Responding to a privacy breach under PIPA

What counts as a breach

A privacy breach is any loss of, unauthorized access to, or unauthorized disclosure of personal information. It is broader than a cyberattack. A stolen laptop, an email sent to the wrong client, a misconfigured shared folder, a former employee who still has access and a ransomware incident can all qualify. Many breaches are caused by ordinary mistakes rather than criminals.

Because the definition is broad, staff need to know that reporting a possible breach internally is expected and will not be punished. The sooner you know about a problem, the more options you have to contain it and the stronger your position is if you later need to explain your response to a regulator, an insurer or the people affected.

The first hours: contain and preserve

Your first goal is to stop the information from spreading further while keeping evidence intact. Avoid wiping machines or deleting suspicious emails until someone with incident response experience has looked at them, because that evidence may be needed to understand what was accessed. Containment is usually a short list of practical actions, and it helps to have the list written down in advance so nobody has to improvise under pressure.

If you have cyber insurance, call the insurer's breach line early. Many policies require prompt notice and may connect you with legal counsel and forensic support. Acting before you call can sometimes affect coverage, so check your policy wording now rather than during an incident. Keep the breach line number somewhere you can reach it even if email is down.

• Disconnect affected devices from the network, but leave them powered on
• Reset passwords and revoke sessions for compromised accounts
• Ask the recipient of a misdirected email to delete it and confirm in writing
• Start a written timeline of what happened and who did what
• Contact your IT provider, insurer and lawyer

The real risk of significant harm test

Under PIPA, an organization must notify the Office of the Information and Privacy Commissioner of Alberta without unreasonable delay when a reasonable person would consider that there exists a real risk of significant harm to an individual as a result of the breach. Significant harm can include identity theft, financial loss, humiliation, damage to reputation or relationships and similar consequences.

Assessing the risk involves looking at how sensitive the information was, who may have it, whether it was encrypted, whether it has been recovered and how likely misuse is. This is a judgment call with legal consequences, so involve your lawyer. When in doubt, many organizations consult the Commissioner's office directly for guidance.

Notifying the Commissioner and individuals

The Commissioner's office publishes a breach notification form that asks for a description of the incident, the information involved, the number of people affected, your assessment of harm and the steps you have taken. The Commissioner can require you to notify affected individuals, and notifications to individuals generally need to be made directly unless the Commissioner allows otherwise.

Notices to individuals should be plain and honest. Explain what happened, what information was involved, what you have done about it, what they can do to protect themselves and who they can contact with questions. Have your lawyer review the wording before it goes out, especially if more than one jurisdiction is involved.

After the incident

Once the immediate response is over, hold a short review. Identify the root cause, decide which controls would have prevented or limited the breach and assign owners and dates for each improvement. Common outcomes include adding multi-factor authentication, tightening shared folder permissions, encrypting laptops and improving staff training on phishing and email handling.

Keep a breach log even for incidents that did not meet the notification threshold. Recording what happened, how you assessed the risk and why you decided not to notify shows that your organization takes its obligations seriously and helps you spot patterns over time. Review the log at least once a year with your privacy lead.