for the room. Three to start with:
| For | Ask the room | Listen for |
|---|---|---|
| Technical | What exactly could the attacker see, and can we prove what they opened? | A clear line between what is known and what is assumed, with the logs to back it |
| Leadership | Who decides whether we report, and when did we “determine” the breach occurred? | A named owner, and a time written down |
| Board | If the Commissioner asked for our breach record tomorrow, what would it show? | A dated entry with the reasoning, even for breaches we did not report |
Questions
Is there a deadline for reporting a breach under PIPEDA?
No fixed number of days. The report and the notices go out as soon as feasible after you determine the breach has occurred. That is a judgment, so write down when you made the determination and why it took as long as it did.
Do we have to report a breach if the data was encrypted?
Not necessarily. The Privacy Commissioner asks whether the information was adequately encrypted or otherwise not easily accessible when you weigh the probability of misuse. Strong encryption with the key kept safe can bring the risk below the threshold. You still have to record the breach.
The breach happened at our vendor. Who reports?
Usually you do. The Commissioner reads PIPEDA as putting the reporting duty on the organization in control of the information, which is the one that handed it to the vendor for processing. Your contract with the vendor is what gets you the facts in time to do it.
Does PIPEDA apply in Quebec, Alberta and British Columbia?
Those three provinces have their own private-sector privacy laws, which apply instead of PIPEDA to most activity inside the province. PIPEDA still applies to federally regulated businesses and to personal information that crosses provincial or national borders. Quebec's Law 25 has its own incident rules.
Do we have to record a breach that is not reportable?
Yes. PIPEDA requires a record of every breach of security safeguards involving personal information under your control, reportable or not, and the Commissioner can ask to see it.