Mandatory Breach Notification Under Pipeda: Clock Is Ticking For Companies Without Security Breach Response Plans

In 2015, Parliament enacted the Digital Privacy Act (the "Act"), a statute that provides for certain amendments to the Personal Information Protection and Electronic Documents Act ("PIPEDA"). However, not all provisions of the Act came into force in 2015; the enactment of certain sections of the Act that would create a new Division 1.1 to PIPEDA to deal with mandatory breach notification and record keeping obligations in respect of security breaches was delayed, pending the development of regulations prescribing the process for breach notification (the "Regulations"). On April 18, 2018, these Regulations were published in final form and on November 1, 2018, both Division 1.1 of PIPEDA and the Regulations will come into force.