Privacy breach

How BC law treats it

Section 34 of the Personal Information Protection Act, SBC 2003, c 63 (PIPA) requires an organization to protect personal information in its custody or control by making reasonable security arrangements against unauthorized access, collection, use, disclosure, copying, modification, disposal or similar risks. What is reasonable depends on the sensitivity of the data and the size of the organization. A breach is often evidence that safeguards fell short. As of October 2026, PIPA contains no mandatory breach notification duty for private organizations. The Office of the Information and Privacy Commissioner for BC recommends notifying affected individuals and the Commissioner where there is a risk of harm, and voluntary notice often reduces losses. BC public bodies have been required to notify since February 1, 2023 under the Freedom of Information and Protection of Privacy Act. Organizations subject to the federal Personal Information Protection and Electronic Documents Act, SC 2000, c 5 (PIPEDA) must report to the Privacy Commissioner of Canada, and notify affected individuals, as soon as feasible after determining that a breach creates a real risk of significant harm (s. 10.1). They must also keep a record of every breach of security safeguards (s. 10.3) for 24 months under the Breach of Security Safeguards Regulations, SOR/2018-64. Civil exposure follows. Affected people may sue in negligence, breach of contract or, for wilful conduct, under the Privacy Act, RSBC 1996, c 373, and large breaches often lead to proposed class actions in the BC Supreme Court.

What it means for your business

A breach can halt operations, trigger ransom demands, expose a business to customer claims and damage its reputation. Federal reporting duties carry offence penalties for organizations covered by PIPEDA, and even where BC law imposes no notice duty, contracts with customers, payment processors and insurers often do. A written incident response plan, vendor contracts that allocate breach costs and a cyber insurance policy reviewed by counsel are the practical defences, together with basic controls such as multifactor authentication and encrypted backups. Example: A Burnaby accounting firm's bookkeeper clicks a phishing link and an intruder downloads client tax files. The firm must contain the breach, assess the risk of harm, consider notifying clients and the BC Commissioner, check its cyber policy's notice deadlines and review whether PIPEDA reporting applies to any cross border data.

Risks and common mistakes

Assuming no action is needed because PIPA has no mandatory breach notification duty. Overlooking that PIPEDA reporting and record keeping duties may apply to cross border or federally regulated activity. Missing the notice deadline in a cyber insurance policy, which can void coverage. Wiping affected systems before preserving logs and evidence needed for investigation and claims. Signing cloud and IT vendor contracts with no security obligations or breach indemnity.