New Notification Requirements For Data Breaches

As of November 1, 2018, if your organization suffers a data breach, new reporting requirements will be in place that may require you to notify consumers and the Privacy Commissioner of the breach – or else face a fine of up to $100,000.

Further to an Order-in-Council published in late March, certain sections of the Digital Privacy Act will come into force on November 1, 2018. These sections require that if:

1. there is any breach of an organization's security safeguards involving personal information under its control, and
2. it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual,

then the organization must notify both the individuals affected and the Privacy Commissioner of the breach. These notifications must be given as soon as feasible after the organization discovers the breach.