Confidentiality incident notices and register: required content
Regulation respecting confidentiality incidents, CQLR c A-2.1, r. 3.1
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Governance, Retention
- Audit expectation
- none
What it requires
- When a confidentiality incident presents a risk of serious injury, send the Commission d’accès à l’information a written notice that gives your name and any Québec business number, a contact person, a description of the personal information and of the circumstances and cause of the incident, the dates it occurred and you became aware of it, the number of persons concerned and how many reside in Québec, the elements that led you to find a risk of serious injury, the measures taken or intended to notify the persons and to reduce the risk and prevent new incidents, and whether a foreign authority was notified.
- Promptly send the Commission any further information of that kind that you learn of after sending the notice.
- Give each person concerned a notice that describes the personal information and the circumstances of the incident, states the date or period, describes the measures you have taken or intend to take, states the measures the person can take to reduce the risk of injury, and gives contact information for more details.
- Give the notice by public notice, by any method reasonably expected to reach the person concerned, when sending it would likely cause increased injury to the person or undue hardship to you, when you lack the person’s contact information, or when you need to act rapidly to reduce a serious injury, and still send the person a notice with proper diligence unless one of the first three circumstances applies.
- Record in your register of confidentiality incidents a description of the personal information, the circumstances, the dates of the incident and of your awareness, the number of persons concerned, the elements behind your risk assessment, the dates of the notices and whether you gave public notice and why, and the measures taken.
- Keep the register up to date and keep its information for at least five years after the date or period in which you became aware of the incident.
These lines are LexLint's reading of the law's text.
What it makes you log
What the log must hold
Event time, Decision basis
Log retention
Counted from the date or period in which the body became aware of the incident.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
The register's required content and its five-year retention come from the Regulation; the duty to keep a register comes from section 3.8 of the private-sector Act.
- Kind
- Explicit
- As of
- Provision
- CQLR c A-2.1, r. 3.1, ss. 7 and 8
- Trigger
- security_incident
What this law does
A notice to the Commission d’accès à l’information that a confidentiality incident presents a risk of serious injury must be in writing and must contain the particulars that section 3 of the Regulation lists, among them the name of the body, a description of the personal information concerned, the number of persons concerned and the measures the body has taken or intends to take.
The body must promptly send the Commission d’accès à l’information any further information listed in section 3 that it becomes aware of after sending the notice. A notice to a person concerned by an incident that presents a risk of serious injury must describe the personal information concerned, the circumstances of the incident, the date or period, the measures the body has taken or intends to take, the measures the person may take and where to obtain more information.
A notice to the persons concerned is given by public notice when sending it would likely cause increased injury to the person or undue hardship for the body, or when the body lacks the person’s contact information.
The register of confidentiality incidents must contain a description of the personal information concerned, the circumstances, the dates, the number of persons concerned, the elements behind the risk assessment, the transmission dates of the notices and the measures the body has taken. The information in the registers must be kept up to date and kept for at least five years after the body became aware of the incident.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .