One Year into Mandatory Reporting, Canada's Privacy Commissioner Releases Key Data Breach Trends

To mark the one-year anniversary of mandatory breach reporting under the Personal Information Protection and Electronic Documents Act (PIPEDA), the Office of the Privacy Commissioner of Canada (OPC) published a blog post providing observations, statistics and compliance tips.

Since November 2018, organizations that are subject to PIPEDA are required to notify the OPC and affected individuals of a "breach of security safeguards" involving personal information that poses a real risk of significant harm to an individual. Organizations are also required to keep records of all breaches, including breaches that do not pose a real risk of significant harm, for a minimum of two years.

As the number of data breaches continue to skyrocket in Canada, the OPC's recent guidance on lessons learned from mandatory reporting complements other resources on preparing for a cybersecurity incident.