New Tool Introduced By The OPC Helps Organizations Assess Real Risk Of Significant Harm

INTRODUCTION

On March 26, 2025, the Office of the Privacy Commissioner of Canada (the "OPC") introduced the Real Risk of Significant Harm Assessment Tool (the "Tool") to help organizations determine whether a privacy breach meets the real risk of significant harm reporting threshold under the Personal Information Protection and Electronic Documents Act ("PIPEDA"). This Tool represents a critical step forward in operationalizing the OPC's legal guidance and turning it into a more practical, structured framework.

PIPEDA BREACH REPORTING OBLIGATIONS

PIPEDA is Canada's federal privacy law for private-sector organizations. It sets out ground rules for how businesses must handle the collection, use and disclosure of personal information during commercial activity. Since amendments of PIPEDA came into force in November 2018, organizations are required to report to the OPC and notify affected individuals of certain breaches involving their personal information.