PIPEDA's breach notification rules sit in Division 1.1 of the Act, sections 10.1 to 10.3, and they have been mandatory since 1 November 2018. An organisation subject to PIPEDA that suffers a breach of security safeguards must decide whether it creates a real risk of significant harm. If it does, the organisation reports to the Office of the Privacy Commissioner of Canada (OPC), notifies every affected individual and alerts any organisation that could reduce the harm, all as soon as feasible. Every breach, reported or not, goes into a record kept for 24 months.
These duties carry weight. Under section 28, knowingly failing to report, notify or keep records is an offence with fines of up to CAD 100,000.
What counts as a breach of security safeguards
Section 2(1) of PIPEDA defines a breach of security safeguards as the loss of, unauthorised access to or unauthorised disclosure of personal information resulting from a breach of the safeguards in clause 4.7 of Schedule 1, or from a failure to establish those safeguards. The second half matters: if an organisation never put reasonable protections in place, the resulting exposure still counts.
The definition is broad. A ransomware attack that encrypts a customer database, an email with a spreadsheet of client details sent to the wrong person, a stolen laptop holding unencrypted staff files and a misconfigured cloud storage bucket open to the internet all qualify. A system glitch that shows one customer's account details to another can count too, as the OPC found in its 2024 investigation into Brinks Home (PIPEDA Findings #2024-002).
The real risk of significant harm test
Not every breach has to be reported. The threshold is whether it is reasonable to believe the breach creates a real risk of significant harm (RROSH) to an individual. Section 10.1(7) defines significant harm broadly: bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on a credit record, and damage to or loss of property.
Section 10.1(8) names the factors for the assessment:
| Factor | What to consider |
|---|---|
| Sensitivity of the personal information | Medical records, financial data, government identifiers such as a Social Insurance Number or passport number, and biometric data are sensitive by nature. Context matters too: a home address becomes more sensitive next to alarm system details, as the OPC noted in the Brinks Home case. |
| Probability of misuse | Who accessed or could access the data? Was it a cyberattack or an accident? How long was it exposed? Has it been recovered? Was it encrypted or otherwise protected? |
The OPC launched its Privacy Breach Risk Self-Assessment Tool in March 2025, according to its 2024-25 annual report. It walks you through a questionnaire on whether a breach meets the threshold, and the result can go into your breach record.
In Brinks Home, the OPC found that an accidental exposure to a small number of known customers, with no malicious intent, did not meet the threshold. When the answer is unclear, reporting is the safer course.
What PIPEDA asks you to do after a breach
Reporting to the Privacy Commissioner
When a breach meets the threshold, section 10.1(1) requires a report to the OPC, made as soon as feasible after the organisation determines that the breach has occurred. PIPEDA sets no deadline in hours or days, unlike the GDPR's 72-hour rule, but the OPC expects organisations to act without unreasonable delay.
The Breach of Security Safeguards Regulations (SOR/2018-64) set out what the report must contain:
- A description of the circumstances of the breach and its cause, if known
- The date or period of the breach, or an approximation
- A description of the personal information involved, as far as known
- The number of affected individuals, or an approximation
- The steps taken to reduce or mitigate the risk of harm
- The steps taken or planned to notify affected individuals
- Contact details of a person who can answer the OPC's questions
Since May 2024, the OPC has offered an updated secure online form for breach reports. You can send more information later if you learn new details, and the report may go by any secure means of communication.
Notifying affected individuals
Section 10.1(3) creates a parallel duty: unless another law prohibits it, the organisation must notify each individual when the breach creates a real risk of significant harm to them, again as soon as feasible.
The Regulations require the notice to include:
- A description of what happened
- The date or period of the breach
- A description of the personal information involved
- The steps the organisation has taken to reduce the risk
- The steps the individual can take, such as changing passwords, watching credit reports or placing fraud alerts
- Contact details for someone who can answer questions
Section 10.1(4) adds that the notice must give enough information for the individual to understand what the breach means for them and what they can do about it. A vague, generic notice that leaves out known details does not meet that standard.
The OPC's joint investigation with the UK Information Commissioner into the 23andMe breach (PIPEDA Findings #2025-001) shows the cost of weak notices. It found that 23andMe's notifications did not fully describe the types of personal information compromised and did not say that some data had been posted for sale online. People whose accounts were accessed directly were told more than a month after the forensic analysis ended.
Direct or indirect notification
The default is direct notice: in person, by telephone, mail, email or any other form a reasonable person would consider appropriate. Indirect notice, through a public communication that could reasonably be expected to reach the people affected, is allowed in three cases only: direct notice would likely cause further harm, it would likely cause undue hardship for the organisation, or the organisation has no contact details for the person.
Notifying other organisations
Section 10.2(1) adds a third duty. An organisation that notifies individuals must also notify any other organisation or government institution that it believes may be able to reduce or mitigate the harm. After a payment card breach, that can mean the card networks and the police. This notice is also due as soon as feasible.
Section 10.2(3) allows personal information to be disclosed to those organisations without the individual's consent, as long as the disclosure is made only to reduce or mitigate the harm. You do not need permission before sharing breach details with someone who can help.
Keeping breach records
Section 10.3 requires a record of every breach, whatever its severity. A breach that does not create a real risk of significant harm still goes in the record.
The Regulations require each record to be kept for 24 months after the day the organisation determines the breach occurred, with enough information for the OPC to check that the reporting and notification duties were met. In practice, that means the RROSH assessment: which factors you weighed and why you did or did not report.
For unreported breaches, write down briefly why the threshold was not met. The OPC can ask for access to, or a copy of, your records at any time under section 10.3(2).
