A privacy breach is the loss of, unauthorized access to, or unauthorized use or disclosure of personal information, whether it is caused by a cyberattack, a stolen laptop or an email sent to the wrong person.
It is Friday afternoon. You send a client's tax file to a contact with almost the same name. The email is gone. You cannot pull it back.
What happens next is not a matter of instinct. Canadian privacy law sets out what you must do: contain it, assess the risk, notify the right people and keep a record. This guide explains what counts as a privacy breach in Canada, what PIPEDA, Quebec's Law 25, Alberta and Ontario require, and how to respond step by step.
Quick Summary
- A privacy breach is the loss of, unauthorized access to, or unauthorized use or disclosure of personal information.
- Under PIPEDA, you must report a breach to the Privacy Commissioner and notify the people affected when it creates a real risk of significant harm.
- You must keep a record of every breach for 24 months, even the ones you do not report.
- Quebec, Alberta and Ontario's health sector have their own rules, thresholds and regulators.
- Respond in order: contain the breach, assess the risk, notify and report, then record it and prevent the next one.
What Is a Privacy Breach?
A privacy breach occurs when personal information is lost, accessed, used or disclosed without authorization. The Office of the Privacy Commissioner of Canada (OPC) puts it plainly: "A privacy breach occurs when there is a loss, unauthorized access to, use or disclosure of personal information."
PIPEDA, the federal private-sector privacy law, uses a narrower legal term, a "breach of security safeguards". It defines it as "the loss of, unauthorized access to or unauthorized disclosure of personal information resulting from a breach of an organization's security safeguards" or from a failure to establish those safeguards. Quebec's law calls the same event a "confidentiality incident".
Size does not matter. The OPC says that whether a breach "affects one person or a 1,000", it must still be reported if your assessment shows a real risk of significant harm. And the rules apply to small businesses as much as large ones.
Common Examples of a Privacy Breach
- Misdirected email or mail. A file, invoice or report sent to the wrong recipient, often through auto-complete.
- Lost or stolen devices. A laptop, phone or USB drive with client records left in a car or on a train.
- Hacked accounts and ransomware. An attacker gets into an email account, a server or a cloud folder.
- Employee snooping. Someone looks at a record they have no work reason to see.
- Over-sharing. A shared folder link that anyone can open, or a document with more information than the recipient needed.
Breaches are not rare. The OPC's 2024-2025 annual report says it received 686 breach reports under PIPEDA that year, and that approximately 20 million individual Canadian accounts were affected by these reported breaches.
Privacy Breach vs Data Breach: Is There a Difference?
In everyday use, a privacy breach and a data breach mean much the same thing. The difference is scope: a data breach can involve any data, including trade secrets, while a privacy breach always involves personal information about an identifiable person. Canadian privacy law only covers the second.
Notice that a privacy breach does not need a hacker. Most of the examples above are ordinary mistakes. Our guide to document confidentiality covers the everyday habits that cause them.
When Must You Report a Privacy Breach in Canada?
Under PIPEDA, you must report a privacy breach to the Privacy Commissioner of Canada, and notify the people affected, when it is reasonable to believe the breach creates a real risk of significant harm (RROSH) to an individual. Both must happen as soon as feasible after you determine the breach occurred.
Section 10.1 of PIPEDA says an organization "shall report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual."
What Counts as Significant Harm?
The OPC lists the kinds of harm that count: "bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property."
How Do You Assess the Risk?
The OPC says the two factors are "the sensitivity of the personal information involved" and "the probability that the personal information has been, is being, or will be, misused." Health and financial information is generally sensitive. To judge probability, the OPC suggests questions such as who could have accessed the information, how long it was exposed, whether there is evidence of malicious intent, and whether the information was adequately encrypted.
A file sent to a trusted colleague at the wrong firm who confirms deletion is lower risk than a laptop stolen from a car. Both still need a record.
