Privacy Commissioner Of Canada Releases Privacy Breach Risk Assessment Tool

On March 26, 2025, the Office of the Privacy Commissioner of Canada (OPC) released a privacy breach real risk of significant harm assessment tool (Tool) for organizations.

In this bulletin, we provide an overview of breach reporting obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA), discuss how the Tool works, and share some helpful reminders and tips for conducting the real risk of significant harm analysis (RROSH analysis).

Overview of PIPEDA Breach Reporting Obligations

Pursuant to section 10.1 of PIPEDA, organizations subject to the Act are required to notify the OPC and affected individuals of a breach of security safeguards involving personal information under the organization's control, where the breach poses a "real risk of significant harm." PIPEDA broadly defines "significant harm" to include bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional