Trick Or…Breach? PIPEDA's Breach Reporting Requirements Come Into Force On November 1, 2018

After more than three years of consultation and anticipation, the big day has finally arrived. As of November 1, 2018, organizations subject to the Personal Information Protection and Electronic Documents Act ("PIPEDA") are, in certain circumstances, required to:

• report to the Office of the Privacy Commissioner of Canada (the "Commissioner's Office") a breach of the organization's security safeguards;
• notify affected individuals of a breach; and
• maintain particular records of all breaches.

The new reporting requirements arise from amendments to various sections of PIPEDA pursuant to the Digital Privacy Act ("DPA"). November 1, 2018 also marks the coming into force of the Breach of Security Safeguards Regulations (the "Regulations"), which are intended to reflect best practices established through the prior voluntary reporting initiative of the Commissioner's Office. The Commissioner's Office has released a Guidance Document¹ to assist organizations in