TL;DR: Under PIPEDA, a company must notify you as soon as feasible when a breach of its safeguards creates a real risk of significant harm (RROSH) to you. The Office of the Privacy Commissioner says the notice should tell you what was compromised, what the company did about it, how you can reduce your risk and who to contact. Then: keep the notice, change passwords, monitor accounts, consider credit alerts and stay alert for months. Fraudsters are patient.
When companies must tell you
PIPEDA requires organizations to notify individuals when a breach creates a real risk of significant harm, as summarized by DWW. Notice must come "as soon as feasible" with "easy-to-understand information." (Quebec has its own rules under Law 25.)
What a good notice includes
The Office of the Privacy Commissioner says organizations should:
- contact you as soon as possible;
- tell you what personal information was compromised;
- explain what they’ve done to reduce your risk;
- give advice on how you can reduce your risk;
- include who to contact with questions.
If your letter is vague about what leaked, you’re allowed to ask. Some recent Canadian notices, like Nova Scotia Power’s, were criticized for exactly that.
Is the notice real?
Breach notices are a favourite disguise for phishing. Check before you act:
- Don’t use links or numbers in the notice to "verify" yourself. Go to the company’s website by typing it.
- Find the privacy officer contact in the company’s privacy policy (the OPC suggests this) and confirm.
- A real notice won’t ask for your password, full card number or SIN.
- Credit monitoring offers should lead to a known provider (like TransUnion or Equifax), set up through the company’s official site.
The OPC’s steps
- Read the notice carefully and keep it somewhere safe. You may need it later.
- Change passwords tied to the breach, and anywhere you reused them.
- Monitor your accounts, especially if financial info was involved.
- Consider credit alerts or order your credit report. See our free credit report guide.
- Contact the organization with questions.
- Stay vigilant over time. The OPC warns fraudsters may wait before using stolen data.
Extra steps by data type
| What leaked | Extra step |
|---|---|
| SIN | Read what to do if your SIN is stolen |
| Bank account number | Tell your bank; watch for unusual debits |
| Driver’s licence | Ask your provincial licensing office about replacement |
| Date of birth + address | Place a fraud alert |
| Email + password | 2FA everywhere, starting with email |
If you’re not satisfied
You can raise a concern with the company and then file a complaint with the federal Privacy Commissioner. Our guide to OPC complaints explains the process.
See all your breaches at once
One letter rarely tells the full story. A free email exposure check lists every known breach your address appears in.
Frequently Asked Questions
When must a Canadian company notify me of a data breach?
Under PIPEDA, when a breach creates a real risk of significant harm to you, as soon as feasible.
What should a breach notification include?
What information was compromised, what the company did to reduce harm, how you can reduce your risk and who to contact.
How do I know a breach notice is real?
Don’t use links in the notice. Visit the company’s website yourself and contact its privacy officer.
What should I do after getting a breach letter?
Keep the notice, change passwords, monitor accounts, consider credit alerts and stay alert over time.
Sources
- Office of the Privacy Commissioner: What to do if you receive a breach notification
- OPC: Advice for Canadians on breach notifications
- DWW: OPC advice on breach notifications