Compliance
A short read on what the federal privacy law expects from a commercial organisation, and the breach reporting obligation that catches people out.
The Personal Information Protection and Electronic Documents Act applies to organisations that collect, use or disclose personal information in the course of commercial activity. Alberta, British Columbia and Quebec have substantially similar provincial laws that apply instead within those provinces, and Quebec's Law 25 in particular is stricter.
Since November 2018, a breach of security safeguards that creates a real risk of significant harm must be reported to the Office of the Privacy Commissioner of Canada, the affected individuals must be notified, and a record of every breach must be kept for twenty four months, including breaches you concluded were not reportable.
That record keeping obligation is the part most small organisations have not implemented. It is not conditional on the breach being serious.
None of this needs a law firm to begin. It does need someone to own it.
More
PHIPA sets out specific circumstances that make reporting to the Information and Privacy Commissioner mandatory, plus an annual filing most clinics do not know about.
Read the note: When an Ontario clinic must report a privacy breach
The shared responsibility model puts availability on Microsoft and your data on you. Most Ontario businesses we assess have no third party backup of mail, SharePoint or OneDrive.
Read the note: Microsoft does not back up your Microsoft 365 data
A short read on what the federal privacy law expects from a commercial organisation, and the breach reporting obligation that catches people out.
