On October 29, 2018, the Office of the Privacy Commissioner of
Canada (OPC) published the final guidance intended to assist
organizations in complying with the mandatory breach reporting and
record-keeping requirements under the Personal Information
Protection and Electronic Documents Act (PIPEDA), which come
into effect on November 1, 2018.
As of November 1, organizations subject to PIPEDA will be
required to notify the OPC and affected individuals of "a
breach of security safeguards" involving personal information
under the organization's control where it is reasonable in the
circumstances to believe that the breach creates a "real risk
of significant harm" to affected individuals. Other
organizations and government institutions must also be notified if
they may be able to mitigate or reduce the risk of harm to affected
individuals. Organizations must also keep and maintain records of
all breaches of security safeguards regardless of whether they meet
the harm
