Data breach

An incident in which sensitive, confidential or personal information is accessed, disclosed, stolen or lost without authorization.

A data breach can result from a cyberattack, but also from everyday mistakes: an email sent to the wrong person, a lost laptop without encryption, a misconfigured shared folder, or an employee viewing records they should not. What matters is that information ended up somewhere it should not be.

In Alberta, private sector organizations covered by the Personal Information Protection Act (PIPA) must notify the Office of the Information and Privacy Commissioner without unreasonable delay when a loss of, or unauthorized access to or disclosure of, personal information creates a real risk of significant harm to individuals. Health information custodians have their own obligations under the Health Information Act, and organizations subject to federal law have separate rules. Beyond legal duties, breaches can damage client trust, trigger contract issues and lead to costly investigations.

Practical tip: know what personal information you hold and where it lives, encrypt laptops and portable drives, and include breach assessment and notification steps in your incident response plan. Seek legal advice early when a breach occurs.