PIPEDA Breach Notification Decision Tree

PIPEDA's breach rules turn on one concept: a breach of security safeguards. That means the loss of, unauthorised access to, or unauthorised disclosure of personal information because a safeguard failed or was missing. A stolen laptop, a hacked mailbox, a ransomware infection, a misdirected email with a client list attached, a vendor that exposed your customer data. All of these count.

Two obligations flow from there. First, you must record every breach of security safeguards, even trivial ones, and keep that record for 24 months. Second, if the breach creates a real risk of significant harm to an individual (the law calls this RROSH), you must report it to the Office of the Privacy Commissioner of Canada as soon as feasible, notify the affected individuals as soon as feasible, and notify any other organisations or government bodies that can reduce the harm. Knowingly failing to report, notify, or keep records is an offence that can lead to fines.

If PIPEDA is new territory, read our plain-talk guide to PIPEDA compliance first, or work through the PIPEDA checklist. This tool only covers the breach side.

How RROSH is assessed. The law points at two factor groups: the sensitivity of the information involved, and the probability the information has been, is being, or will be misused. Sensitive data plus a plausible path to misuse means report and notify. A lost encrypted phone that was remotely wiped within the hour usually does not. A hacked inbox full of client financial records almost always does. In between, it depends, and that is exactly when you document your reasoning and get legal advice.

What good notification looks like. Tell affected people what happened, what information was involved, what you have done to reduce the risk, and what they can do to protect themselves. Do it directly (email, letter, phone) wherever possible, and do it as soon as feasible. Feasible means you may take a short pause to understand scope so your notice is accurate, not that you can sit on it for a quarter.

Breach response goes far better when the plumbing already exists: a breach register template, an incident response plan people have rehearsed, backups you have actually test-restored. That is the boring work we do for clients under managed compliance, and it is the difference between a controlled 48 hours and a very bad month.

If your organisation is a private-sector business in British Columbia or Alberta, much of your day-to-day handling of personal information may fall under BC PIPA or Alberta PIPA rather than PIPEDA, because both provinces have their own private-sector privacy laws. Alberta PIPA has its own mandatory breach reporting, run through the Alberta Information and Privacy Commissioner, so an Alberta business may owe a report to the Alberta Commissioner rather than (or as well as) the federal one. PIPEDA still applies to some activities, including personal information that crosses provincial or national borders, so many BC and Alberta organisations need to think about both regimes.

We break this down in plain terms in BC PIPA vs PIPEDA and Alberta PIPA explained. If you operate in either province, read the one that applies to you before relying on the checklist above.