How to report a breach of security safeguards under PIPEDA, step by step

Since Nov. 1, 2018, private-sector organizations covered by the Personal Information Protection and Electronic Documents Act (PIPEDA) have had to report certain breaches to the Office of the Privacy Commissioner of Canada (OPC), notify the people affected and keep a record of every breach. The test is whether it is reasonable to believe the breach creates a real risk of significant harm (often shortened to RROSH) to an individual. The number of people affected does not change the obligation: one person is enough.

IT teams usually discover breaches and hold the evidence, so they shape how fast and how well the organization can report. This guide follows the OPC's published guidance. Provincial laws in Quebec, Alberta and British Columbia, and sector rules, can add separate duties.

Step 1: Contain the breach and preserve evidence

1. Stop the exposure: revoke shared links, disable compromised accounts, reset credentials and API keys, isolate affected hosts, or ask the recipient of a misdirected file to delete it and confirm in writing.
2. Preserve logs, mailbox audit records, firewall and VPN logs and disk images before systems are rebuilt. Note the time you first learned of the event.
3. Open a ticket or case file. Everything you collect will feed the report and the breach record.
4. The OPC's page What you need to know about mandatory reporting of breaches of security safeguards links to its containment and prevention checklists.

Step 2: Establish the facts

Gather what the report will need:

• what happened and the cause, if known;
• the date or period of the breach, even if approximate;
• exactly which personal information was involved (names, contact details, SIN, financial, health, credentials);
• how many people were affected, or an estimate;
• whether the data was encrypted, recovered or deleted, and who had access to it.

Step 3: Assess the real risk of significant harm

Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment or business opportunities, financial loss, identity theft, negative effects on a credit record and damage to or loss of property. The OPC asks you to weigh two factors:

1. Sensitivity. Health and financial information is generally sensitive, but context matters. A list of names can be sensitive if it reveals, for example, the clients of an addiction clinic.
2. Probability of misuse. Consider who accessed the data, how long it was exposed, whether there is evidence of malicious intent (a ransomware group or a thief, as opposed to an employee who opened the wrong file), and whether it was recovered or properly encrypted.

The OPC offers an online tool, Assess if a privacy breach poses a real risk of significant harm to an individual, and its results can be attached to a report. Write down your reasoning either way: if you decide there is no RROSH, your breach record must explain why.

Step 4: Report to the OPC as soon as feasible

The law requires the report as soon as feasible after you determine a breach of security safeguards has occurred and poses a real risk of significant harm. Do not wait for the investigation to finish; you can add information later.

1. Go to the OPC's Report a privacy breach at your business page. The secure online breach reporting form is the preferred route.
2. On the Request a link to submit a breach report screen, enter your email address and select Submit, then open the link the OPC sends.
3. On the PIPEDA breach report screen, select New submission. You can fill in the form online or choose Upload a completed breach report form to send the PDF version.
4. Include the circumstances and cause, the date or period, the personal information involved, the number of people affected, steps taken to reduce harm, how and when you will notify people, and a contact person.
5. On the final screen, download a copy of the submission for your file. To add documents later, use the online form with the temporary tracking number or PIPEDA file number you receive.

Step 5: Notify affected individuals

1. Notify people as soon as feasible after determining there is RROSH, unless a law prohibits it.
2. Use direct notice (in person, phone, mail or email) where possible. Indirect notice, such as a public announcement or website notice, is allowed only if direct notice would cause further harm or undue hardship, or if you do not have contact details.
3. The notice must describe the circumstances, the date or period, the information involved, what you have done to reduce harm, what people can do themselves (for example, change passwords, watch accounts, place a fraud alert with credit bureaus) and how to reach you.
4. Do not attach files or include links that look like phishing. Tell people how you will and will not contact them.

Step 6: Notify other organizations that can reduce harm

PIPEDA also requires you to notify government institutions or organizations that may be able to reduce the risk of harm. Examples from the OPC include police after a cyberattack and a payment processor when card data is exposed. For cybercrime, also consider reporting to the Canadian Centre for Cyber Security through its incident reporting page and to the Canadian Anti-Fraud Centre at reportcyberandfraud.canada.ca. You must keep a record of these notifications.

Step 7: Record every breach for two years

1. Keep a record of every breach of security safeguards involving personal information under your control, including those you did not report.
2. Keep each record for at least 24 months after the day you determined the breach occurred, or longer if another law requires it.
3. At minimum, record the date or estimated date, a general description of the circumstances, the nature of the information involved, and whether you reported to the OPC and notified individuals. For unreported breaches, add a short explanation of why you concluded there was no RROSH.
4. The OPC can request these records at any time. In an inspection of telecom companies, it found that many records lacked enough detail to support the RROSH assessment, so be specific.

What can go wrong

Knowingly failing to report, notify or keep records is an offence under PIPEDA, punishable by a fine of up to $100,000. The OPC does not issue fines itself; it can refer cases to the Attorney General of Canada. Remember that you remain responsible for information you hand to a service provider, so your contracts should require vendors to tell you quickly about any breach.

What to do now

• Create the breach record template and register before you need it.
• Pre-draft notification letters and a short internal escalation chart.
• Rehearse the process in a tabletop exercise once a year.

Sources

• OPC: What you need to know about mandatory reporting of breaches of security safeguards
• OPC: Report a privacy breach at your business
• Canadian Anti-Fraud Centre: Reporting fraud and cybercrime
• Canadian Centre for Cyber Security: Report a cyber incident
• Mondaq: Reporting and recording breaches of security safeguards, the OPC releases new resources