One Incident, Potentially Multiple Breach Reporting Requirements – OSFI Introduces Cyber Breach Notification Guidelines For Financial Institutions

On January 20, 2019, the Office of the Superintendent of Financial Institutions of Canada (OSFI) issued an Advisory (also read: OSFI's Guidance on cyber incident management framework) regarding the responsibilities of federally regulated financial institutions (FRFI), including banks, federal credit unions, and loan and trust companies, to report Technology and Cyber incidents (effective date: March 31, 2019). The threshold for reporting is a "high" or "critical" severity level. The assessment is to be made by the institution itself.

Notification to the Lead Supervisor must be made within 72 hours (similar to the notification timelines under the European General Data Protection Regulation (GDPR) for incidents involving personal information). Since November 1, 2018, breaches involving personal information are reportable under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) but PIPEDA does not prescribe a precise notification timeline.