What Do Quebec, Alberta and Ontario Require?
Quebec, Alberta and Ontario's health sector have their own breach rules. Quebec requires notice when an incident presents a risk of serious injury, Alberta requires notice to its Commissioner when there is a real risk of significant harm, and Ontario health custodians must report certain breaches to the IPC.
| Law | What it is called | Report to the regulator when | Records |
|---|---|---|---|
| PIPEDA (federal, private sector) | Breach of security safeguards | Real risk of significant harm, as soon as feasible | Every breach, kept 24 months |
| Quebec private-sector Act (Law 25) | Confidentiality incident | Risk of serious injury, promptly | Register of every incident |
| Alberta PIPA (private sector) | Loss of or unauthorized access to or disclosure of personal information | Real risk of significant harm, without unreasonable delay | Not covered in this table |
| Ontario PHIPA (health custodians) | Theft, loss, or use or disclosure without authority | In the situations set out in the regulation, at the first reasonable opportunity | Annual statistics to the IPC by March 1 |
Rules as published by each law or regulator, checked on November 8, 2026.
Quebec: Confidentiality Incidents Under Law 25
Quebec's private-sector law says that "if the incident presents a risk of serious injury, the person carrying on an enterprise must promptly notify the Commission d'accès à l'information" and must also notify the people whose information is concerned. Section 3.8 adds: "A person carrying on an enterprise must keep a register of confidentiality incidents." Our guide to Quebec Law 25 covers the rest of the law.
Alberta: Notify the Commissioner
Alberta's Personal Information Protection Act requires an organization to notify the Commissioner "without unreasonable delay" where "a reasonable person would consider that there exists a real risk of significant harm to an individual." The Alberta Commissioner may then require you to notify the people affected.
Privacy Breach in Ontario: Health Custodians
The OPC lists Alberta, British Columbia and Quebec as the provinces with their own private-sector privacy laws, so most Ontario businesses follow PIPEDA. Ontario's health information custodians follow PHIPA, its health privacy law. Ontario's Information and Privacy Commissioner (IPC) says custodians "must notify the Information and Privacy Commissioner of Ontario (IPC) at the first reasonable opportunity about certain privacy breaches", in seven categories that include stolen information and snooping.
The IPC adds that even when you do not need to notify it, "you have a separate duty to notify individuals whose privacy has been breached". And "by March 1, custodians are required to provide the IPC with an annual report of the previous calendar year's statistics." Our guide to PHIPA explains the rest of the Act.
What Should You Do After a Privacy Breach?
After a privacy breach, contain it first, then assess the real risk of significant harm, notify the affected people and the regulator if that threshold is met, and record what happened. The OPC's guidance for businesses follows this order, and the same steps work under Quebec, Alberta and Ontario rules.
1. Contain the Breach
Stop the leak. The OPC's containment tips include resetting affected passwords right away when a breach comes from a hacked account, and disconnecting affected systems. For a misdirected file, it says: "If personal information is sent to someone by mistake, ask them to delete it, send it back securely or have it ready for you to collect." Tell your privacy officer, IT and legal contacts.
2. Assess the Risk
Work out what information was involved, how many people are affected, who has it now and whether it was encrypted. Then apply the test for your law: real risk of significant harm (PIPEDA, Alberta) or risk of serious injury (Quebec). In Quebec, the law also says you must consult the person in charge of the protection of personal information within the enterprise.
3. Notify and Report
If the threshold is met, report to the regulator and notify the people affected. Under PIPEDA's regulations, a notice to individuals must describe what happened, when, what information was involved, what you have done to reduce the risk, what they can do, and who to contact. The OPC also says you must notify other organizations, such as law enforcement or a payment processor, if they can reduce the risk of harm.
4. Record It and Prevent the Next One
Under PIPEDA, you must "keep and maintain a record of every breach of security safeguards", whether or not you reported it. The regulations require you to keep each record for 24 months after you determine the breach occurred. The OPC expects a record to include the date, a description of what happened, the type of information involved, and whether you reported it and notified individuals.
