It is Monday morning. The bookkeeper at a hypothetical Brampton dental supply company opens her laptop and finds every file renamed and a note demanding payment. Or a sales rep mentions that his phone, with the full customer list on it, went missing on the GO train. Or an employee realizes she emailed a spreadsheet of client banking details to the wrong person. None of these feels like a legal problem at first. They feel like a technology problem, an embarrassment, or both.
They can also trigger legal duties that begin as soon as you believe the incident meets a threshold, and those duties do not wait for your IT provider’s final report. Business owners who handle these first days well tend to do a few plain things in the right order: stop the bleeding, preserve the evidence, work out who is at risk, and tell the people they must tell.
Please read this as general information, not as legal advice on your incident. Breach response depends heavily on the facts, on what kind of information was involved, and on your sector. If an incident is underway, get professional help first and read the rest later.
The First 24 Hours
Your priorities in the opening hours are operational, but what you do now becomes the record you will later have to explain.
- Contain it. Disconnect affected machines from the network, disable compromised accounts, change passwords, and ask your email provider to revoke active sessions. For a lost device, trigger a remote wipe if one is available.
- Preserve evidence. Do not reformat machines or delete suspicious emails, however tempting that is. Logs are often what show what was actually taken, and they can be overwritten on a schedule.
- Call your insurer. Many commercial and cyber policies impose prompt notice conditions and may require you to use approved vendors. Missing them can put coverage at risk.
- Get advice before you announce anything. Bringing in a lawyer early can help protect sensitive assessments under legal privilege in some circumstances, although privilege is not automatic and should not be assumed.
- Start a written log: who found what, when, and each step taken from that moment on.
Keep staff communications short and factual. A panicked all-hands email speculating about who is to blame is discoverable, and can end up quoted in a claim.
Which Privacy Law Applies to You
Ontario has no general private-sector privacy statute. For most Brampton businesses, the governing law is the federal Personal Information Protection and Electronic Documents Act (PIPEDA), which covers personal information collected, used, or disclosed in commercial activity. Its breach rules are in sections 10.1 to 10.3, with details set out in the Breach of Security Safeguards Regulations.
Three variations are worth checking.
Health care providers such as clinics, pharmacies, and physiotherapists are usually health information custodians under Ontario’s Personal Health Information Protection Act, 2004 (PHIPA). That statute has its own rules: individuals must be notified at the first reasonable opportunity when health information is stolen, lost, or used or disclosed without authority, and the Information and Privacy Commissioner of Ontario must be notified in prescribed circumstances.
Employee information held by a provincially regulated employer generally sits outside PIPEDA, though common-law duties, contracts, and insurance obligations still matter. Federally regulated businesses, such as interprovincial carriers operating from Brampton yards, are in a different position because PIPEDA covers their employee information too.
And customers outside Canada can bring foreign rules into play. If you sell to people in the United States or Europe, ask about those laws at the same time.
For the broader day-to-day obligations behind all this, including inventories and policies, see our privacy law services. This article stays with the incident itself.
Is It a “Breach of Security Safeguards”?
PIPEDA defines this term broadly: a loss of, unauthorized access to, or unauthorized disclosure of personal information resulting from a breach of an organization’s safeguards or a failure to establish them. No hacker is required. An unencrypted USB key left at a coffee shop qualifies, and so does an envelope sent to the wrong address or an employee browsing records out of curiosity.
Personal information is also broader than people assume. It includes names paired with other details, financial data, government identification numbers, health details, employment records, photos, and even purchase histories. Business contact details used strictly for business communication are treated differently, but do not stretch that exception to cover everything on a customer list.
The Real Risk of Significant Harm Test
Every breach has to be recorded. Not every breach has to be reported. The dividing line is whether it is reasonable to believe, in the circumstances, that the breach creates a real risk of significant harm to an individual.
Significant harm is defined widely and includes bodily harm, humiliation, damage to reputation or relationships, loss of employment or business opportunities, financial loss, identity theft, negative effects on a credit record, and damage to or loss of property.
The Act names two factors for assessing the risk: how sensitive the information is, and the probability that it has been, is being, or will be misused. Practical questions help make that concrete:
- Who has the information now: a known recipient who confirms deletion, or an unknown attacker?
- Was it encrypted, and was the key also taken?
- How long was it exposed?
- Is there evidence of malicious intent, as with a targeted theft or ransomware operators who publish stolen files?
- Could this information be combined with other data to commit fraud?
Compare two hypotheticals. A payroll summary mistakenly emailed to the company’s own accountant, who confirms in writing that it was deleted, may present low risk. A stolen file holding social insurance numbers, birthdates, and addresses almost certainly crosses the line, even if you have no evidence yet that anyone has used it. Write down your reasoning either way, because you may be asked to justify it.
