Should I ask for a business’s privacy breach records before buying it?

Asking is a reasonable diligence step because the federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), makes the seller keep the document. Section 10.3 requires an organization to keep and maintain a record of every breach of security safeguards involving personal information under its control. Under the Commissioner’s guidance, the record should describe each incident and hold enough detail to show how the seller assessed the risk of harm. For the wider review, see what cybersecurity and data privacy checks to do before buying.

What the law requires the seller to report and record

Section 10.1 requires an organization to report a breach to the Privacy Commissioner if it is reasonable in the circumstances to believe the breach creates a real risk of significant harm to an individual. The Act lists the sensitivity of the information and the probability of misuse among the factors. The record is wider. The Commissioner’s office says there must be a record of every breach, whether or not there is a real risk of significant harm. See the glossary entry on breach of security safeguards.

How long the record is kept

The Breach of Security Safeguards Regulations require an organization to maintain the record for 24 months after the day it determines the breach occurred. So an older incident may no longer appear in the record; the regulation sets 24 months as the period to maintain it. Ask the seller about earlier incidents directly, and put the answers in writing. The regulations also say the record must contain any information that enables the Commissioner to verify compliance with the Act’s reporting and notification duties in subsections 10.1(1) and (3) (section 6(2)). The Commissioner’s office says it can request access to the records or a copy.

What to ask for and how to read it

• The full breach record, and any reports the seller made to the Commissioner.
• For each entry, the date or estimated date and a description of the circumstances, which the Commissioner’s guidance lists among what it expects a record to include at minimum.
• How the seller assessed the risk of harm. The guidance says records should hold enough detail to show that assessment.
• A written statement of whether any incident has gone unrecorded. Knowingly breaking the reporting or record-keeping rules is an offence.

Scope

This describes the federal rule. Alberta, British Columbia and Quebec have their own private-sector privacy laws, which the Commissioner’s office says are deemed substantially similar to PIPEDA. Which law governs a given business is a question for a privacy lawyer, and this page does not describe those provincial laws.