Privacy Breach Reporting Requirements – Tools Available To Organizations

During the last few years, organizations have used the media to disclose – often considerably after the fact – security breaches that may have compromised the personal information of their clients, due to flaws in their mobile apps, website or internal IT system. However, such public disclosure will soon no longer be sufficient under the upcoming new Canadian legislative framework.

On November 1^st, 2018, new provisions of Canada's Personal Information and Electronic Documents Act (PIPEDA) will come into force. Private-sector organizations subject to this statute will then be required to report breaches of security safeguards involving personal information that pose a real risk of significant harm to individuals, such as reputational damage, financial loss, identity theft, etc.