Compliance

Privacy breach reporting rules for BC businesses: PIPEDA and BC PIPA explained

If your business suffers a data breach, you may be legally required to report it and notify the people affected. Which rules apply depends on whether you're covered by the federal PIPEDA or British Columbia's PIPA. Here's a plain-language summary, and the IT steps that make compliance possible.

By Star X Consulting technical teamPublished Updated 6 min read

Business team discussing a plan in a meeting

This is general information, not legal advice. Privacy law depends on your circumstances; consult a lawyer or privacy professional about your obligations.

PIPEDA: mandatory reporting since November 2018

Under the federal Breach of Security Safeguards Regulations, in force since November 1, 2018, organizations covered by PIPEDA must:

  • Assess whether a breach creates a "real risk of significant harm" (RROSH) to individuals, considering how sensitive the information is and how likely it is to be misused.
  • Report breaches that meet that threshold to the Privacy Commissioner of Canada "as soon as feasible".
  • Notify affected individuals as soon as feasible, directly in most cases, with what happened, what information was involved, what you've done and what they can do.
  • Notify other organizations, such as banks or police, if they can help reduce the harm.
  • Keep a record of every breach, reportable or not, for 24 months.

BC PIPA: notification to individuals

BC's Personal Information Protection Act governs most private-sector organizations' handling of personal information in the province. Currently, reporting a breach to the Office of the Information and Privacy Commissioner for BC (OIPC) is generally voluntary, while notifying affected individuals is expected where there's a real risk of significant harm (source). The OIPC encourages organizations to report, and reform of BC PIPA has been discussed for several years, so check for current requirements.

Separately, BC public bodies covered by FIPPA have their own mandatory breach notification rules.

What to do in the first 24 hours

  1. Contain itDisconnect affected devices, reset compromised passwords, revoke access, and stop any ongoing data loss. Don't wipe systems yet; you may need the evidence.
  2. Find out what was exposedWhich systems, which records, how many people, and whether the data was encrypted.
  3. Call your insurer's breach lineIf you have cyber insurance, they may provide legal and forensic help and need to be told early.
  4. Assess the risk of harmWith your lawyer or privacy officer, decide whether reporting and notification are required.
  5. Record everythingDates, what happened, decisions made and why. This becomes your breach record.

The IT side of compliance

You can't assess a breach you can't see. These controls make it possible to answer "what was accessed?" with facts instead of guesses:

  • Audit logging in Microsoft 365 or Google Workspace, kept long enough to investigate
  • Endpoint detection and response on every computer
  • Encryption on laptops and phones, so a lost device isn't automatically a breach
  • Access controls that limit who can see personal information
  • Backups that can restore systems without paying a ransom
  • A written incident response plan

Star X sets up these controls and helps Richmond and Delta businesses respond to incidents. See our cybersecurity services, or if you're dealing with a breach now, call (778) 312-2227 (24/7).

Questions we hear a lot

Still unsure? Call (778) 312-2227 and ask a technician directly.

Does PIPEDA or BC PIPA apply to my business?

As a general rule, BC PIPA covers private-sector organizations' handling of personal information within British Columbia, while PIPEDA applies to federally regulated businesses and to personal information that crosses provincial or national borders in the course of commercial activity. Many businesses deal with both. Confirm with a privacy lawyer.

What counts as a breach?

Under PIPEDA, a breach of security safeguards includes loss of, unauthorized access to, or unauthorized disclosure of personal information, for example a stolen laptop, a hacked mailbox containing client records, or ransomware that exfiltrates files.

How long must we keep breach records?

Under PIPEDA, records of every breach of security safeguards must be kept for 24 months after you determine the breach occurred, even breaches that don't need to be reported.

Keep reading

CybersecurityCybersecurity for Richmond and Delta businesses: MFA, endpoint protection, email security, phishing training, cyber insurance readiness and incident response.Cyber insurance requirementsWhat cyber insurers typically ask BC small businesses for, from MFA, EDR and backups to patching, training and an incident plan, and how to answer accurately.Preventing invoice and payment fraudBusiness email compromise explained for BC businesses: how criminals change bank details on real invoices, warning signs, and 7 steps to prevent it.

Stop fighting your IT. Hand it to us.

Call now for urgent problems, or book a free, no-obligation IT assessment for your office.

Call (778) 312-2227Get a free IT assessment
IT problem right now? Call (778) 312-2227