Reporting a breach to the Privacy Commissioner: the “real risk of significant harm” test explained

When a breach happens, one question decides much of what follows: do we have to report it to the Office of the Privacy Commissioner of Canada (OPC)? Under the Personal Information Protection and Electronic Documents Act (PIPEDA), the answer turns on a single test: whether the breach creates a “real risk of significant harm” (RROSH) to an individual.

Who this applies to

PIPEDA applies to private sector organizations in the course of commercial activities in most of Canada, and to federally regulated businesses. Quebec businesses generally follow Quebec’s private sector act for their activities in Quebec, which has its own “risk of serious injury” test, but many organizations operating across provinces deal with both. The mandatory breach rules have been in force since 2018-11-01 (Breach of Security Safeguards Regulations).

The three obligations

If it is reasonable in the circumstances to believe that a breach of security safeguards involving personal information under your control creates a real risk of significant harm to an individual, you must (PIPEDA, s. 10.1):

1. report it to the Privacy Commissioner;
2. notify the affected individuals; and
3. notify any other organization or government institution that may be able to reduce the risk of harm, such as a bank or a credit bureau (s. 10.2).

Notice must be given “as soon as feasible” after you determine that the breach has occurred.

Step 1: Is there significant harm?

The act defines significant harm broadly. It includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on a credit record, and damage to or loss of property (s. 10.1(7)). Ask: if this information were misused, could any of these happen to someone?

Step 2: Is the risk real?

The act names two factors (s. 10.1(8)):

Sensitivity

Financial data, government identifiers, health information, passwords and precise location are generally sensitive. But context matters: a list of names can be sensitive if it reveals that people are clients of a particular clinic or service.

Probability of misuse

Consider who had access, for how long, and with what intent. Useful questions:

• Was it a malicious attack, or an accidental disclosure to a known, trusted recipient?
• Is there evidence the information was copied, sold or posted?
• Was it encrypted with keys that were not compromised?
• Has the information been recovered or confirmed deleted?
• Could it be combined with other data to cause harm?

Both factors are weighed together. Highly sensitive information with a meaningful chance of misuse will usually meet the test. The OPC offers a free breach risk self-assessment tool that walks through these questions, and publishes guidance on mandatory breach reporting.

What the report must include

The regulations set out the content of the report to the OPC, including the circumstances and cause if known, the date or period of the breach, the personal information involved, the number of individuals affected, the steps taken to reduce harm, how individuals will be notified and a contact person. Notices to individuals must describe the breach, the information involved, what you are doing, what they can do to protect themselves and how to reach you.

Keep a record of every breach

Whether or not a breach meets the test, you must keep a record of it (s. 10.3) for 24 months after you determine it occurred (regulations, s. 6), and provide it to the Commissioner on request. The record should contain enough information for the OPC to verify your decision.

Consequences of getting it wrong

Knowingly failing to report, notify or keep records is an offence under PIPEDA, punishable by a fine of up to $100,000 on indictment (PIPEDA, s. 28). Federal reform under Bill C-36, tabled on 2026-06-15 and still before Parliament (LEGISinfo), would substantially raise the potential penalties (DLA Piper). Until it passes, PIPEDA’s test is the one that applies.

Prepare before you need it

• Write a short decision procedure using the two factors, and name who decides.
• Prepare report and notice templates in advance, in French and English.
• Test your detection and logging so you can actually tell what was accessed.

Ubitrak’s security testing helps reduce the chance of a breach, and KW Consulting can help you build a breach response plan. See our PIPEDA and Law 25 pages, our security review and privacy and security program services, or contact us.

Sources

• PIPEDA, sections 10.1 to 10.3
• PIPEDA, full text (s. 28)
• Breach of Security Safeguards Regulations, SOR/2018-64 (Canada Gazette)
• OPC – Privacy breach risk self-assessment tool
• OPC – What you need to know about mandatory reporting of breaches
• LEGISinfo – Bill C-36 (45-1)
• DLA Piper – Canada tables Bill C-36