Real risk of significant harm (RROSH)
Real risk of significant harm (RROSH) is the test in PIPEDA s. 10.1 for when a breach of security safeguards must be reported to the Privacy Commissioner and, unless otherwise prohibited by law, notified to affected individuals: it applies where it is reasonable in the circumstances to believe the breach creates a real risk of significant harm to an individual.
An owner meets this test when personal information is lost or wrongly accessed, and a buyer meets it in diligence when asking how past breaches were judged. The Office of the Privacy Commissioner of Canada (OPC) uses the short form RROSH. The reporting duty itself is covered under breach of security safeguards.
What the Act says
Section 10.1(7) says significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property. Section 10.1(8) says the relevant factors include the sensitivity of the personal information, the probability that it has been, is being or will be misused, and any other prescribed factor.
What to ask
- How the business assessed sensitivity and probability of misuse for each breach, which is how the OPC says to determine the risk
- Whether it kept records of all breaches, which the OPC says is required whether or not a breach presents a real risk
- Which privacy law governs the business; this entry covers PIPEDA only
See what privacy obligations apply to customer data when a tech company is sold.
Sources
This definition is checked against primary sources. Links were last confirmed on the dates shown.
- 01Government of Canada (Department of Justice)GovernmentPersonal Information Protection and Electronic Documents Act, S.C. 2000, c. 5
- 02Office of the Privacy Commissioner of CanadaRegulatorWhat you need to know about mandatory reporting of breaches of security safeguards
Deavo is an advertising and listings platform, not a brokerage, law firm or valuation firm. This page is general information, not legal, tax, accounting or valuation advice, and rules differ by province. Confirm anything you rely on with a qualified professional before you act on it.