CanadaPIPEDA breach of security safeguards regime
S.C. 2000, c. 5, ss. 10.1-10.3
In force since .
A breach notification rule binding private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Report any breach of security safeguards involving personal information under the organization's control to the Privacy Commissioner as soon as feasible, if it is reasonable to believe the breach creates a real risk of significant harm to an individual.
- Notify each affected individual directly, in a conspicuous form, with enough information to let them understand the significance of the breach and take steps to reduce or mitigate the resulting harm.
These lines are LexLint's reading of the law's text. Also read by: Office of the Privacy Commissioner of Canada (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.priv.gc.ca/en/privacy-topics/business-privacy/safeguards-and-breaches/privacy-breaches/respond-to-a-privacy-breach-at-your-business/gd_pb_201810/
- Guidance body
- Office of the Privacy Commissioner of Canada
- Open questions
- Which organization has personal information 'under its control' for the reporting duty in subsection 10.1(1) of the Personal Information Protection and Electronic Documents Act when a principal organization and its processor each decide some uses of the same information?
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 10.3(1) requires a record of every breach of security safeguards, whether or not it is reported, kept in accordance with any prescribed requirements, and section 10.3(2) requires the organization to give the Privacy Commissioner access to or a copy of a record on request. The Act lists no contents and sets no period; both are left to the regulations, which this row does not cite. Section 28 makes a knowing contravention of section 10.3(1) an offence. The Commissioner's audit power in section 18 sits outside the sections this row cites.
- Kind
- Explicit
- As of
- Provision
- Section 10.3(1) and (2)
- Trigger
- security_incident
What this law does
Requires an organization to report to the Privacy Commissioner, and to notify the affected individual directly, any breach of security safeguards involving personal information under its control where it is reasonable to believe the breach creates a real risk of significant harm. Significant harm includes bodily harm, humiliation, damage to reputation, financial loss and identity theft; relevant factors include the sensitivity of the information and the probability of misuse. Added to PIPEDA by the 2015 Digital Privacy Act, with the reporting duty itself brought into force .
When LexLint raises it
When your app profile says your app operates a social platform, serves under-18s, operates an app store, ships a mobile app or processes personal data.
Back to the example · Lint your app
Page updated .