Breach of security safeguards (privacy breach reporting)

In diligence, ask whether the target has had a breach, whether it was reported where required, and whether records exist. A buyer may later own the data, the systems and the questions that come with them. See the cybersecurity and data privacy checks before buying a business.

The federal rule

PIPEDA s. 10.1(1) requires an organization to report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual. Section 10.1(3) adds notice to the individual on the same test, unless otherwise prohibited by law, and s. 10.3 requires a record of every breach. The Office of the Privacy Commissioner says the law requires breach records to be kept for two years.

Provincial regimes differ

• Alberta’s Personal Information Protection Act s. 34.1 requires notice to Alberta’s Commissioner, without unreasonable delay, where a reasonable person would consider that a real risk of significant harm exists
• Quebec’s private-sector Act uses “confidentiality incident” and a risk of serious injury, with notice to the Commission d’accès à l’information (s. 3.5) and a register (s. 3.8)
• This entry covers the federal, Alberta and Quebec rules only; check the rules in the province where the business is