Reporting to the Privacy Commissioner
If the test is met, you must report to the Office of the Privacy Commissioner of Canada as soon as feasible after you determine a breach has occurred. No fixed number of days applies, yet undue delay is hard to defend. The Commissioner’s online form asks for the circumstances and cause if known, the date or period of the breach, the types of information involved, an estimate of the number of people affected, steps taken to reduce harm and to notify people, and a contact person.
You are allowed to submit further information as you learn it. Do not hold a report back to wait for a perfect forensic picture.
Responsibility stays with the organization that controls the information, even when a vendor held it. If your cloud bookkeeping provider or payroll processor is the one breached, you are generally the one who must assess and report. Read your service contract for the vendor’s notice duties, and press them for the facts you need.
Telling the People Affected
Where the same threshold is met, you must also notify affected individuals as soon as feasible. The notice has to include enough information to help them understand the significance of the breach and take steps to protect themselves. In practice, it should explain:
- What happened and when, in plain language
- What kinds of their information were involved
- What you have done to reduce the risk of harm
- What they can do, such as watching accounts, placing fraud alerts with credit bureaus, or changing passwords
- How to reach someone at your company with questions
Notice must usually be given directly by phone, email, letter, or in person. Indirect notice, such as a website posting or a public announcement, is permitted only in limited cases: where direct notice would cause further harm or undue hardship, or where you do not have contact details.
Word the notice with care. Understating the problem can undermine trust and may later look misleading. Overstating what you know, on the other hand, can cause unnecessary alarm and create admissions you did not mean to make. If your customers in Brampton speak several languages and you know that many of them would struggle with an English-only letter, consider whether translations or a staffed phone line would make the notice genuinely useful.
You must also notify any other organization or government institution that could reduce the risk or mitigate the harm, for example a payment processor, a bank, or a credit bureau, and you may share personal information with them for that purpose without consent in the circumstances the Act allows.
Police, Ransom Demands, and Fraud Reports
Criminal activity can be reported to Peel Regional Police, and fraud or cybercrime can also be reported to the Canadian Anti-Fraud Centre. Neither replaces your privacy obligations, and telling police does not count as notice to the Commissioner. Police can ask you to delay particular steps, so keep a record if that happens.
Ransom payments raise difficult questions that no general article can settle. Payment does not assure that files will be restored or that stolen data will actually be deleted, and it does not end your duty to report and notify. Sanctions laws can also become an issue, depending on who is behind the attack. Talk to your insurer and counsel before anyone responds to the attackers, and do not let a staff member begin a negotiation by email on their own.
Records, Penalties, and Lawsuits
The record-keeping rule is frequently overlooked. An organization must keep a record of every breach of security safeguards, including those that fall below the reporting threshold, for 24 months after determining that the breach occurred. The record must contain enough detail for the Commissioner to verify compliance, and the Commissioner may ask to see it.
Knowingly contravening the reporting, notification, or record-keeping requirements is an offence under PIPEDA, with fines of up to $10,000 on summary conviction and up to $100,000 on indictment. The Commissioner cannot levy these personally but may refer matters to the Attorney General of Canada.
Civil claims are the other exposure. Affected people may sue, individually or as a class, typically alleging negligence or breach of contract, and PIPEDA also allows a complainant to apply to the Federal Court for damages after a Commissioner’s report. Commercial customers may have contract rights as well, particularly under data-handling clauses and indemnities. If you get a demand letter or claim, preserve everything and pass it to your insurer quickly; our business litigation page outlines how those disputes are generally handled.
After the Dust Settles
When the immediate pressure has passed, set aside time for a frank review of what failed. The technical fix may be a simple one, like multi-factor authentication on email or encryption on company phones. The legal fixes tend to involve vendor contracts, retention schedules that stop you from holding ten-year-old identity documents you no longer need, and an incident plan naming who does what.
PIPEDA requires safeguards appropriate to the sensitivity of the information, so the Commissioner can ask whether the weakness that caused the breach was reasonable to begin with. Information you never kept cannot be stolen, and it is often the easiest risk to remove.
A one-page response plan, printed and kept somewhere other than the server that may be locked up, is worth preparing before you need it. Include your insurer’s number, your IT contact, a lawyer’s number, and the Commissioner’s reporting page. If you are facing an incident now, contact Sawan Law House LLP with what you know so far.
Sources and Further Reading
- What you need to know about mandatory reporting of breaches of security safeguards (Office of the Privacy Commissioner of Canada)
- Breach of Security Safeguards Regulations, SOR/2018-64 (Justice Laws)
- Personal Health Information Protection Act, 2004 (Ontario e-Laws)
- Canadian Anti-Fraud Centre (Government of Canada)