New Canadian Data Breach Notification Requirements Take Effect As PIPEDA Amendments Come Into Force

On November 1, 2018, the long-awaited amendments to Canada’s main federal data privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), take effect.

The new amendments, first passed by the Canadian Parliament in 2015, will require entities that collect, use, or disclose personal information of Canadian residents in the commercial context to notify the affected individuals and the federal Office of the Privacy Commissioner when there has been unauthorized access to personal information, or a loss of personal information, if the access or loss would create a real risk of significant harm to the individuals. 

Personal information under PIPEDA is defined broadly as “information about an identifiable individual.”