Navigating The Legislative Landscape On Data Breaches: 2026 Data Breach Insights – Part 3

This article is part of our 2026 Data Breach Insights series, designed to help companies navigate the evolving data breach landscape. Explore the full series.

In this article, we provide an overview of the legislative and regulatory framework governing data breaches in Canada and highlight certain developments from the past year. We do not cover public sector privacy laws in this article.

Breach reporting and notification under privacy laws of general application

Canada’s private-sector privacy law framework is anchored by both federal and provincial statutes that regulate how personal information is collected, used, disclosed and protected. At the federal level, the Personal Information Protection and Electronic Documents Act (“PIPEDA”) remains the privacy statute governing private-sector organizations engaging in commercial activities, including those operating in federally regulated industries such as banking, telecommunications, and inter-provincial transportation.