Pricing Models, Comparisons and 2026 Rules
Breach reporting in Canada: PIPEDA, Quebec Law 25 and Alberta PIPA, and what your security provider must do
When to report a breach to the OPC, the CAI or Alberta, records to keep, and how to write breach duties into a security contract.
Under PIPEDA, an organisation must report to the Office of the Privacy Commissioner of Canada (OPC) any breach of security safeguards involving personal information under its control if it is reasonable to believe the breach creates a real risk of significant harm to an individual. It must also notify affected individuals, notify other organisations that can reduce the harm, and keep a record of every breach for 24 months. In Quebec, Law 25 requires notice to the Commission d'accès à l'information (CAI) and to affected persons of confidentiality incidents presenting a risk of serious injury, plus a register of all incidents. In Alberta, PIPA requires notice to the Information and Privacy Commissioner without unreasonable delay where a reasonable person would consider there is a real risk of significant harm. In all three, the business that controls the information is responsible, even if a managed security provider or other service provider handled it, so your contract must make the provider tell you fast and give you the facts.
This guide is part of the 2026 rules section. It is general information, not legal advice; get a lawyer involved early in a real incident.
The three regimes at a glance
| PIPEDA (federal) | Quebec private-sector act as amended by Law 25 | Alberta PIPA | |
|---|---|---|---|
| Who | Private-sector organisations in commercial activity, except where a substantially similar provincial law applies; also federally regulated businesses | Enterprises holding personal information about people in Quebec | Private-sector organisations in Alberta |
| Trigger | Breach of security safeguards creating a real risk of significant harm | Confidentiality incident presenting a risk of serious injury | Loss of, unauthorised access to or disclosure of personal information where a reasonable person would consider there is a real risk of significant harm |
| Report to | OPC, as soon as feasible | CAI, promptly | Alberta Commissioner, without unreasonable delay |
| Individuals | Notify as soon as feasible | Notify promptly | The Commissioner may require the organisation to notify |
| Records | Record of every breach, kept 24 months | Register of all incidents; CAI says information kept at least five years | Check the regulation and OIPC guidance |
| Main source | PIPEDA ss. 10.1–10.3; SOR/2018-64 | CAI guidance; Règlement sur les incidents de confidentialité | PIPA ss. 34.1, 37.1 |
British Columbia's private-sector PIPA did not, as far as we could confirm, contain a mandatory breach-notification duty for businesses at the time of writing; check the BC Information and Privacy Commissioner's guidance, and remember that a BC business may still be subject to PIPEDA for some activities.
PIPEDA in detail
Real risk of significant harm. Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property (s. 10.1(7)). Factors include the sensitivity of the information and the probability that it has been, is being or will be misused (s. 10.1(8)).
The report to the OPC must be in writing and, under the Breach of Security Safeguards Regulations, describe the circumstances and cause if known, the date or period, the personal information involved, the number of individuals affected if known, the steps taken to reduce harm, the steps taken or planned to notify individuals, and a contact person. You can add information later. The OPC provides a breach report form.
Notice to individuals must allow them to understand the significance of the breach and take steps to reduce harm, and include contact information. It can be direct (in person, phone, mail, email) or, in limited cases such as when direct notice would cause further harm or undue hardship, indirect through public communication.
Records. Keep a record of every breach, including those below the threshold, for 24 months after the day you determine it occurred, and give the OPC access on request (s. 10.3; SOR/2018-64 s. 6).
Offences. Knowingly contravening the reporting, notification or record-keeping duties is an offence punishable by a fine of up to $10,000 on summary conviction or up to $100,000 on indictment (s. 28).
Service providers. The OPC says that where a processor such as a cloud or managed service provider suffers a breach, the organisation that transferred the information generally remains in control and is responsible for reporting, notification and record-keeping, and should have contractual arrangements in place. A provider that uses the data for its own purposes becomes responsible for that use.
Quebec Law 25 in detail
The CAI defines a confidentiality incident as access to, use or communication of personal information not authorised by law, its loss, or any other breach of its protection. After an incident, the enterprise must take reasonable measures to reduce the risk of injury and prevent recurrence, assess the risk of serious injury considering sensitivity, anticipated consequences and the probability of misuse, and consult its person in charge of the protection of personal information. If the risk is serious, it must promptly notify the CAI, using the CAI's notice form, and the persons concerned. It may also inform anyone who can reduce the risk.
The register covers all incidents, including those without serious risk, and records the information involved, circumstances, dates, number of people affected, the reasons for the risk assessment, notification dates and measures taken. The CAI can ask for it. The statute itself is published on LégisQuébec; we relied on the CAI's guidance because the statute portal could not be consulted automatically. The CAI can impose administrative monetary penalties, and penal fines are higher; amounts are tied to worldwide turnover for larger enterprises, so check the CAI before quoting a figure.
Alberta PIPA in detail
Section 34.1 requires an organisation with personal information under its control to notify the Commissioner without unreasonable delay of any incident involving loss of or unauthorised access to or disclosure of the information where a reasonable person would consider there is a real risk of significant harm. Under s. 37.1, the Commissioner may require the organisation to notify affected individuals within a time the Commissioner sets. Failing to notify under s. 34.1 is an offence, with fines of up to $10,000 for an individual and $100,000 for other persons (consolidation current to 1 September 2025).
Writing breach duties into the managed security contract
| Clause | Why | Illustrative wording goal |
|---|---|---|
| Notice to you | You cannot report what you do not know | Provider notifies a named contact within a fixed number of hours of suspecting an incident affecting your data |
| Facts and cooperation | The OPC, CAI or Alberta report needs details | Provider supplies timeline, systems, data types, number of records, containment steps |
| Log retention | Evidence and 24-month records | Logs and incident records kept long enough and exportable |
| No direct regulator contact | You control the message | Provider does not notify regulators or individuals on your behalf without written instruction, unless law requires |
| Sub-processors | Accountability chain | List of sub-processors and the same obligations flowed down |
| Cost allocation | Notification and credit monitoring cost money | Who pays when the breach is caused by the provider |
Check these clauses with the due-diligence checklist. Retention and cost are discussed in SIEM and log-volume pricing and incident-response retainers; critical-infrastructure rules are in Bill C-8.
Frequently asked questions
Do I have to report a ransomware attack if no data was stolen?
It depends on whether there was unauthorised access to or loss of personal information and the risk of harm. Encryption by ransomware can be a loss of access to the data. Record the incident either way and get advice on the assessment.
Is there a deadline in hours?
PIPEDA says "as soon as feasible", the CAI says "promptly" and Alberta "without unreasonable delay"; none sets a fixed number of hours for SMEs. Contracts and insurers may set shorter times.
My provider is in the US. Does that change anything?
Your duties stay the same. See SOC data residency and access.
Who pays for notifying customers?
Your business, unless the contract or a cyber policy shifts the cost.
Sources
- Office of the Privacy Commissioner of Canada — mandatory breach reporting guidance and breach report form
- Justice Laws Website — PIPEDA ss. 10.1–10.3 and 28; SOR/2018-64
- Commission d'accès à l'information du Québec — confidentiality incidents, register and notice form
- Office of the Information and Privacy Commissioner of Alberta — PIPA breach notification
- Alberta King's Printer — PIPA consolidated text
- Office of the Information and Privacy Commissioner for British Columbia — BC private-sector guidance