What a complete breach record holds
| Element | Detail |
|---|---|
| Date of discovery | When the breach was found and by whom |
| Dates of the breach | When it happened, or the approximate period |
| Description | What happened, which systems were involved, the cause if known |
| Personal information involved | Categories and volume of data |
| Number of individuals | Actual or estimated count |
| RROSH assessment | Sensitivity, probability of misuse, conclusion |
| Actions taken | Containment, remediation, notices sent or the reason none were |
| Notification details | Who was told (OPC, individuals, other organisations), when and how |
Penalties for breaking the rules
Section 28 makes it an offence to knowingly contravene section 10.1 or the record-keeping duty in section 10.3(1). The word matters: an honest mistake is not the target, but an organisation that assesses a breach as meeting the threshold and decides not to report it is. On summary conviction the fine is up to CAD 10,000, and on indictment up to CAD 100,000.
The OPC does not prosecute or fine. It refers possible offences to the Attorney General of Canada. The OPC's enforcement role runs through complaints and findings instead: individuals can complain under section 11, and after the OPC reports, take the matter to the Federal Court under section 14, which can order changes and award damages, including for humiliation.
Reports are frequent: in 2024-25 the OPC received 686 PIPEDA breach reports, affecting about 20 million Canadian accounts.
Breach reporting deadlines in other laws
PIPEDA sits between the GDPR and laws with fixed short clocks. Its "as soon as feasible" standard has no number, but it is backed by an offence where the GDPR uses administrative fines. As of October 2026, the main regimes a Canadian business with international customers meets compare like this:
| Regime | Deadline to the authority | Threshold | Record-keeping |
|---|---|---|---|
| PIPEDA (Canada) | As soon as feasible | Real risk of significant harm | All breaches, 24 months |
| GDPR (EU and EEA) | 72 hours from awareness, where feasible | Unless unlikely to result in a risk to rights and freedoms | All breaches, no fixed period |
| UK GDPR | 72 hours from awareness, where feasible | Unless unlikely to result in a risk to rights and freedoms | All breaches |
| LGPD (Brazil) | 3 working days | Relevant risk or damage | All incidents, 5 years |
| Privacy Act (Australia) | Assess within 30 days, then notify as soon as practicable | Likely to result in serious harm | Not fixed by the Act |
| DPDP Rules 2025 (India, not yet in force) | Without delay, detailed report within 72 hours | Any personal data breach | Not yet in force |
| POPIA (South Africa) | As soon as reasonably possible | Reasonable grounds to believe data was accessed or acquired | Not fixed by the Act |
Brazil's three working days come from the ANPD's incident rules of April 2024. Australia's 30-day assessment and "as soon as practicable" notice are in sections 26WH to 26WL of its Privacy Act, as the OAIC's guidance explains. India's Rules were notified in November 2025, but the breach duty starts in a later phase. POPIA uses a looser standard, close to PIPEDA's.
Provincial laws add another layer in Canada. Quebec's Law 25, Alberta's PIPA and British Columbia's PIPA have their own breach rules, which can apply alongside or instead of PIPEDA depending on the province and the sector.
Steps for your organisation
If your website or business collects personal information from people in Canada, such as names, email addresses, payment details or identifiers linked to cookies, these rules apply to you.
- Before anything happens, name a breach response team and write a plan that says who assesses the risk, who drafts notices and who contacts the OPC. Practise with the OPC's self-assessment tool.
- When a breach is found, contain it first: isolate systems, revoke compromised credentials and keep forensic evidence.
- Assess the risk by looking at how sensitive the exposed data is and how likely it is to be misused. Write down each step.
- If the threshold is met, report to the OPC, notify the people affected and tell any organisation that can reduce the harm, as soon as feasible.
- Log the breach with the full assessment and response, and keep the record for at least 24 months.
- Review what went wrong, strengthen your security safeguards, and consider whether a privacy impact assessment is needed for the systems involved.
Questions about PIPEDA breach notification
Does PIPEDA require notification for every data breach?
No. Reporting to the OPC and notifying individuals are required only when a breach creates a real risk of significant harm. Every breach, including those below the threshold, must still be recorded and the record kept for 24 months.
How quickly must a PIPEDA breach be reported to the OPC?
As soon as feasible after the organisation determines that the breach has occurred. There is no fixed deadline in hours or days, so have a response plan ready to act within days of confirming a reportable breach.
Can an organisation be fined for failing to report a breach under PIPEDA?
Yes. Knowingly failing to report, notify or keep records is an offence under section 28, with fines of up to CAD 10,000 on summary conviction or CAD 100,000 on indictment. The OPC refers cases to the Attorney General of Canada.
Who reports a breach when a third-party processor is involved?
The organisation that controls the personal information. PIPEDA's duties apply to information under the organisation's control, so the duty stays with it even when the breach happened at a processor it transferred the data to.
Does PIPEDA breach notification apply to small businesses?
Yes. Every organisation subject to PIPEDA must meet the reporting, notification and record-keeping duties, whatever its size. Division 1.1 has no small business exemption.
What should a record of an unreported breach contain?
Enough for the OPC to check your decision: a description of the incident, the personal information involved, the risk assessment you carried out and why you concluded the threshold was not met.
Know what your website collects before an incident
A breach assessment starts with knowing what personal data you hold. For your website, the Cookie scanner lists the cookies and trackers that collect data from visitors, so the inventory is ready if you ever need it.
It also shows which third parties receive that data, which is the first question when you work out who else to notify. Kukie.io is one part of a wider setup for privacy laws around the world.
