Canada's Mandatory Privacy Breach Reporting Requirements coming into force November 1, 2018

Starting on November 1, organizations across Canada subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) will be required to provide notice of certain privacy breaches.

The breach reporting requirements relate to a "breach of security safeguards," which is defined in PIPEDA as: the loss of, unauthorized access to or unauthorized disclosure of personal information resulting from a breach of an organization's security safeguards, or from a failure to establish those safeguards.

If it is reasonable to believe the breach of security safeguards creates a real risk of significant harm to the individual:

• Organizations will be required to report to the privacy commissioner of Canada any breach of security safeguards involving personal information under its control, if it is reasonable to believe the breach creates a real risk of significant harm to an individual;