Mandatory Data Breach Notification Is Coming: Is Your Organization Ready?

The Digital Privacy Act amends the Personal Information Protection and Electronic Documents Act ("PIPEDA") in several key ways. While most of the provisions of the Digital Privacy Act came into force in June 2015, those relating to breach reporting, notification and record keeping are anticipated to come into force later this year once the associated Regulations come into force.

We provide below an overview of these changes and what organizations should be doing to ensure they comply.

What Are the Key Changes?

1. Mandatory Data Breach Notification

Imagine a scenario where an employee loses a corporate laptop containing customer information at a trade show. Once the regulations are adopted, the corporation will be required to not only inform the Office of the Privacy Commissioner (the "Commissioner"), but may also be required to inform the customers whose information was lost, potentially increasing the corporation's litigation exposure as a result of