Unsure About Mandatory Breach Reporting Obligations? OPC Publishes Draft Guidelines About What You Need To Know

The Office of the Privacy Commissioner of Canada (the "OPC") has published draft guidelines (the "Guidelines") on mandatory breach reporting under the Personal Information Protection and Electronic Documents Act ("PIPEDA") and the Breach of Security Safeguard Regulations.

Starting November 1, 2018, organizations subject to PIPEDA will be required to:

• report to the OPC breaches of security safeguards involving personal information that pose a real risk of significant harm to individuals
• notify affected individuals about those breaches, and
• keep records of all breaches (regardless of whether or not they meet the harm threshold for reporting).

An organization may also be required to notify other organizations or government institutions of the breach if such organization or institution may be able to mitigate or reduce the risk of harm to affected individuals.