What to Do After a Data Breach in Canada

1. Contain the Breach

The first priority is to stop the breach from continuing. Isolate affected systems, revoke compromised credentials, block malicious IP addresses and close exploited access points. Do not shut down or wipe systems as this destroys forensic evidence. Containment actions should be documented with timestamps so they can be included in your breach report and any subsequent legal proceedings.

2. Preserve Evidence

Engage a digital forensics team to capture volatile evidence before it is lost. This includes memory dumps, running process lists, active network connections, log files and disk images. Chain of custody must be maintained from the moment evidence is collected. Forensic evidence may be needed for regulatory investigations, insurance claims, civil litigation or criminal prosecution. Sherlock Forensics provides court-admissible evidence collection following established forensic standards.

3. Assess the Scope

Determine what data was compromised, how many individuals are affected, what systems were accessed and how the breach occurred. This assessment drives your notification obligations. Under PIPEDA you must determine whether the breach creates a "real risk of significant harm" to affected individuals. Factors include the sensitivity of the data involved, the likelihood of misuse and the number of individuals affected.

4. Report to the Privacy Commissioner

If the breach creates a real risk of significant harm you must report it to the Office of the Privacy Commissioner of Canada (OPC). The report must include a description of the breach, the type of personal information involved, the number of individuals affected, the steps taken to reduce harm and your contact information. PIPEDA requires reporting "as soon as feasible" after determining a breach has occurred. Best practice is to report within 72 hours of confirmed discovery.

5. Notify Affected Individuals

When a breach poses a real risk of significant harm to individuals you must notify them directly. Notifications must include a description of the breach, the type of personal information involved, the steps the organization is taking to reduce harm, steps individuals can take to protect themselves and contact information for someone who can answer questions. Notification must be conspicuous and delivered directly to the affected individuals unless direct notification would cause further harm.

6. Notify Third Parties

In some cases you may be required to notify other organizations that can help reduce the risk of harm. This may include law enforcement, credit bureaus, payment processors or regulatory bodies beyond the OPC. If the breach involves provincially regulated data in Alberta, British Columbia or Quebec you may have additional notification obligations under provincial privacy legislation such as BC PIPA or Alberta PIPA.

7. Maintain Breach Records

PIPEDA requires organizations to maintain records of every breach of security safeguards involving personal information regardless of whether the breach triggered reporting obligations. Records must be maintained for at least 24 months and must be available for inspection by the Privacy Commissioner on request. Records should include the date of the breach, a description of the circumstances, the personal information involved, the risk assessment and the actions taken in response.

Government Sources

• PIPEDA Overview - OPC
• Report a Privacy Breach - OPC
• Canadian Centre for Cyber Security

Related Services

• Incident Response
• Computer Forensics
• Risk Management