PIPEDA Data Breach Reporting To Take Effect November 1, 2018

Private sector organizations governed by the Personal Information Protection and Electronic Documents Act ("PIPEDA") have seven months to prepare for the coming into force of the legislative amendments that enact mandatory data breach reporting and notification. This article explains the coming into force of the breach reporting provisions within PIPEDA, as well as the timing for the release of final Regulations.

The long-awaited breach reporting and notification rules will require organizations that experience a data breach to report the incident to the Office of the Privacy Commissioner of Canada (the Commissioner) and to notify affected individuals. Reporting and notification will be required in all circumstances where it is reasonable to believe that the breach creates a "real risk of significant harm to the individual". Under the Act, "significant harm" is defined to include bodily harm, humiliation, damage to reputation or relationships, loss of employment,