A data breach happens. Maybe it's ransomware. Maybe it's a phishing attack that handed a criminal access to your email for three weeks. Maybe a staff member accidentally sent a client list to the wrong address. The incident is over — or at least contained. But now what?

For Canadian businesses, the answer is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) — specifically, the breach notification amendments that came into force in November 2018. The rules are not optional, they are not aspirational, and they do not have a "small business" exemption.

The Two-Track Obligation

PIPEDA's breach notification framework has two parallel requirements:

  1. Report to the Office of the Privacy Commissioner of Canada (OPC) — required when the breach creates a "real risk of significant harm" to any individual
  2. Notify affected individuals — required for the same threshold: real risk of significant harm

The timing requirement for notifying individuals is "as soon as feasible" — which courts and the OPC have interpreted as promptly, in plain language, without unnecessary delay. For reporting to the OPC, the same standard applies. The widely-cited 72-hour benchmark mirrors the GDPR's standard and represents what Canadian regulators and insurers consider reasonable — though PIPEDA itself uses "as soon as feasible" rather than a fixed clock.

What "Significant Risk of Harm" Means

PIPEDA defines significant harm to include bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on a credit record, and damage to or loss of property. For most small business breaches involving client records, employee data, or payment information, this threshold is met.

What You Must Report

The breach report to the OPC must include:

The OPC provides a breach report form on their website. You submit it online. There is no filing fee. But failing to submit, submitting late, or submitting inaccurate information are all violations that can be investigated and fined.

The Individual Notification Requirement

Notifying affected individuals must be done directly — not through a press release, not through your website's news section. The notification must be in plain language and must include:

The "Plain Language" Requirement

PIPEDA specifically requires breach notifications to be written in plain language. Notifications drafted in legal boilerplate — dense, passive, full of qualifications — have been criticized by the OPC and can be treated as non-compliant. Write it the way you would tell a client what happened.

The Record-Keeping Requirement Nobody Talks About

Here's the provision that catches most small businesses off guard: PIPEDA requires you to maintain a record of every breach of security safeguards — not just the ones that meet the "significant risk of harm" threshold. Every breach, regardless of severity, for a minimum of 24 months.

If the OPC conducts an audit or investigation and requests your breach records, you must produce them. If you don't have them — because you never kept them, or because a ransomware attack destroyed them — that's a separate PIPEDA violation on top of whatever the original breach was.

For a small business, a breach record doesn't have to be elaborate. A date, a description of what happened, what information was involved, whether it met the reporting threshold (and why or why not), and what was done about it. Keep it in a document, update it when incidents occur, and store it somewhere that survives a ransomware attack — which means off-network, off-site, or in a cloud system that isn't connected to your primary workstations.

The Penalty Structure

PIPEDA's enforcement teeth are modest by international standards — a maximum of $100,000 per violation — but the reputational consequences of an OPC investigation are often more damaging than the fine itself. OPC investigation reports are published. They name the organization. They describe the breach in detail. For a small business that depends on client trust — a law firm, an accounting practice, a property management company — an OPC report finding a failure to comply can be existential.

The more significant risk is class-action litigation. Following a data breach, affected individuals can sue for damages. Several class actions have been successfully certified in Canadian courts against organizations that failed to protect personal information. The damages per affected individual may be modest, but multiplied across hundreds of clients, the aggregate exposure is significant.

PIPEDA in Practice: A Small Business Scenario

Consider a five-person accounting firm. A staff member clicks a phishing link in an email that appears to come from the Canada Revenue Agency. The attacker gains access to the employee's email account for four days before the firm notices unusual activity and resets the credentials.

During those four days, the attacker had access to every email in that account — which included client names, SIN numbers, financial statements, tax returns, and correspondence about audits and disputes. Potentially hundreds of clients' data was exposed.

Under PIPEDA, the firm's obligations are:

  1. Determine whether the breach creates real risk of significant harm — given the sensitivity of the information (SINs, financial details), the answer is almost certainly yes
  2. Report to the OPC as soon as feasible after making that determination
  3. Notify every affected client directly, in plain language, with the required content
  4. Record the breach in their breach log
  5. Implement controls to prevent recurrence (MFA on email, at minimum)

Many small businesses in this scenario do none of the above. They reset the password, breathe a sigh of relief, and move on. That is a PIPEDA violation — and it compounds the original breach into a compliance failure.

The Only Real Answer Is Prevention

PIPEDA's framework assumes breaches will happen. The law doesn't require perfection — it requires reasonable safeguards and proper response when those safeguards fail. But "reasonable" is a bar that has risen considerably as security tools have become more affordable and accessible.

Multi-factor authentication, endpoint protection, and staff phishing training are no longer "enterprise" measures. They're baseline expectations. The OPC has found organizations non-compliant for failing to implement MFA on email accounts — a finding that would have been unlikely five years ago and is increasingly common today.

The goal isn't to be bulletproof. It's to be able to demonstrate, if an investigation occurs, that your safeguards were reasonable for an organization your size with the data you hold. The organizations that can't demonstrate that — and that failed to comply with the breach notification obligations when an incident did occur — are the ones that end up in published OPC reports.