Privacy breach reporting for Canadian small businesses: PIPEDA, Quebec Law 25 and BC PIPA

What to take away

Start with the question: which law covers your business

Canadian private-sector privacy rules are split. The federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies to federal works, undertakings and businesses, to commercial activity that crosses borders, and within provinces that lack a substantially similar law. Quebec, British Columbia and Alberta have their own private-sector laws that the federal office has recognised as substantially similar. Provincially regulated organizations in those provinces are generally covered by the provincial statute for their in-province handling of personal information.

A small shop in Vancouver that only handles customers in British Columbia usually falls under BC's Personal Information Protection Act (PIPA). The same shop sending customer data to a supplier in another province or country can still trigger PIPEDA for that flow. A Toronto business is under PIPEDA. A Montreal business is under Quebec's private-sector Act, as updated by Law 25.

If you operate across provinces, assume more than one regime applies and meet the strictest rule. Alberta has its own PIPA as well, so Alberta businesses should read that Act separately. For a view of how a breach starts in practice, see the first 24 hours after an attack and the incident response overview.

PIPEDA: the real risk of significant harm test

PIPEDA defines a breach of security safeguards as the loss of, unauthorized access to or unauthorized disclosure of personal information resulting from a failure of safeguards. The Office of the Privacy Commissioner of Canada (OPC) states that the rules apply to small and large businesses alike.

Your duties are three:

The OPC says the same duty applies whether a breach affects one person or 1,000: it depends on whether the assessment shows real risk. Number of people is not the test. You judge the sensitivity of the information and the probability that it will be misused. The OPC offers an online tool that walks through those questions.

A report to the OPC must include a description of the breach and its cause if known, when it occurred, the personal information involved, the number of people affected, the steps taken to reduce harm, how you will notify people, and a contact person. A notification to individuals should contain similar detail and tell them what they can do to reduce the risk, such as changing passwords or watching their accounts.

PIPEDA also makes it an offence to knowingly fail to meet the reporting, notification and record-keeping requirements, which can lead to fines. The OPC does not prosecute offences itself; it can refer information to the Attorney General of Canada.

Quebec Law 25: confidentiality incidents

Quebec's private-sector Act, strengthened by Law 25, uses different words. A "confidentiality incident" is any access, use or communication of personal information not authorized by the Act, or the loss of personal information or any other breach of its protection. Examples published by the Commission d'accès à l'information (CAI) include an employee viewing records without authorization, information sent to the wrong recipient, and a cyberattack such as phishing or ransomware.

For every incident you must take reasonable measures to reduce the risk of harm and to prevent similar incidents. You must assess the seriousness of the risk, considering the sensitivity of the information, the anticipated consequences of its use, and the likelihood it will be used for harmful purposes. The privacy officer in your business must be consulted. The harm does not have to have occurred; it only has to be likely.

If the incident presents a risk of serious injury, you must:

Notice to individuals must describe the information involved, the circumstances, the date or period, the measures taken or planned, the steps the person can take, and a contact. A public notice can be used to reduce risk quickly, but it does not replace individual notice except in three situations the CAI lists: it would cause greater harm, it would be excessively difficult, or you lack the contact details.

Every business must keep a register of all confidentiality incidents, including those without serious risk, and give the CAI a copy on request. Register entries are kept for a minimum of five years from the date you became aware of the incident.

The CAI can impose administrative monetary penalties of up to 2% of worldwide turnover or $10 million for certain failures, including failing to report an incident with a risk of serious injury. Penal proceedings are a separate route.

British Columbia PIPA: no mandatory notification, but do not stay silent

The Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) explains that PIPA requires organizations to make reasonable security arrangements against unauthorized access, collection, use, disclosure or disposal. Its breach guidance sets out four steps: contain, evaluate the risk, notify, and prevent. On notification it says that, unlike the public-sector law, PIPA does not currently mandate it for organizations, but the OIPC recommends it as best practice.

In a January 2024 statement the Commissioner said PIPA was nearly alone among private-sector laws in North America in lacking mandatory breach notification and called for the law to be modernised. Because that position may have changed since the statement, check the OIPC site and the current Act before relying on it.

In practice, a BC business should still treat a serious breach as reportable: not telling people whose information could be used for identity theft is hard to square with the duty to protect it, and contracts, insurers or PIPEDA (for cross-border flows) may require notice anyway.

A simple workflow for a small business

Keep the register in a form you can hand to a regulator.

Common questions

Official sources