No organization is too small to suffer a data breach. A lost laptop, a phishing email, a misconfigured cloud folder or an email sent to the wrong recipient can all expose personal information. What separates a manageable incident from a crisis is usually preparation: knowing who does what, which rules apply and what to say.
Here is a five-step response plan you can adapt for your business.
Step 1: Contain the breach
- Stop the leak: disable compromised accounts, reset passwords, revoke shared links, isolate affected devices.
- Preserve evidence — do not wipe systems before you understand what happened. Keep logs.
- Assemble your response team: a decision-maker, IT or security support, someone responsible for communications and, where needed, legal counsel and your cyber-insurance provider.
Step 2: Assess the risk
Under PIPEDA the key question is whether the breach creates a real risk of significant harm (RROSH). Significant harm includes humiliation, damage to reputation or relationships, financial loss, identity theft, and negative effects on credit records. Consider:
- Sensitivity: health, financial, government ID or login credentials are highly sensitive.
- Probability of misuse: Was the data encrypted? Was it accessed by a malicious actor or simply misdirected to a trusted party who deleted it? How long was it exposed?
- Scope: how many people and what types of information are involved.
Step 3: Notify the right people
Requirements differ by jurisdiction:
| Law | When to report | Who to notify |
|---|---|---|
| PIPEDA (federal) | Real risk of significant harm | OPC and affected individuals, as soon as feasible; other organizations that can reduce the harm |
| Alberta PIPA | Real risk of significant harm | Alberta’s Information and Privacy Commissioner without unreasonable delay; the Commissioner may require you to notify individuals |
| Quebec (Law 25) | Risk of serious injury | The CAI and affected individuals, promptly |
| BC PIPA | No general mandatory private-sector reporting duty at the time of writing | Voluntary reporting to BC’s OIPC is encouraged — and PIPEDA may still apply to cross-border data |
Sector-specific rules may also apply — for example, Ontario health information custodians have their own notification duties under PHIPA.
A notification to individuals under PIPEDA should include:
- A description of what happened and when (the date or period).
- The personal information involved.
- What you have done to reduce the risk of harm.
- What individuals can do to protect themselves (for example changing passwords or monitoring accounts).
- Contact information for questions.
Write in plain language, avoid minimizing the incident, and send it directly to affected people where possible.
Step 4: Record everything
PIPEDA requires you to keep a record of every breach of security safeguards for 24 months, including breaches you decided not to report. Quebec requires a register of all confidentiality incidents. Record at least the date, what happened, the information involved, your risk assessment and your reasoning, and the actions taken.
Step 5: Learn and prevent
- Find the root cause, not just the symptom.
- Fix the gap: enforce multi-factor authentication, tighten access permissions, encrypt devices, review sharing settings.
- Update training and your response plan with lessons learned.
Prepare before anything happens
The best time to write your plan is now. A one-page playbook should include:
- Names and phone numbers of the response team (stored somewhere you can reach if email is down).
- Contacts for your IT provider, cyber insurer and legal counsel.
- A risk-assessment worksheet and a breach-record template.
- Draft notification letters you can adapt quickly.
- A short tabletop exercise once a year — walk through a realistic scenario such as a phished email account.
Breach readiness is one of the 10 PIPEDA principles in action — see our PIPEDA compliance checklist for the bigger picture.
Frequently asked questions
Is a misdirected email really a breach?
Yes — any unauthorized access to or disclosure of personal information is a breach. Whether it must be reported depends on the risk assessment, but it must still be recorded.
Does encryption mean I don’t need to report?
Strong encryption with uncompromised keys can significantly lower the probability of misuse and therefore the risk. Document that reasoning in your breach record.
Get a second pair of eyes
Secure Pathways helps small and mid-sized businesses turn privacy requirements into a clear, manageable routine — from privacy audits and policy templates to consent management and breach readiness. If you are not sure where you stand on breach readiness, get in touch for a complimentary consultation.
This article is general information, not legal advice. Privacy rules change and depend on your industry and province — confirm your obligations with a qualified professional.
