Many assume that, with the advent of privacy statutes, companies
have been required to notify their customers, or the relevant
statutory authority, in the case of a data breach or improper
accessing of customer data. However, to date, for the vast
majority of provinces and territories in Canada, that has not been
the case, and the choice of whether or not to tell even those whose
personal data has been improperly accessed, or leaked, has been in
the discretion of the party that failed to keep it safe. That is
about to change.
New Rules
The Order in Council 2018-0369 dated March 26,
2018, has confirmed that later this year, new provisions and
regulations requiring organizations to notify Canadian consumers
when their personal information is breached will come into effect.
As of November 1, 2018, Canadian companies governed by the Personal Information Protection and Electronic
Documents Act ("PIPEDA") will be required to report
data breach incidents to the Office of
