Canada. Breach notification. Regulation
BSSRBreach of Security Safeguards Regulations (SOR/2018-64)
In force
§1Summary
- Synopsis
Regulations under PIPEDA setting the content and manner of breach reports to the OPC and notices to affected individuals. They also require organisations to keep a record of every breach of security safeguards for at least 24 months.
- Key themes
- Unique features
Threshold is 'real risk of significant harm' (sensitivity plus probability of misuse) rather than a fixed hour deadline; every breach, even below threshold, must be logged and producible to the OPC.
- SaaS relevance
A SaaS controller suffering an incident involving Canadian personal data must assess RROSH, report and notify, and keep breach records available for OPC inspection.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- OPC + individuals as soon as feasible if RROSH; notify other organisations that can mitigate; 24-month breach log
- Maximum penalty
- CAD 100,000 per knowing contravention (via PIPEDA s.28)
§3Dates
- Key dates
- Adopted
- In force
- Published Canada Gazette II 2018-04-18
§4Text and authority
- Text
- Authoritative text laws-lois.justice.gc.ca
- Authority
- Office of the Privacy Commissioner of Canada (OPC)
§5Where it applies
- Domestic law of
- Canada
- Also applies in
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Prosecution is via Attorney General/DPP, not OPC.