Then fix the cause. The OPC's prevention tips include an incident response plan, collecting only what you need, staff training, clear contracts with service providers, and "strong encryption on laptops, USB drives, and other devices that leave the office." A privacy impact assessment helps you catch these risks before a new system goes live.
What Are the Penalties for a Privacy Breach in Canada?
Under PIPEDA, the breach-related fines are for knowingly failing to report, notify or keep records, up to $100,000 CAD. Quebec's law goes further: its penalties also cover not taking the security measures needed to protect personal information, up to $25,000,000 CAD or 4% of worldwide turnover.
| Law | What triggers it | Maximum amount |
|---|---|---|
| PIPEDA, section 28 | Knowingly contravening the breach reporting, notification or record-keeping rules | $100,000 CAD (indictable offence); $10,000 CAD (summary conviction) |
| Quebec Act, sections 90.1 and 90.12 | Monetary administrative penalty, for example for not reporting a confidentiality incident | $10,000,000 CAD or 2% of worldwide turnover, if greater |
| Quebec Act, section 91 | Penal offence, for example failing to report an incident or not taking the necessary security measures | $25,000,000 CAD or 4% of worldwide turnover, if greater |
Maximums as written in each Act, checked on November 8, 2026. The OPC notes that it does not prosecute offences or issue fines itself; it can refer information to the Attorney General of Canada.
How Can You Prevent a Privacy Breach When Sending Files?
You can prevent most file-sharing breaches by replacing plain email attachments with a secure link that needs a passphrase shared separately, expires on a set date, and shows when the file was retrieved. A wrong address then exposes a link the recipient cannot open, not the file itself.
Email was built for messages, not for client records. An attachment lands in the recipient's inbox, can be forwarded, and stays there for years. Our guide on whether email is secure explains the risks, and our guide to sending documents securely compares the safer options.
| Breach risk | Plain email attachment | Secure link with a passphrase |
|---|---|---|
| Sent to the wrong address | The file is delivered and readable | The recipient also needs the passphrase, shared by phone or text |
| Old files in inboxes | Kept until someone deletes them | The link expires on the date you set |
| Knowing who has the file | No record once it is sent | Status shows when the transfer is retrieved |
| Changing your mind | Cannot be recalled reliably | Cancel the transfer before it is downloaded |
A Safer Way to Send Client Files
This is where SureSend comes into the picture. SureSend is a Canadian secure file transfer service that sends files through a passphrase-protected link that expires on a date you choose. SureSend encrypts every file while it's sent and while it's stored (TLS in transit, AES-256 at rest). It gives you the safeguards a breach response asks about: who could open the file, for how long, and whether it was retrieved.
Here is exactly how it works:
- Create a transfer. Sign in, add one or more recipient email addresses, upload your files, and choose an expiry date of up to 21 days.
- Set a passphrase. SureSend emails each recipient a secure link, but the passphrase is never included in that email. You share it separately, by phone or text.
- The recipient downloads. They open the link, enter the passphrase, and download the files. They do not need a SureSend account.
- Track and control it. Your dashboard shows when the transfer is retrieved. You can cancel it before it is downloaded, and it expires automatically.
Each transfer allows one successful download. If the download is interrupted, the recipient can try again until one download completes; after that the link cannot be used again, and the transfer's status updates to Retrieved.
Your dashboard lists every transfer with its status, so if a link went to the wrong person, you can see whether it was retrieved and cancel it if it was not.
Your recipient needs no account. You can start on the free Starter plan. Pro is $7 CAD/month plus applicable taxes, with transfers up to 2 GB. SureSend doesn't keep your files forever; they're removed when the transfer expires. A secure transfer tool is one safeguard within your privacy program, not a compliance solution on its own.
