Do you have to report this privacy breach?
Answer a few questions about the incident. We'll walk you through the "real risk of significant harm" test, who you may need to notify in Canada, and the records you must keep.
- Free, no sign-up
- Takes a few minutes
- Nothing is stored unless you ask
Simple, start to finish.
Describe the incident
What happened, what information was involved and whose it was.
Assess the harm
We walk through sensitivity and probability of misuse, the two factors regulators use.
Get your checklist
Who to notify, what to include, and the records to keep.
Is this legal advice?
No. It's a guide based on public regulator guidance. Speak to a privacy lawyer for your specific situation.
Do I need to keep a record of breaches I don't report?
Yes. Under PIPEDA, organisations must keep records of every breach of security safeguards involving personal information for 24 months.
Can you help us respond to an incident?
Yes. We help contain incidents, investigate what happened and restore systems.
More free tools.
Want an expert to look at your results?
Tell us what you found. An Infinity engineer, not a salesperson, will reply within one business day.
Tell us about your IT.
We answer almost every inquiry within one business day.