Breach Notification · CA
Canada data breach notification requirements, by regime
A regime-by-regime map of your breach notification obligations under PIPEDA, provincial laws, OSFI and CCSPA, before an incident starts the clock.
WHY IT’S COMPLICATED
A PATCHWORK OF REGIMES
There is no single Canadian data breach law. Notification obligations come from a patchwork: the federal PIPEDA, provincial statutes in Quebec, Alberta and British Columbia, sector guidance from OSFI for federally regulated financial institutions, and — once in force — the Critical Cyber Systems Protection Act for designated operators of vital systems.
WHY ONE LAW DOESN’T COVER IT
What matters in practice is knowing which regime’s clock is running before an incident starts, not working it out during one. Trigger standards, deadlines and who gets notified all differ, and a plan built for one regime’s threshold does not automatically satisfy another’s.
WHO FALLS UNDER WHICH LAW
PIPEDA covers private-sector commercial activity across Canada, except activity that takes place entirely within Quebec, Alberta or British Columbia, where the province’s own “substantially similar” law applies instead: Quebec’s private-sector privacy Act (as amended by Law 25), Alberta’s PIPA and British Columbia’s PIPA. Health information custodians in Ontario, New Brunswick, Nova Scotia, and Newfoundland and Labrador follow their province’s own health privacy law. Federally regulated businesses such as banks, telecoms and transportation companies, and personal information that crosses provincial or national borders, always stay under PIPEDA. Layered on top of all of it, sector regulators add their own expectations: OSFI for federally regulated financial institutions, and, once its provisions come into force, the CCSPA for designated operators of vital systems. A single incident can sit inside more than one of these regimes at once.
THE REGIMES IN PLAY
PIPEDA, Alberta PIPA, BC PIPA, Quebec Law 25, OSFI guidance and, once in force, CCSPA. Which one applies to a given incident depends on your sector and province, and often more than one applies at once.
WHAT BILL C‑36 WOULD CHANGE
Bill C‑36, the proposed Protecting Privacy and Consumer Data Act, was introduced and given first reading on June 15, 2026. It is still before the House of Commons and is not law. If passed as introduced, it would repeal Part 1 of PIPEDA and move privacy oversight to a new Digital Safety and Data Protection Commission of Canada, with a dedicated Privacy and Consumer Data Commissioner; that Commission is itself proposed in a separate bill. Administrative monetary penalties would reach $10 million or 3% of gross global revenue, and fines for the most serious offences $25 million or 5%, whichever is greater. Until C‑36 is passed and in force, PIPEDA’s existing breach notification regime, described above, is what applies.
NOT LEGAL ADVICE
We aren’t Canadian counsel, and this page isn’t legal advice. It’s the map we’d use ourselves to work out which regime governs a specific incident — the legal interpretation of that incident is a conversation for your lawyer; we handle the security and process side. We have worked with clients in Canada, and under NDA we cannot name them.
Six regimes, different triggers
PIPEDA
Applies to private-sector commercial activity across Canada, except activity that takes place entirely within Quebec, Alberta or British Columbia. Federally regulated businesses and personal information that crosses provincial or national borders are always covered. Triggers on a “real risk of significant harm” (RROSH); report to the Privacy Commissioner and notify individuals “as soon as feasible”; keep records of every breach of security safeguards for 24 months.
Alberta PIPA
Applies to provincially regulated private-sector organizations in Alberta. Notify the Commissioner “without unreasonable delay” where a reasonable person would consider there’s a real risk of significant harm; the Commissioner can then require notification to affected individuals.
BC PIPA
Applies to provincially regulated private-sector organizations in British Columbia. Requires “reasonable security arrangements”; the Act itself does not set a mandatory breach notification obligation.
Quebec Law 25
Applies to any business operating in Quebec that handles personal information. Every confidentiality incident goes in a five-year registry; incidents presenting a risk of serious injury must be notified “promptly” to the CAI and to the individuals concerned.
OSFI (advisory)
Applies to federally regulated financial institutions. Reportable technology and cyber security incidents (for example, those the institution rates as high or critical severity) go to OSFI’s Technology Risk Division and the Lead Supervisor within 24 hours or sooner, followed by regular updates (e.g., daily).
CCSPA (not yet in force)
Will apply to designated operators of vital systems in finance, telecommunications, energy and transportation. Once in force, incidents get reported within a period prescribed by regulation, not to exceed 72 hours.
We map your obligations across every regime that applies to your sector and province.
Which regime applies to us?
It depends on your sector and where you operate, not on where you’re incorporated. A federally regulated business — a bank, a telecom — stays under PIPEDA everywhere in Canada. A provincially regulated business in Quebec, Alberta or BC generally falls under that province’s law instead. Federally regulated financial institutions add OSFI’s expectations on top, regardless of province; provincially regulated institutions fall outside OSFI’s guidelines.
Is there one deadline across Canada?
No. PIPEDA and Alberta PIPA use variations of “without unreasonable delay” or “as soon as feasible” tied to a risk threshold; Quebec requires notification “promptly” once there is a risk of serious injury; OSFI expects notice within 24 hours for reportable incidents at federally regulated financial institutions; CCSPA, once in force, will cap reporting at 72 hours. Designing around the shortest clock that applies to you helps with timing, but each regime keeps its own trigger, recipient, report content and record-keeping rule, so the plan needs a branch for each one.
Do any of these laws require penetration testing?
None of these laws requires a penetration test by name. OSFI’s B‑13 guideline names it directly, as an example of intelligence-led testing. Quebec’s Commission d’accès à l’information lists intrusion and vulnerability testing among the ways to measure whether your security measures work, and the Privacy Commissioner of Canada has called penetration testing “a critical aspect of maintaining safeguards” (PIPEDA Findings #2021-003). PIPEDA, Law 25, Alberta PIPA and BC PIPA all require reasonable security safeguards, and testing is how you show they work.
What happens when CCSPA comes into force?
Designated operators of vital systems get a 72-hour reporting cap, a 90-day deadline for a cyber security program, and explicit supply chain risk obligations. None of that is enforceable yet. The Act received Royal Assent on June 15, 2026, but its provisions come into force in phases by order, and no such order had been published as of October 2026. Readiness now means not scrambling when it is.
Our certificates
Team portfolio
Where to start?
You can copy our materials only after making sure that your services are safe.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.