Make the Wrong Address a Smaller Problem
SureSend encrypts every file while it's sent and while it's stored: TLS in transit and AES-256 encryption at rest. Send up to 2 GB per transfer, protect it with a passphrase you share separately, set an expiry of up to 21 days, and see when it is retrieved. Your recipient needs no account. New subscribers get 30 days of Pro free, with no credit card required. Start sending securely for free.
A Quick Workflow That Works
Put this on one page and share it with your team before you need it:
- Name the person who leads breach response, and how to reach them after hours.
- Contain first: reset passwords, disconnect systems, ask a wrong recipient to delete the file.
- Assess the risk using sensitivity and probability of misuse.
- Report and notify if the threshold for your law is met.
- Record every breach, reported or not, and keep the record for at least 24 months.
- Fix the cause, starting with how files leave the office.
If you can send an email, you can SureSend a file.
Frequently Asked Questions
What is the meaning of a privacy breach?
A privacy breach is the loss of, unauthorized access to, or unauthorized use or disclosure of personal information. The OPC uses this definition for businesses across Canada.
Is sending an email to the wrong person a privacy breach?
Yes, if the email contains personal information, sending it to the wrong person is an unauthorized disclosure. Under PIPEDA you must record it, and report it if it creates a real risk of significant harm.
Do I have to report every privacy breach?
No. Under PIPEDA, you report to the Privacy Commissioner and notify individuals only when a breach creates a real risk of significant harm. You must still keep a record of every breach for 24 months.
How quickly must a privacy breach be reported in Canada?
PIPEDA requires reports and notifications as soon as feasible after you determine a breach has occurred. Quebec requires prompt notice, Alberta requires notice without unreasonable delay, and Ontario health custodians must notify the IPC at the first reasonable opportunity.
Who do I report a privacy breach to in Ontario?
Most Ontario businesses report to the Office of the Privacy Commissioner of Canada under PIPEDA. Health information custodians report certain breaches to Ontario's Information and Privacy Commissioner under PHIPA.
What is a real risk of significant harm?
It is PIPEDA's test for reporting a breach. The OPC says it depends on the sensitivity of the personal information and the probability that it has been, is being, or will be misused.
How does SureSend protect files?
SureSend encrypts files in transit (TLS) and at rest (AES-256), and SureSend manages the encryption keys. The passphrase is never included in the email with the link.
Sources
This article draws on the following sources, checked on November 8, 2026. Laws and regulator guidance change, so confirm the current version on each page.
- Office of the Privacy Commissioner of Canada. What you need to know about mandatory reporting of breaches of security safeguards. priv.gc.ca
- Office of the Privacy Commissioner of Canada. Contain a privacy breach at your business. priv.gc.ca
- Office of the Privacy Commissioner of Canada. Prevent a privacy breach at your business. priv.gc.ca
- Office of the Privacy Commissioner of Canada. 2024-2025 Annual Report to Parliament. priv.gc.ca
- Government of Canada, Justice Laws. Personal Information Protection and Electronic Documents Act, sections 2, 10.1, 10.3 and 28. laws-lois.justice.gc.ca
- Government of Canada, Justice Laws. Breach of Security Safeguards Regulations (SOR/2018-64). laws-lois.justice.gc.ca
- Government of Quebec, LégisQuébec. Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), sections 3.5 to 3.8, 90.1, 90.12 and 91. legisquebec.gouv.qc.ca
- Office of the Information and Privacy Commissioner of Alberta. How to Notify the OIPC of a Privacy Breach. oipc.ab.ca
- Office of the Privacy Commissioner of Canada. PIPEDA requirements in brief. priv.gc.ca
- Information and Privacy Commissioner of Ontario. Report a health privacy breach. ipc.on.ca
The Bottom Line
A privacy breach is often a small mistake with large consequences. Canadian law does not expect you to never make one; it expects you to contain it, assess it honestly, tell the right people and keep a record.
Have the plan ready. Then just SureSend it.